Hacker News Reader

Comment by jackconnor | Hacker News Reader

There should be hundreds of thousands or millions of these hacked motherboards, and nobody has found a single one despite hardware geeks worldwide searching like it was Willy Wonka's final golden ticket. This story was bogus, it most likely came from a ton of rumors that got conflated, hence why they had to go with anonymous sources as opposed to any physical evidence. I'd be surprised if Bloomberg has any credibility in tech journalism by the end of the year, and a good chance they may end up stuck in a courtroom trying to defend the decision to run this piece (on the front page, no less) for a long, long time.

View on HN

"There should be hundreds of thousands or millions of these hacked motherboards"

No, the boards would be selectively hacked.

And we know it happens because 'we' do it as well.

Surely there is evidence floating around but it's also unlikely that companies would want to admit the breach.

I kind of believe Apple and Amazon though, there's too much risk if they were to be caught lying.

This is a weird one ...

But surely there's at least a few thousand of the hacked boards? The article mentioned a data center and entire companies being targeted. All it would take is someone to dig up some junked boards, unless they were intentionally destroyed to hide evidence. Unlike 0 days or other issues, this seems like it would be easy to reproduce. Just need to find the boards.

Things are hacked often with a specific facility or installation in mind. It could be as little has a handful and that'd be enough to compromise a lot.

I actually don't care what the truth [edit: truth of this specific BMRG story] is - the West needs a 'wake up call' on this one and any company installing hardware should be inspecting everything that comes in.

Too much lax security out there, sadly, the US gov I don't think is competent enough in this area to provide guidelines.

I wish there was a CIO right in the White House cabinet, who could work with the Valley + Security experts to provide minimum guidelines for everyone, and to make everyone aware of certain things.

I'm glad the internet was designed to be 'open first' but not glad it was designed to be almost inherently insecure as well. 'Open but Secure' by default would be nice :)

> I actually don't care what the truth is

Why are you in this thread at all then?

Because 'the truth of the Bloomberg story' is not important - what matters is 'what's actually happening' in the world. And this kind of hacking is definitely happening irrespective of how right/wrong the Bloomberg report is.

So why are you rambling on about unrelated pet topics in HN threads?

Do you truly believe his point to be unrelated, this isn't a debate about GP's tone?

I think what parent touches on in their "tangent" is indeed the most important thing to come out of this story.

I do truly believe it to be unrelated and veering into attractive-but-unsubstantiated conspiracy territory.

The United States spends 10's of billions of dollars spying on it's enemies. They hack, install spyware, require backdoors, use phishing, social engineering. So does China, Russia etc. and this is not a conspiracy.

It IS a conspiracy.

What you said is not a conspiracy theory.

Ha ha yes, you're right!

I think you mean conspiracy theory.

Of course this event is a conspiracy.

You only want to slip in as few of these implants as possible to get in. You obviously want to hit as many networks as possible but only for targets that actually make sense. Hitting a DoD network has higher value than hitting the Mormon church's streaming servers. If these implants are real, they aren't cheap and the less that are in the wild, the less chance someone will find one on accident. If the implant actually could take over the BMC firmware, that could give you access to not only the OS running on that server but everything else on the network so the actual number of implants needed for an attack on a network/datacenter are low compared to how many machines are on there.

Any evidence of this theory?

No evidence that this alleged attack was highly-targeted, but it is pretty much SOP now, since the history of Stuxnet [1] publicly revealed the strategy. I was initially impressed the Bloomberg's story, but the longer this drags on with no independent proof, and given the one of the author's previous infosec reporting gaffe with no follow through, I've dismissed the story's veracity to a low probability.

[1] https://en.wikipedia.org/wiki/Stuxnet#History

No evidence whatsoever. Just all speculation based on previous targeted malware attacks that are public knowledge.

You just need ONE board to be able to prove it. Surely Bloomberg or their sources can get their hand on a single piece?

The story is weird, and yes, they should be able to produce a board, surely. They maybe got caught with their pants down.

But it doesn't matter - this is happening 100% guaranteed.

'We' do it and China has become far more aggressive in these areas these days ... so if they could be doing it, they would be.

Someone should come up with a bit of proof though.

evidence is usually required for statements like

" this is happening 100% guaranteed."

I don't know what brave new world we have entered where journalists, or even online users for that matter, make confident claims about things for which there is no physical evidence.

