Hacker News Reader

Comment by mmastrac | Hacker News Reader

It seems like there are two possibilities to me:

1) Bloomberg has a number of sources that are mistaken/misinformed, but this is not necessarily a made-up story, or

2) Bloomberg is nearly correct (minus some technical details) but the US government is forcing these companies to respond as if the story is wrong - possibly because of diplomatic reasons.

What is the likelihood that #2 is correct?

(there are other alternatives, but I believe that the likelihood that this is 100% or at least majorly fabricated by Bloomberg is near enough to zero)

View on HN

Taking the writer's statements as truth, 6 out of 17 sources for the original Bloomberg story were government. Presuming the information was classified, each one of those individuals is risking losing their job and going to prison for talking about it.

What kind of conclusions the writers made from talking to the other 11 sources, what seniority they had, or even what companies they were from besides 3 from Apple, are anyone's guess.

I always am suspect when a government official or employee releases classified information. In some cases extreme moral outrage seems very plausible (Manning, Snowden.) The information is so startling the leaker decides they can handle spending much of the rest of their life in prison. In a much larger number of cases it is for political reasons (Libby, countless other stories where the source is never identified.) Many times, however, I suspect, the information is made up and then no laws have been broken, as far as I understand it.

The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.

> The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.

Would the US government have to force these companies to lie? It's quite possible that the denials were the result of voluntary cooperation.

A public company issuing such strongly-worded denials that turn out to be untrue would be leaving themselves at risk of an investigation by the SEC and/or a shareholder lawsuit.

It would be pretty extraordinary for the government to sue a company for cooperating with the government.

A company has to follow court orders. The government would have to sue itself.

The SEC prides itself on its independence; I don't think it would have any problem taking on a company that lied on behalf of some other agency of the federal government.

Now, a court order would indeed be something different, but I find it hard to conceive of a judge compelling a company to lie.

If they didn't have to lie and there was no legal order but voluntary cooperation, as the grandparent post suggests, then such voluntary misinformation can easily be a violation of SEC requirements; and one part of the government certainly can prosecute you for doing something that another part of the government suggested (but didn't/couldn't legally require), it wouldn't be the first time.

> The US cannot force those companies to lie

That's a nice government tender you're working on, looks very profitable! Would be a shame if someone rejected it because reasons.

While it isn't the direct influence described i imagine this scenario is highly effective and getting companies to stay in line.

Is it really so clear-cut what the US can do? Maybe this so significant (it may well be if the allegations are correct) that they're running a campaign to really try to make people believe that this story is false.

The companies may have a strong incentive to cooperate in this campaign too, both to save face and government relations.

Unfortunately all of Bloomberg's allegations don't hold much water either, even though it'd be so easy for them to make the story credible with some details.

What case law exists for not being able to force a company to lie? Particularly non-press.

But if the story was entirely false, they'd have sued Bloomberg for libel already.

Well, the story just came out a few days ago. I wouldn't rule it out in the future, nor would I leap to the conclusion that an absence of such a move means there's truth to the story.

There could be other arrangements made with Bloomberg that would be jeopardized by that course of action. EG... you find a serious piece of news that can destroy me, so I pay you or make another arrangement to prevent that. If I later turn around and sue you, our backroom deal could blow up in my face. Too much is unknown right now.

That might still be in the works, legal process moves slowly. If we don't hear anything in another week or so, this could be worth considering.

>The US cannot force those companies to lie.

When it comes to companies like ATT/Verizon it seems like no forcing is necessary. They are complicit.

You are right and you are wrong. Legally, you are right. Practically, there is evidence that various elements in the US Government have at times coerced people into making untrue statements.

But they probably can force a handful of engineers to tell nothing to their employer, who would be vehemently denying in good faith.

How would the government get in contact with the engineers who discovered the hack without going through their managers, the CISO, etc. ?

An LRAD "Voice of God" would certainly get their attention.

https://www.wired.com/2007/12/the-voice-of-go/

Not only would they have to force the engineers to tell nothing, they'd have to force all capable engineers to vehemently deny it to their bosses who ask or ask them to look again.

>The US cannot force those companies to lie.

But they can. Maybe only in cases where silence is a canary, but that still sets a precedence for them being able to force you to lie.

You have it backwards. The government can't force them to put out "no comment" press releases. They can force them not to reveal certain information. Maybe that means the only logical thing to do is to say "no comment", but it certainly doesn't prevent a company from commenting as long as they don't reveal the gagged info.

It's interesting that everyone is assuming the only country interested in pressuring them to lie would be the US rather than China.

or 3) Bloomberg is vaguely correct, but wrong in the specifics, including naming Apple and Amazon.

