Apple denies claim China slipped spy chips into its iCloud server hardware
A Bloomberg report claims Apple, Amazon, and almost 30 other companies were the subject of hacking by Chinese spies embedding chips in hardware for surveillance purposes, a story that Apple has now twice refuted as "wrong and misinformed."
Reportedly, servers examined by Amazon had extra hardware embedded on the motherboard, found during a 2015 inspection of startup Elemental Technologies that Amazon was keen to acquire. Bloomberg writes the motherboards had an extra microchip about the same size as a grain of rice, that wasn't part of the original design.
Elemental's motherboards are produced by Supermicro. Apple was once poised to order more than 30,000 servers for its iCloud data centers from Supermicro over two years.
The chips allegedly allowed attackers to access a "stealth doorway onto any network" where the computers were located. The attack with the single chip allegedly offered the potential for "long-term stealth access" that is usually expected of spy agencies. The attack is an extremely difficult as compared to software-based hacks, but could offer far greater results, if successful.
Aside from corporate espionage, the attack could also affect the U.S. military and law enforcement. Elemental's servers were used by the Department of Defense, the CIA's drone operations, on Navy warships, among other sensitive locations.
Bloomberg claims senior insiders at Apple advised that it had found a number of malicious chips in Supermicro boards in May 2015, after detecting odd network activity and firmware problems. The company reportedly informed the FBI, but kept the details of what it had uncovered quiet, even internally.
A few weeks after the discovery, Apple started to remove all Supermicro servers from its data centers, with 7,000 installed units replaced over a brief period. According to the report, Apple denies any servers were removed. Apple allegedly cut ties to the company in 2016, for "unrelated reasons" according to the report.
However, Apple differs with the account as set forth by the publication.
http://appleinsider.com/articles/18/10/04/apple-denies-claims-china-attacked-icloud-server-supply-chain-to-spy-on-us