A very close friend of mine led customer support for a large American IT company in the middle east where US federal agents were posed as support staff.

I worked at a large high-tech firm with business in the middle east, including content-filtering solutions and we were basically 'required' to work with Western governmental entities of a 'security nature'.

The US has massive clandestine projects in this regard and some of them are not so secret - consider the recent Wikileaks: [1]

"The US intelligence agency has been involved in a concerted effort to write various kinds of malware to spy on just about every piece of electronic equipment that people use. That includes iPhones, Androids and computers running Windows, macOS and Linux."

[1] https://www.independent.co.uk/life-style/gadgets-and-tech/ne...

All countries with active spy/clandestine agencies are spying on one another using malware, spyware, hardware hacking, phishing, social engineering, whatever. And many firms are complicit to one degree or another.

That Apple or AWS etc. may have been compromised with a specific attack makes for a really weird story - but that this is happening in general is a non-story - of course it is. It's not about this specific attack really.

I promise you that my dad works at microsoft and he has a chip I add to my ps4 to make it play Xbox games, you can't see it because it's too small becaise he also secretly works for the new. He taught me how to program the chips and I can do anything with them.

So if a newspaper wanted evidence that your company fucked up you would go and dismantle company property to discredit your employer knowing that it's likely to damage them and ruin you.

Well, if you're Apple/Amazon you have the SEC and your shareholders ready to ruin your life if you say anything that could even be interpreted as a lie. So, in this hypothetical you may not want to, but you will definitely feel forced to.

You can also have the government out to ruin your life if you don't cooperate.

See: Joseph Nacchio and Qwest

> You can also have the government out to ruin your life if you don't cooperate.

What if it's the Chinese government that's putting pressure on Apple and Amazon? What would Tim Cook do if he was told on no uncertain terms that Apple would be kicked out of China and its iPhone production lines shuttered if it confirmed this story? Even if the chance they'd go through with their threats is small, it's an enormous risk to Apple and taking it would be hard to justify to its shareholders. FAANG companies are clamoring for access to the Chinese market, and that gives the Chinese government a lot of leverage.

A possibility straight out of a thriller novel - and definitely exciting!

I don't think it likely though because such a nuclear option from the CN government would have the effect of basically destroying their position in the global supply chain.

I can't believe that the government would blackmail Tim Cook into writing such a strongly worded rebuttal and then, weeks later when the story is not making the front pages anymore, have him write a call for retraction which brings this story back in the news cycle. That makes zero practical sense. That's the problem with many conspiracy theories: they make it seem like the people pulling the strings are incredibly clever and powerful while at the same time completely clueless and coming up with extremely complex plans to achieve mundane goals.

I could believe it if the denials so far felt incomplete or ambiguously worded as if they were tiptoeing around something that they were not allowed to disclose. I could believe it if all we had coming from Apple and Amazon was the usual lawyer-speak "I won't confirm of deny" bullshit. Instead we've had completely unambiguous "this is completely false and never happened". If it turns out to be a lie it's going to be devastating for the trust in Apple or Amazon.

I mean think about it, if for some reason the US or Chinese agencies wanted to downplay or shift the blame they had so many easier ways to do it that would put them in an awkward position if somebody manages to prove the existence of these backdoored mobos. If the best spin they could come up with was "just deny everything and make sure to do so at a regular interval so people are constantly aware of our denial" they really need better PR people.

> I could believe it if the denials so far felt incomplete or ambiguously worded as if they were tiptoeing around something that they were not allowed to disclose. I could believe it if all we had coming from Apple and Amazon was the usual lawyer-speak "I won't confirm of deny" bullshit. Instead we've had completely unambiguous "this is completely false and never happened".

Well, at this point everybody is watching for weasel words, so a categorical denial is the only thing the government can demand that wouldn't provoke suspicion.

> If it turns out to be a lie it's going to be devastating for the trust in Apple or Amazon.

Oh, please. Companies have had millions of credit card numbers stolen, and nothing happens.

Apple and Amazon would get a bit of bad press. The tech folks wouldn't trust them any less than they already do. And it would blow over in a couple weeks at worst.

At this point, my Bayesian priors are lowering on Bloomberg, but they are not necessarily going up on Amazon or Apple.