I.e., They get credible reports of SuperMicro servers having been compromised, they know that Apple and Amazon are customers. They find 1 over eager source willing to say Apple and or Amazon received compromised servers.

My take on this is that it's been fairly obvious for a long time that these kinds of attacks are possible (if not easy) with today's technology. One could design a microcontroller, for example, that was disguised as an 0805 capacitor and functioned like an 0805 capacitor, but also had other functionality.

So why is this suddenly breaking news? It bears resemblance to most of the propaganda stories we have seen in recent years:

- it is based on truth. Supply chain attacks are known to exist

- the US government has a goal of escalating with China over trade and IP practices.

- national security threats justify nearly any form of government action in today's world.

- the story turns out to have been leaked through foreign sources. This is typically the pattern we see because of concerns about propaganda coming directly from US government officials to US news outlets. There is typically a middle layer that is outside of the US where the allegations can originate from until they are broadly accepted as fact.

So Apple and Google are not really lying. Chances are there has not been any sort of major security breach in either of those companies due to supply chain attacks. It is possible that they have been barred from revealing information about it for national security reasons (in this case propaganda reasons).

So I think we can expect the following next steps:

- The story will continue to hover in this slow reveal format until enough laypeople come to understand the key concepts -- circuit assembly, components, trojan horse components, QC processes, subcontractors, etc. Once the stage has been set there will be more revelations and leaks from major companies that corroborate the story.

The goal is to make China the crisis in the buildup to the 2020 election. It's not a coincidence that this strategy is getting underway right after the midterm elections in the US.

Our president has already been attacking China with rhetoric and trade sanctions, and this story is meant to turn public opinion broadly against China.

The supply chain attacks do not have to have been significant (or successful) to make this happen. The very idea that "sneaky" Chinese intelligence agencies and firms would be able to slip this by US firms' quality control measures is enough to inflict paranoia on Americans and help them start to view China as a terrifying adversary that must be stopped.

China's military outnumbers the US military by 20:1 in terms of the number of active duty fighters, and China's economy is approaching first world standards in major cities far faster than the US had ever expected. China dominates scientific publications in the hard sciences, and its top universities are 10x more competitive (or more) than top US universities.

So hawks in the US realize that this may be the last opportunity for some sort of power projection or military driven containment of China's ambitions.

This is foolhardy, because China is led by a group of highly rational people whose policy responses to the administration's trade threats have been masterful and precise, and have conveyed with no uncertainty that China will not be bullied.

So what we're seeing is a short time horizon strategy by the US which is meant to have electoral consequences in 2020 and pave the way for some degree of hostile escalation with China. US weapons systems are still significantly more advanced, but China has likely weaponized many aspects of US infrastructure via these sorts of supply chain attacks. My guess is that the US Government is not aware of many of these, and will panic when they are discovered.

Fortunately for us all, China's leadership is calm and not prone to knee-jerk responses. China is rising to world prominence faster than expected, and the US will not take that lying down. However it is probably too late at this point, as China has a tremendous amount of soft power stemming from its importance to the US supply chain. Because of this there is still much hope for a peaceful, trade-driven equilibrium to emerge.

> Our president has already been attacking China with rhetoric and trade sanctions, and this story is meant to turn public opinion broadly against China.

Ah yes, Bloomberg, well-known for protectionist rhetoric and support for Trump.

> top universities are 10x more competitive (or more) than top US universities. A citation would be very helpful here. And no, number of paper's published isn

> This is foolhardy, because China is led by a group of highly rational people whose policy responses to the administration's trade threats have been masterful and precise, and have conveyed with no uncertainty that China will not be bullied.

Citation also needed. They're so rational, they just detained the president of Interpol, have committed mass internment of Muslim citizens, and can't go six months without trying to ram NATO ships in international waters.

> but China has likely weaponized many aspects of US infrastructure via these sorts of supply chain attacks

Wait, what? So doesn't that mean the hawks were right to be suspicious? And that this really should be a national security concern? "This is all just a pretense to make people afraid of the PRC! By the way, you should be afraid of the PRC."

> Ah yes, Bloomberg, well-known for protectionist rhetoric and support for Trump.

To be fair, many of Bloomberg's sources were government, so the government could easily have said "we'll leak this to Bloomberg." It doesn't require Bloomberg to have a protectionist agenda more than being a pawn.

I agree with you on the rest though; "masterful and precise" in particular seems pretty farfetched and ridiculous, and many parts of China's economy look like a house of cards.

