Hacker News Reader

Comment by wanderingjew | Hacker News Reader

The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit.

What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and even the position of the 'exploit' in the article's graphics is accurate. This is obfuscated because of an ongoing investigation. It's real, but there's purposeful misinformation, combined with a journalistic game of telephone or chinese whispers.

It's also about the worst possible way to drop and 0-day, but whatever.

View on HN

Why would Apple and Amazon release such vehement denials, though? If it were an ongoing investigation, wouldn't they use more hedging and obfuscatory language? They could just as easily say "we're not aware of anything like this, but we take all allegations of this nature seriously and are looking into it". The whole situation is just odd.

Obviously to quiet their contractor and client fears. Shareholders know that replacing the hardware would be a major cost and PR damage intense.

It's still an odd strategic move though. They could get caught in the lie, in which case they would both be exposed to pretty serious legal and financial trouble.

Replacing the hardware would be cheap compared to the hit they could take getting caught in such an outright lie. Public companies have obligations to their shareholders not to lie about things like this. They're opening themselves up to lawsuits.

Their reputations could take a huge hit from this story alone, so a strong denial is the first defense. If they are unaware of any investigation, as they claim, then that makes even more sense.

The part I don't understand is why Apple would take such a huge PR hit from the story. I way I read it is that they found out about the problem, diagnosed it and replaced all servers all within a very short time. A careful writeup about what happened, what kind of information that might have leaked, and what they do to avoid it in the future would to me be a net PR win at this point. The next question would be how all other customers has acted.

If Apple were to agree with and state that China is spying on them, then they might face repercussions from the Chinese government on their extensive business interests in China. They make all the stuff there. This is monetary threat to Apple, so lying is within character for a corporation to preserve their business.

If the story were true Apple cannot lie about it publicly like this; the SEC would have their heads.

They would have to hedge, "we are investigating Bloomberg's allegations and take security seriously."

I wonder why people on HN take these arguments seriously.

You either anger govt that is authoritarian & capable of confiscating your entire production (basically ending your current business)

You make some half-truth statement (not necessary to be lying, but that does not change the point), and - if everything will be revealed - one agency of democratic govt will be pissed and slap you with big fine.

Basically this is big enough to make SEC meaningless.

The idea that the Chinese gov't would seize Apple's "entire production" is up there with the possibility that the US invades China. It isn't going to happen. There are just too many consequences, not least of which is the withdrawal of most US companies from China.

The SEC on the other hand literally just got done fining Elon Musk $20m for a tweet. Fines for something like this could be in the hundreds of millions, that's not something you risk when you could just say "we are investigating the claims and take them seriously."

SEC fined him over something so much easier to verify that I wonder why is everybody bringing it up? Why do you think truthiness of Apple'a / Amazon's statements will be obvious in next year or two? Why do you think that accussation like "China is hacking our HW" from Apple would not escalate situation dramatically? (implicating they have to deny as hard as possible)

It's such obvious damage control in shit-has-publicly-hit-the-fan situation ... Why do you think SEC's fines (lol $20M, even for Tesla/Musk it's not a big deal, Apple would have to be hit with 100times that to even notice it) are even relevant now?

And "It isn't going to happen." could have been said about hardware attacks on USA from China last week. Situation has changed quite a bit, China is either starting to abuse its hw monopoly or someone is doing A LOT to prevent such scenario, so the stakes are too high for simple SEC fines to be worth discussing.

Lying publicly and on the record about something that should have been disclosed in their financials as a risk is not something the SEC would take kindly to.

Publicly traded companies do not have the same freedom to lie because the truth or falsity of this claim has a direct impact on their stock price. Something we just saw with Musk less than a week ago.

I certainly understand why they wouldn't want people to know about it. But lying outright in a public statement in a way that is direct and clear could expose them to serious legal risk. Trading PR risk for legal risk seems like a dangerous move that companies this large wouldn't take lightly.

For me, the Apple piece is not as black and white.

> "Our best guess is that they are confusing their story with a previously-reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple."

They deny Bloomberg's specifics, but basically admit that the general attack vector very much works.

That quote seems to be describing a software attack, not a hardware attack.

> "chinese whispers"

Does anyone have a better phrase for this?

A Chinese workmate called me out for using that phrase in his presence. Until then I had used the phrase since childhood without thinking that there were connotations and with nobody complaining. However, after that one fateful conversation I did see that my language could be improved. But how?

Does anyone have a concise alternative that conveys the same thing without implying anything about how Chinese people communicate in whispers, to get things wrong?

Not a native speaker: Does it have additional meaning to the reference to the children's game where everyone whispers to their neighbor, passing a message along? If not, isn't that also known as the "telephone game"?

I was going to reply "I don't know, it's all Greek to me" but then decided that was not a good idea. So, [0] says

> Chinese whispers is the British term for what is known as the telephone game in the United States

and then lists several other names for the same game. I've also met people who when discussing confusing messages say "send three and fourpence, we're going to a dance", which is a result of 'Chinese whispers' being applied to the input "send reinforcements, we're going to advance". The reference to the pre-decimal coinage ('three and fourpence', i.e. three shillings and four pence, approx £0.17) in this old phrase shows how long the concept has been around in British English (we decimalised in 1971).

[0] https://en.wikipedia.org/wiki/Chinese_whispers

In France it is the "Arab telephone" !

I had never even heard the phrase until this thread. A quick google/wikipedia shows me it's the British term for what we in the US call "telephone". I guess I learned something new today.

https://en.wikipedia.org/wiki/Chinese_whispers#Etymology

> As the game is popular among children worldwide, it is also known under various other names depending on locality, such as Russian scandal,[3] whisper down the lane, broken telephone, operator, grapevine, gossip, don't drink the milk, secret message, the messenger game, and pass the message among others.[1] In France, it is called téléphone arabe (Arabic telephone) or téléphone sans fil (wireless telephone).[4][better source needed] In Malaysia, this game is commonly referred to as telefon rosak, which translates to broken telephone. In the United States, the game is known under the name telephone – which in this use is never shortened to the colloquial and more common word phone.

The Telephone Game is not common parlance in British English, just American English. So a better phrase is sought than that to convey the idea.

I suspect there is no common phrase. Chinese whispers isn't common parlance in american english.

"Pass the message" or just "whispering game" seems to be the same.

This also illustrates why hardware implants do not work as a mass infiltration tool. The idea is not getting caught, otherwise risking the whole operation. Implementing a threat like this is counterproductive.

Intel ME seems pretty successful though.

This amazes me. Everyone freaks about the Chinese doing it, whereas we're surrounded by millions of computers doing the same thing - or at least able to - without us even knowing or being able to block it.

I suppose a big difference is that Intel ME is on the spec sheet, is known about, and is sold as a feature for sysadmins. It's not cool that it's not optional, but it can be switched off.

Reply on news.ycombinator.com