If you want to blow a whistle, yes. If not dismantle, at least photograph the object. If your employer retaliates, you can make good money in speaker fees retelling the story, or get a job at a company that wants to be known for good hardware security.

Getting a job is not necessarily a reason to jeopardize a whole career in the intelligence community. People in public service sometimes have feelings about serving their country.

> would go and dismantle company property

since when taking a photo of the claimed motherboard with a foreign spy chip on it is considered as "dismantle" company property?

> discredit your employer knowing that it's likely to damage them and ruin you

I thought those huge number AAPL and AMZN investors deserve some truth.

> So if a newspaper wanted evidence that your company fucked up you would go and dismantle company property to discredit your employer knowing that it's likely to damage them and ruin you.

The informant may have perfectly accurate information but be completely unable to provide physical evidence. For instance: they could have been briefed on the matter, but still have no physical access to the datacenter or to the location where the compromised servers were taken to.

A lot of the demands for physical proof make the false assumption that someone who knew about the spy chips and talked to Bloomberg would have had physical access to an example. That's simply not the case. How many of us work as software engineers in Fortune 500 companies, and how many of us could walk into one of our employer's datacenters and take a photo of the motherboard of a particular machine that we frequently work with? Not many, I'd imagine.

They were internally designed boards that Super Micro simply manufactured. Why would Bloomberg be able to put their hands on a custom board like that?

Bloomberg claims that there is evidence floating around - unless they're bluffing, they should be able to show evidence of at least one such motherboard, instead of CGI graphics showing how it might look.

Have they seen any actual hard evidence? Noone is disputing that the described attack vector is possible, but if Bloomberg has not properly verified if it actually has happened, then their article becomes a lie; and if they have properly verified it (as opposed to blindly trusting unnamed sources), why are they seemingly unable to show any hard evidence or details to the public?

These were supposedly targeted attacks. Why would Bloomberg have access to AWS and Apple internally designed boards?

> internally designed boards

What? The allegations are against super micro boards produced in China.

Super Micro builds custom designed boards for other businesses given the right quantities. It's a huge part of their business; I wouldn't be surprised if it's bigger than their white box boards.

One of the allegations was that special purpose video encoder boards from a hardware startup that Amazon acquired (Elemental) were targeted. These aren't off the shelf boards that anyone can buy.

Because the sources in AWS and Apple who reported this issue to Bloomberg have access to the boards they're reporting about?

What details and evidence about these boards have these sources provided to Bloomberg? Are there any details or evidence?

Not if they've been destroyed or handed over to the authorities.

"It should be taken as fact because I can't prove it."

How about no.

No, just that the a absence of evidence isn't the evidence of absence.

There's next to no way that Bloomberg's sources would still have access to the boards, and that should be considered given all of the calls here to see them.

If their sources are from the intelligence community do you really expect them to handover physical chips to the journalists they leak to?

If the intelligence community expects what they say to be reported as fact, then they need to pony up at least something to verify their claims. Otherwise the news media is just a mouthpiece for the intelligence community. That's particularly bad because one of their jobs is to be a check against just such behavior.

But it likely isn't the IC saying it so much as a whistleblower saying.

Does that somehow mean they should be less skeptical and not require more evidence before publishing the whistleblower assertions as fact? Do whistleblowers, by asserting that they are whistleblowers even without evidence, deserve more trust in this scenario for some reason?

I agree with you, now its normal practice to blame someone without evidence. Intelligence communities around the world are major source of "fake news" and media manipulate. My understanding is that "whistleblowers" are part of experiments done by intelligence communities to gauge public response on certain activities(might be illegal ,immoral) and with passage of time we forget and accept theses practices as new normal.

It doesn't reduce the requirement for evidence, but it's a very realistic "why" when it comes to why they haven't produced any physical evidence.

Of course intelligence agencies would never do such a thing as have one of their officers pretend to be a whistleblower in order to trick the news media into publishing their propaganda. /s

> Otherwise the news media is just a mouthpiece for the intelligence community.

Ah, the Mockingbird sings...

I'd be very careful about the term "the intelligence community", that is the "community" which told the world the WMD story in Iraq.

That would be politicians who ignored any of the "IC" analysis that contradicted their claims, and made up their own conclusions from dubious sources of "raw" intelligence like Ahmed Chalabi.