You're conflating rationality with propriety. China wanted Meng Hongwei to make it easier to use Interpol to track down Chinese dissidents, directly in conflict with the Interpol charter; and merely two years later they kidnap, disappear him, and charge him with disloyalty to the Chinese Communist Party. He was supposed to be their stooge pigeon, but was clearly ineffective. Again from their point of view, entirely rational to have him removed because he wasn't doing what was expected. And that's what's so conspicuous, they openly admit China was his master, not Interpol.

China, Xi, and the Party are in a sense all one in the same thing. There is nothing more important than loyalty to the one Party, and the concept of one Party rule. And Uighurs are a threat to that, so they're labeled terrorists. If you accept the idea that one party rule is necessary, it's entirely rational to aggressively, perhaps even violently, ban all possible opposition. That's the nature of any autocracy.

POTUS has also explicitly stated China is meddling in the 2018 election, against him and Republicans, and assigned a motive.

“They do not want me or us to win because I am the first president ever to challenge China on trade,”

And converse to the calm of China, he is impulsive and has floated the idea of selective defaults on Treasury securities. And he has ample experience with this himself. It is in the realm of ridiculous conspiracy theories, but POTUS is a walking pile of ridiculous conspiracies theories, so why is defaulting on only Chinese owned securities more ridiculous than nuking Pyongyong? (Of course, only one of those can actually be contained.)

   > China's leadership is calm and not prone to knee-jerk responses

Communist China is ruled by a genocidal mafia with a well-known penchant for sudden outbursts of violence. From its bloody inception, through the Great Leap Forward, the TianAnMen Massacre, the persecution of FaLunGong followers and recently Muslims — the regime has shown it's completely incapable of serving its people. When times get tough they invariably turn to intimidation and murder.

You're not refuting anything the post you're responding says.

Murdering people can be a completely non knee-jerk response to domestic issues. They ARE getting away with it, aren't they?

That's certainly one way to look at it.

I guess I'm projecting some semblance of humanity onto them. I'd assume even the most evil would usually want to hold off murder till nothing else works. Hopefully karma is about to catch up.

>One could design a microcontroller, for example, that was disguised as an 0805 capacitor and functioned like an 0805 capacitor, but also had other functionality.

Don't you think it's going to be suspicious when you see a capacitor with 6 pins? Don't you think anyone that inspects the motherboard is going to wonder why a capacitor has 4 additional lines going to a critical flash chip? Seriously.... The entire article here is around replacing entire components. Adding new traces to a finished PCB is impossible without using wire that will be suspicious to anyone doing a visual inspection. Most sabotage will probably just program the flash chips with malicious software without changing the hardware or swap big components that use standardised footprints like QFN with a nearly identical part. Adding a small capacitor sized micro controller where it doesn't belong and on top of that connect it to existing chips in comparison is extremely hard. At that point you might as well design the backdoor into the PCB itself and embed it between the individual layers of the PCB.

It would not have to have more than two leads, depending on its use in the circuit. It was an example meant to illustrate how the dramatically different levels of miniaturization can make it hard to reason about attack vectors.

Consider what a state actor could do with access to modern microprocessor level fabrication.

I'd expect that we'd see features such as the following:

- sophisticated intra-chip communication

- long periods of total dormancy of the exploits

- circuitry capable of receiving a "it's safe to begin the attack" message

- surprising communications vectors for exfiltration

- technology to make malicious parts appear under x-ray to be normal

- fallback to awaiting the message to perform DoS if more sophisticated attack vectors are not possible

I agree with your suggestion about using the existing footprint, etc. There is likely some very sophisticated tech for making malicious parts x-ray and test as normal in every respect.

The network connector exploit described in the article would be easily detectable by temperature dissipation measurements. So distributed methodologies are likely in use.

I'd also estimate that a large number of mobile devices have built-in hardware compromises that are dormant and can be used if necessary. These would be the simplest attacks to carry out and would have extremely high yield. Things like:

- phones suddenly jamming the 4G and WiFi network simultaneously

- hardware implants to help detect whether a device is being used by a high value target. Such an attack could be created using a tiny bit of silicon and would be dormant in most cases.

The biggest risk to a state actor doing these kinds of attacks is being detected, so firmware based attacks are potentially more risky than hardware attacks, since we are better at detecting a checksum mismatch than we are at testing hardware across the spectrum of possible input conditions that might trigger unusual behavior.

So I think we'd see state actors dipping their toe in slowly to these kinds of attacks, first establishing the supply chain hacks without anything malicious going on, and then gradually phasing in actual malicious hardware once the relevant parameters for the attack are better understood.

What is the likelihood that #2 is correct?

I read a lot of (recent) American history books - #2 gets my vote.

Reply on news.ycombinator.com