What Happened with Supermicro?

You can parallelize this search, because the people doing it don't need to know much about what they're looking for—they're just hunting for visual differences. Unless/until one of them actually finds anything different. At that point, you need better resources to figure out what's different; but at that point, all hell also breaks loose, and you'll get all the resources and help you need to do better analyses.

I think... we might just live in different worlds? I'm a sysadmin and I maintain computers, but I am surrounded by serious programmers (I mean, kernel and system verilog types, not frontend people)

I have worked places where it was just me and the frontend folks, and in that case? yeah, It's kinda lonely when you need help on anything serious. But even then, with my social life being what it is now, I'd have people to ask if I was in that situation again at work.

I... usually don't have any trouble getting someone qualified to look at my backtraces when I have kernel panics, and I usually don't have trouble getting those people to give me patches. that requires analyzing the code.

I mean, sure, people don't spend a lot of time reading random code for no reason... but you give them a clue that something interesting is somewhere, and my experience? you can get plenty of help.

I can tell you people were literally tearing them apart; cutting open capacitors and the like (common place to hide extra components) pulling apart power supplies (as I recall, one of the bloomburg illustrations implied that something was in a power supply; I remember a long discussion of how you could compromise something over i2c from a chip actually in the psu) - I mean, sure, these things could be better hidden to the point where such techniques would be ineffective, but my reading of the bloomburg article was that they weren't particularly well-hidden, and that therefore they were discovered. Hiding that sort of thing from another EE who designs that sort of thing seems like it's probably pretty difficult.

(I mean, it is common to have compromised firmware; that's way easier. but that's also not what the bloomburg article was about)

But... yeah, I guess a lot of my assumption was based on my reading of the bloomburg article implying that this hardware was something tacked on in a detectible way; the sort of thing that could be done by some third-tier subcontractor. I acknowledge that if your attacker has the capability to produce ASICs that look just like the real thing and act just like the real thing out the same I/O pins, except in some rare case? yeah, that's not going to fall to this level of examination. but that wasn't my reading of the bloomburg story.

Furthermore, if an attacker went through that level of effort, they'd probably not just do it for supermicro. Most motherboards of the same generation are pretty similar; pretty heavily based on reference designs. If you were going to do something that sophisticated, that's where you'd attack.

If you were going to attack just one particular rev of one particular brand of a motherboard? well, something tacked on seems a lot more feasible.

(the story was that it was a Chinese subcontractor. Remember that SuperMicro is a Taiwanese company; I'm pretty sure that SuperMicro has less Chinese made content than any of the other major manufacturers of commodity server kit. )

I did know people cutting open power supplies, cutting open capacitors (a place chips have been hidden in the past) and otherwise examining the systems at the macro level.

I also knew people who managed networks of these things... and one of the bloomburg stories, as I recall, claimed that the hack was discovered via looking at the network as the BMC tried to phone home.

I mean, yes, you could do something more clever than that, replace a chip with one that looks identical, which uses the same traces that did something different, but the article certainly implied it was a more simple sort of thing.

I mean, if I was trying to compromise a BMC in that way, I'd just flash it with firmware that did what I needed (and this has happened before... to many different vendors) - my understanding of the bloomburg story was that there was some bit of hardware to re-flash the firmware to the compromised version after the user upgraded to a non-compromised version.

My guess as to why: one of their reporters was misled by a trusted source, or multiple trusted sources (who were maybe actually catspaws of some-group-or-other who would benefit from getting this story out.)

So now, although Bloomberg would like to speak truth by issuing a retraction, such a move would likely severely damage the original reporter's career; and they don't want to do that for something that wasn't that reporter's fault.

Having some corporation or government agency with tons of resources come along and force or trick a reporter into running a story, would be the journalism equivalent of an insurance agency's "act of God" waiver clause. I would guess that every major news outlet has a policy for protecting and defending reporters who—by hook or by crook—get used as patsies by forces out of the news outlet's control.

There were bunch of other things where I caught Tim Cook lying. Steve Jobs uses to be very deceptive when he needs to, his wording weren't clear cut and leads you to wrong assumption. Tim Cook doesn't have that talent.

And once you have been caught lying, you lose trust.

While I do have doubt on Bloomberg story, I am not going to trust sold on Tim Cook's word.

And if you have the means to do something like this, why not do it in a more subtle way that doesn't have people asking questions 6 months later?

I'm not suggesting you're wrong and I have no clue what happened.

Are those the $1M Silicon Valley homes I hear about?

Authoritarian regimes can look appealing (from the outside, anyway) until circumstances change. Then they falls apart spectacularly because the commercial and governmental institutions are either absent, very weak, or are unable to adapt to the change. For example, the Soviet Union.

Because - as noted in the article - the practical effect of this story is that now people are worried about supply chains involving China, not that people are worried about Supermicro in particular. And selling this story on multiple fronts, official and unofficial, seems most effective.

And allowing negative side effects for domestic companies as collateral damage to harm other countries is standard practice; see e.g. visa policy. US companies can't hire the best workers, but it's okay because it helps the US government's political goals.