Bullshit. Straight from the CIA's NIE, page 9:

> High Confidence:

> Iraq is continuing, and in some areas is expanding, its chemical, biological, nuclear and missile programs contrary to UN resolution.

> Iraq could make a nuclear weapons in months to a year if it acquired sufficient weapons-grade fissile material.

https://www.scribd.com/doc/259216899/Iraq-October-2002-NIE-o...

I'm not sure where this "the IC is this blameless group that only looks like they screw up because of those pesky politicians" meme came from, but it has no basis in reality.

Don't bother trying - its not possible in todays political climate for people to be enlightened as to just how much damage has been done to the world by the 'intelligence' community. The CIA is the #1 source of conflict and trouble in the world - but American citizens have a very hard time with the self-reflection required to see this fact. This is by design: their society has been engineered to allow the secret spooks to rule, comfortably, without interference from public policy makers.

Time and again, we see the CIA, and other of US' TLA-agencies, directly causing world turmoil - and yet a blind eye is turned, because "at least its our guys doing it", etc.

The world would be a much, much better place if American citizens paid more attention to what their spy masters are doing in the world. Secrecy is the lynchpin of all corruption: the fact that American's worship their secret-keeping institutions as beyond reproach, the reason we have so much turmoil in the world.

>> The world would be a much, much better place if American citizens paid more attention to what their spy masters are doing in the world.

It doesn't work like that... "at least its our guys doing it" isn't some honest maxim we spout off in American fervor. It's akin to Winston knowing that when the 2-minutes-hate starts, whether you are into it or not, you stand up and blend in. Otherwise, those spy masters you mention make your life very uncomfortable, or take it away entirely. We just live here man, you don't think we actually are in charge and can make any difference...do you?

>We just live here man, you don't think we actually are in charge and can make any difference...do you?

Is it a democracy or not? Are you a brave people, or are you really a nation of cowards?

The world burns while Americans do everything they can to not take responsibility for their government.

No it's not a democracy and never has been, the system of government here is a democratic republic. Misunderstanding America seems to be a very hip thing to do these days. Most of us do exactly what you do in your respective country: try to look out for our family each day. We're neither aware nor responsible for 99% of the rest of what goes on around the globe. Most of us don't care, because we have our own problems to worry about.

The talking heads you see on TV telling you "America thinks XYZ", or "America won't stand for <foo>!", are just that...talking heads. They aren't us, we don't know them, they don't come over and share meals...they are just a few elite that can't shut their mouth in front of a camera. It's just as shitty here as it is where you are from, most likely.

Now we have lots of propaganda. You know, like the USSR and North Korean propaganda... mantras that say we are the bravest, most "free", most prestigious people on the planet. It's just propaganda though, no one that lives here believes that nonsense. If they do, they just got off the boat...give them a year and their tune will change.

disclaimer: I'm an unhappy veteran.

I disagree with the other guy - definitely continue to bother trying.

"The body of the NIE contained several qualifiers that were dropped in the executive summary. The fact that the State Department’s Bureau of Intelligence and Research disagreed with the conclusions was not highlighted.

As the draft NIE went up the intelligence chain of command, the conclusions were treated increasingly definitively. Only the summary of the NIE was partially declassified, and it omitted most of the reservations and nonconforming evidence. The fact that the NIE concluded that there was no operational tie between Saddam and al Qaeda did not offset this alarming assessment."

https://www.rand.org/content/dam/rand/pubs/research_reports/...

I wouldn't call the IC or even the CIA "blameless" for Iraq either and I don't appreciate you putting the word in my mouth (we also probably share a generally sour view of the CIA - they have done too many godawful destabilizing things around the world). The IC weren't the ones ordering the troops to invade any country on flimsy politically-massaged evidence though.

I always wonder why are sources from the intelligence community regarded as distinct? They're fairly integrated, I'd regard them as just one source.

> And we know it happens because 'we' do it as well.

What's the logic in this? This is like saying Saudis must be Christians because we are Christians as well

The implication here is more "we know its possible because we do it".

No it’s not. It’s much more like saying the Saudis probably killed the journalist because we do it too.

not sure why you are so downvoted on this (maybe less drama next time) but more or less right.

More specifically though, the Snowden docs showed how the usa does this kind of stuff on a one-off basis.

and IIRC, that it was/is the "preferred" method because it's easier to pull off/harder to detect than most other methods.

Honestly, less drama, fair enough...but sadly it's not drama, it's fact albeit in small numbers, this 100% happened as we found out from Snowden docs and other leaks! That wasn't really the point i was trying to make though, and if it's happened or not doesn't really need to hold true for the basis of my comparison to hold true as a basis of english arguments.

Also, I gave up hunting karma on HN a while back, i'd rather speak my mind honestly than be artificially censored by chasing a number.

How would you verify this theory?

The Apple and Amazon statements were bulletproof, and would very likely guarantee them shareholder lawsuits if they were in fact falsified. Additionally, the SEC would likely investigate if this did happen (since it would be fraud with harmed investors looking for blood)

> Additionally, the SEC would likely investigate if this did happen

The phone companies all denied providing metadata to the NSA when the story first came out. I couldn't find the WaPo article from the same week, which I remembering reading in hardcopy, but here's a cite for the same from NPR: https://www.npr.org/templates/story/story.php?storyId=540913.... Did the SEC sue Verizon here?

Original Verizon statement: https://www.ft.com/content/d70c2ce2-e519-11da-80de-0000779e2...

They're very careful to say that they never turned phone records over to the NSA - who's to say they didn't turn phone records over to the DoJ, FBI, or any other agency, which then bounced them over to the NSA? I think they do have an out here. Plus, I'm not certain the SEC would sue over a matter of national security, even if Verizon was directly lying.

Yeah I don't think those are really related. Apple was exceptionally clear that this simply didn't happen. Verizon is very careful about how they word that to say they didn't turn them over to the NSA, while omitting all of the other three letter agencies (DIA, FBI, DOJ, etc).

Compare that with Apple's statement, which is forcefully blunt and has no wiggle room:

    On this we can be very clear: Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.

The fact that they then asked Bloomberg to retract the story is also going a step further. The next step would be a libel lawsuit against Bloomberg, but that would be the thermonuclear option.

All of that said, the BMC on supermicro boxes is running a super old unpatched Linux and is absolutely chock full of exploits:

https://www.cvedetails.com/google-search-results.php?q=super...

I had to root one several years ago to fix a broken server we couldn't take out of service for $reasons.

The next step would be a libel lawsuit against Bloomberg

I'm waiting for the libel lawsuit. The absence of one is something I can't reconcile and leads me to thinking perhaps Apple doesn't want to through the discovery process for such a lawsuit which leads me to wonder why they wouldn't...

There aren't really any upsides for a libel lawsuit from Apple tbh, but I guess it just depends on how much Cook wants that retracted. As spiteful as he was, I'd suspect Jobs would have aggressively taken this approach.

Would the pr team even know if it was true

Is there, though? Take the latest Google example where they were less than forthcoming about user data that was accessed. Did anything ultimately happen to them? I think the same would happen in this case. If it were found, I'm sure they could quickly come up with some BS excuse that it was the best way to prevent the potential damage from being greater, that all along they had been investigating and doing whatever they could to mitigate the damage, yada yada yada. Then cue massive outrage. Followed by everyone else using their thing products as usual

> it's also unlikely that companies would want to admit the breach.

No comment is the proper action for no admission. However, Tim Cook and Andy Jassy put out public statements if they were willingly lying, they will be prosecuted by SEC

"weird" is right

That such a potentially damaging allegation has not been met with a more forceful (read: lawyerly) response is "weird". That this dropped in one publication with quite a bit of detail is "weird". The timing of the responses, the rumors of trouble at SuperMicro, the timeframe of the alleged compromised boards. It's all weird.

I'm waiting for the other shoe to drop on this one.

>most likely came from a ton of rumors that got conflated, hence why they had to go with anonymous sources

Just noting that anonymous sources aren't unknown sources — if Bloomberg says that these are people working in US Intelligence then they've very likely validated it, but are protecting their identities by request.

Also worth noting that Amazon and Apple have a tremendous amount to lose here. That doesn't mean they're lying, but based no what we know, they have more incentive to lie than Bloomberg does. Also possible that they're already working with the government and have been asked to lie about it due to national security.

Totally possible that Bloomberg was intentionally mislead or flat-out wrong either way. It just sounds like they've done the due diligence of checking with an abundance of sources, so it would be odd. They've made mistakes before, but I don't know that they've ever made one of this magnitude. The decision to publish or not publish a story like this isn't something that one person working at Bloomberg does on a whim, many people are involved.

All other things aside, I tend to trust journalists more than corporations. There's not a lot of room to jump to a conclusion either way. Very solid 'maybe' territory all around.

While something like this will no doubt be damaging to some large American tech companies, it is way worse for China. Are they really going to potentially devastate their entire economy over the long term over such an easy to detect hack?

> Are they really going to potentially devastate their entire economy over the long term over such an easy to detect hack?

That didn't make the NSA afraid of targeted interception campaigns.

I believe that secret services are doing everything we normal people dream of already, including stuff such as the hardware injections either in the Supermicro case or in the stuff the NSA did, and a good bunch more which we don't even know of yet.

Cyber warfare is all too real now.

We already know that they're constantly trying to hack American IP. Our economies are symbiotic. Hurting theirs would be hurting our own.

> they have more incentive to lie than Bloomberg does

The other way around. Apple and Amazon have very strong incentives to tell the truth. This has significant implications for their business (i.e. stock price) and if there is one thing that executives want to avoid, it's SEC filings based on false information given to the market.

Meanwhile, Bloomberg has the reputation of journalists with patchy histories of security news reporting. Perhaps they've been fed a line by government sources, but there is little financial incentive to fix any errors.

Let’s size up the options.

Bloomberg is wrong. Apple and Amazing have every incentive to strongly deny the story.

Bloomberg is right. Multiple employees up to executive level at 30 US companies and the government know about it and are actively leaking to Bloomberg about it. Numerous boards are out there at 30+ companies as physical evidence. There’s no way Apple and Amazon could risk denying this so strongly. It’s already being widely leaked - according to Bloomberg - the cat is well and truly out of the bag and wailing it’s ass off.

It just doesn’t make any sense for Apple and Amazon to put their reputations on the line in that second scenario.

Or the government told them to strongly deny the allegations and the fact that the government can do that is just one of the many powers that we already know get granted to intelligence agencies in secret by rubber-stamp classified court systems not held publicly accountable and already infamous for suppressing criticism of their practices under the guise of national security. If the three letter agencies don't want Bloomberg reporting on a hardware hack, they already have the power to tell Amazon and Apple that they can't legally confirm the story. I see no plausible reason why they couldn't get a judge to tell them they had to make it look sincere.

Apple has been known to use warrant canaries and other methods of communicating when they have had to cooperate with intelligence bureaus. They've never come out and lied because the government told them to, at least, not that has been proven.

Do a search on the case law around “compelled speech”. tl;dr the government can force you to not talk, but they can’t force you to blatantly lie either. As an example, check out the difference between the denials of PRISM vs this.

If they were instructed to do so by the government they would not really have a choice, which would very likely produce leaks.

If true, this is vastly different from the government requesting a backdoor or various warrant canaries, this would be an actual national security threat.

It would also be compelled speech, and from what I've read,

> governments have the right to mandate corporate speech “if the information in the disclosure is reasonably related to a substantial governmental interest and is purely factual.”

(https://www.reuters.com/article/us-otc-speech/when-the-gover...)

Since that would not be the case here, I do not believe it would be legally defensible for the government to compel false statements out of both Apple and Amazon.

(IANAL, so do take this with a grain of salt)

Actually, that's not the latest news on that. I looked up that case on scotusblog & it was vacated based on the result of "National Institute of Family and Life Advocates v. Becerra" which I believe overturns the 9th Circuit's ruling on this although I'm not totally sure. Regardless, you're right. No ruling has held the government has the right to compel factually incorrect speech.

Why would it have to be compelled?

The government could say "look here, this is an actual national security issue" and Apple, Amazon, etc could say "oh shit, you're right - how can we help?"

If this were a real national security risk, what incentive would Apple, Amazon, etc have to tell divulge the truth rather than cooperating with the government? This is vastly different than saying no to a requested NSA backdoor.

Is there any mechanism that the government can use to force you to lie? I know they can keep you silent but forcing you to say anything, true or otherwise, feels like a huge 1st amendment issue as the government can't typically compel speech, can it? I'm not a lawyer so curious on the perspective of someone who might know the details better.

Under certain circumstances the government can force a person or corporation to produce speech that is true - for instance, they are allowed to force you to file your taxes. However, there has never been a case to my knowledge where the government has been able to compel a lie - and any attempt to do so would immediately be subject to a legal case over constitutionality.

Or option 3: Bloomberg is was fed false information by the US government to cultivate distrust of Chinese sourced electronics. Not a bad tactic if you want to prevent Chinese infiltration in sensitive industries while also using it for political and economic leverage.

Option 4: Bloomberg is working on another story and the government is trying to taint their credibility by feeding them false information, so nobody will believe them when the real story comes out.

(I just wanted to point out all options)

Option 5: A journalist that really wants to land a scoop has a hunch that something is going on, and collects all the rumors and theories about hardware hacks, blurs the lines between speculation and facts, creates a plausible narrative that is too good to pass, and somehow persuades the editor that a dozen sketchy rumors must be enough to run a story.

That's why editors exist. Then, the journalist could also have been fed information that was fed to their leaky source in order to find out who the leaker would be.

OTOH, no experienced intelligence professional would leak information they are not absolutely sure other people have.

> hardware geeks worldwide searching like it was Willy Wonka's final golden ticket.

The stuff of dreams for security researchers.

I doubt Bloomberg is that eager to dig a hole for itself. I wouldn't be surprised if someone with a vendetta was feeding them cooked information and fabricating a lot of very convincing evidence. That's pure speculation, but I just don't belligerent Bloomberg would run such an explosive story unless they were convinced it was true.

> they had to go with anonymous sources as opposed to any physical evidence

What do you mean by the second part of this? Bloomberg should have received examples of comprised boards?

I would say exactly that.

If not received explicit examples, at the very least they should have been given some potentially affected SKUs to examine off-the-shelf boards.

Or gone to AWS/Apple and club and asked them to investigate before publishing...

According to Bloomberg Apple and AWS had already investigated thoroughly, had talked to the government, and their executives were the ones who had leaked to Bloomberg in the first place.

They did. Apple said they did 3 separate times, and in all times found absolutely nothing. Bloomberg chose to publish the story anyway.

Published along the initial story were strong refutations from Apple, Amazon, Super Micro and Chinese Goverment. Some of them suggested that this is not the fist request from Bloomberg, so much that companies got annoyed to refute baseless speculations (see Apple response). So Bloomberg consulted with the companies and published despite the strong denials from all sides.

Not necessarily received, but at least seen them and verified that the described thing actually exists. If they don't even have a single frigging photo that they can show us (up until now they have only shown CGI renderings that they fabricated themselves showing how it might have looked), then that seems to imply that they haven't done any due diligence.

> Not necessarily received, but at least seen them and verified that the described thing actually exists. If they don't even have a single frigging photo that they can show us (up until now they have only shown CGI renderings that they fabricated themselves showing how it might have looked), then that seems to imply that they haven't done any due diligence.

I don't know about you, but I certainly couldn't get a photo of the motherboard of a dev server I work with every day, let alone take a reporter to go take a look at it. That doesn't mean I don't have accurate information to base a story on, and it doesn't mean someone else can't corroborate that information.

Reporting isn't about gathering physical evidence, it's about gathering and cross-checking testimony and documents. If credible people in the government and an NGO testify that there was a poison gas attack at a certain location, a reporter can legitimately write an article about it. That reporter isn't going to sit on the story until they go to the attack site, collect samples, and sent them to a lab; nor should they.

If you're not holding that motherboard in your hands, then you definitely "don't have accurate information to base a story on" if that story is about inserted extra hardware - the story Bloomberg reported relies on analysis of that motherboard. If you find an anomaly in the dev server but can't open it up to look at the motherboard, then you can blow the whistle that something weird is happening, but you're not qualified to be a source for what Bloomberg claimed unless you have seen some evidence about the actual hardware.

As you say, reporting is about cross-checking documents. In this case, the relevant documents would be the technical details of that malware - photos of the motherboard with the inserted hardware, schematics and analysis of where and how the inserted chip connects to the "real" parts, dumps of the firmware alterations, microscopy analysis of the extra chip after decapping it. Instead, Bloomberg provided "this is where it could have been" CGI illustration and "this is how the mechanism might have been" description of the process. All details about the attack seem to be made up by Bloomberg, they're not based on any real hard data from their sources.

This implies that none of their sources had (or provided to Bloomberg) sufficient detail to assume that this is what happened - if the sources say "well, there was a major supply-chain attack but we're not giving the details" then that's not sufficient to report what the Bloomberg article did, making up the details without knowing them. If the sources provided enough detail to Bloomberg, then this is the point where Bloomberg should release those details to the public.

> If you're not holding that motherboard in your hands, then you definitely "don't have accurate information to base a story on" if that story is about inserted extra hardware - the story Bloomberg reported relies on analysis of that motherboard.

I disagree. What if you have a the text of a government report describing the reactions to its discovery in detail (e.g. "an implant was found attached to the BMC of some Supermicro boards, here's our plan for securing the supply chain against implants as small as 1x1mm...")? What if they were shown a report but not given a copy? What if you have consistent testimony from five credible people whose backgrounds check out who read the only copy of the report in a secure reading room? What if all that is verbally confirmed by other insiders?

> In this case, the relevant documents would be the technical details of that malware - photos of the motherboard with the inserted hardware, schematics and analysis of where and how the inserted chip connects to the "real" parts, dumps of the firmware alterations, microscopy analysis of the extra chip after decapping it.

The Bloomberg reporters aren't security researchers. All of the stuff you describe is well outside their areas of expertise or what they can be reasonable expected to do. They're doing their job if they report what they learn from others, it's not their job to perform research or replicate research themselves.

Journalism is more like history than archeology, but a lot of people seem to want it to be the other way around.

We all know somebody has to be obtaining these boards, finding the alleged malicious grains of rice and testing them to see if they are in fact just passive components?

Where are they? Where is their presentation of finding nothing?

Will they name their anonymous sources if it turns out they were played by them?

Probably if they could prove it - but it's hard to imagine what they could find that would constitute proof.

Bloomberg probably has its own political agenda (guess who's administration is behind this?) for fabricating such elaborated fake news.

Exactly- where are they?! The Bloomberg story made verifiable claims (perhaps not exactly falsifiable due to their nature), so where is the verification?

It's so strange to see people continue running with "they wouldn't have doubled down unless they were really certain, so it must be true".

Assuming the story is real it is quite obvious that there aren't that many compromised motherboards. It wouldn't make sense and it would make the attack easier to detect and to publicly incriminate the culprit.

As the attack is said to have been discovered 3 years ago it is also not surprising that housekeeping has already been done a long time ago.

Supermicro is a fairly large player (4th largest) and they still manufacture servers. If this story were indeed true, none of these companies or any other company buy their servers. The story is simply fake news.

Who knows.

Obviously no-one would have publicised this, so if you weren't involved you would have had no idea. The story does report that Amazon completely dropped Supermicro as a supplier following this alleged hack (that should be verifiable even if the reason given would obviously be different).

Big companies are now scandal proof. No amount of negligence or criminality is bad enough to bring one down.

Wells Fargo committed millions of counts of bank fraud, yet they still exist and people buy their services.

BP destroyed a large part of the economy and ecosystem in the Gulf of Mexico, yet they still exist and people buy their products. One of their top lawyers just became Assistant Attorney General for the Department of Justice’s Environment and Natural Resources Division.

VW built millions of cars with hardware designed to fake emissions testing data, yet they still exist and people buy their services.

Crimes are committed by individuals, not companies. If execs at VW break the law, you go after the execs, you don’t put the whole company in jail or turf out all it’s employees on the streets.

I'd be on board with this position if it was applied consistently. But it's not. Companies take political action, companies take credit for innovation, etc. The whole basis of a company is that it limits the liability of the people who own it.

HSBC laundered nearly a billion dollars for terrorists and Mexican cartels. Which execs faced any legal repercussions again?

https://www.forbes.com/sites/afontevecchia/2012/07/16/hsbc-h...

I’m not saying there shouldn’t be repercussions, check my comment again, but there’s no point putting the bank tellers out of work because their bosses, bosses, bosses, bosses boss broke the law.

>I'd be surprised if Bloomberg has any credibility in tech journalism

If the tech world turns their back on Bloomberg, I'll give them more credibility; not less.

I’m curious; why?

I'm curious too. This seems like a sides thing, and of course a lot of people are anti-tech these days. But, to side with the publisher of garbage tech journalism just because you don't like tech seems a little counter-productive. You can hate tech people without willfully believing things you know are false.

Reply on news.ycombinator.com