Chinese spies slipped secret chips into servers at Apple, Amazon and others, report says

[mahatmakanejeeves]

Source: Silicon Valley Business Journal

Technology

Chinese spies slipped secret chips into servers at Apple, Amazon and others, report says

By Luke Stangel - Contributing writer
46 minutes ago

Chinese spies were able to build and secretly install a tiny chip on servers made by San Jose-based Super Micro Computers that gave them backdoor access to information flowing across the data center, Bloomberg reports, citing 17 unnamed sources. (1)

Federal investigators believe Super Micro sold the compromised servers to 30 U.S. companies, notably Apple Inc. and Amazon.com, Bloomberg reports. Both companies vigorously denied the report.

Super Micro shares plunged 29 percent at the opening bell today. The company's shares trade over the counter, after being delisted from the NASDAQ stock exchange in August.

Amazon Web Services reportedly discovered the chips in 2015, while performing due diligence on an Oregon startup they were interested in buying. The company handed over evidence to federal investigators, who found the spy chips were no larger than a grain of rice and made to look like a common signal conditioning coupler.

Once installed, the chips were reportedly designed to quietly control their host server's operating system, injecting simple commands that allowed hackers to gain access to the information on the server.

(1) https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies

Read more: https://www.bizjournals.com/sanjose/news/2018/10/04/chinese-spies-slipped-secret-chips-into-servers-at.html

---

I have the Bloomberg report over in Editorials & Other Articles. It's more of an analysis than a news story.

The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

https://www.democraticunderground.com/1016217106

[still_one]

1. It is interesting because I also heard on Bloomberg this morning that both Amazon and Apple said the

story wasn't true

While that still doesn't mean it isn't, I sure would like to get more information on this since not coincidently trump and company are pushing the theme that China is hacking our midterm elections to give a Democratic win

[Fred Sanders]

2. Amazon and Apple were not the targets, the server manufacturer was...even if this story true.

Servers could have been sold to anyone.

The story needs...corroboration from the companies who actually have the servers and do a quick check...word of the day...corroboration!

[still_one]

3. We are on the same page Fred

[LiberalArkie]

5. Apple and Amazon and Microsoft and others design their own servers.

They really don't buy Dell or over the counter machines. They send the design to factories to have them made, sometimes an order for 50,000 mother boards and chassis's.

[LiberalArkie]

4. They really have to say that.

[DetlefK]

7. Amazon is renting servers to other companies. Imagine if Amazon admitted their servers are not secur

[pazzyanne]

12. If tRump is pushing this, the 3 finger policy needs to be envoked.

tRump points a finger at Dems and China. Check out the three fingers pointing back to him and substitute Repugs and Russia.

[Zorro]

6. May be a very big deal

Everyone -- including the DoD -- is moving to the cloud, so compromised servers would have key strategic value to an adversary.

[xor]

9. I think amazon even offers services targeted specifically for agencies like the DoD

I recall receiving an email from AWS about that offering. I'm sure Microsoft and Google have something or soon will.

Just waiting for the day when everything just shutdowns and I'm forced to scavenge for food while avoiding aggressive hairy wild people who ride motorcycles with spiked wheels.

[Blue_Tires]

22. +1

[xor]

8. I read some paper on analog backdoors awhile back.

This is a bit technical, but it's an interesting read if that's your thing.
http://www.ieee-security.org/TC/SP2016/papers/0824a018.pdf


Here's a little bit more of a lighter read.
https://www.wired.com/2016/06/demonically-clever-backdoor-hides-inside-computer-chip/

It's time to start building our computers out of discrete transistors
http://megaprocessor.com/progress.html

[Power 2 the People]

10. Hmmmmm..maybe we should start manufacturing in America??

Just a thought.

[Duppers]

13. Exactly!

[Pepsidog]

11. Probably the only area where I agree with the Dotard is China stealing our intellectual property.

This hacking is probably our biggest national security issue. From industrial to military espionage other countries are building industries in the back of our public and privately developed innovations. Why should other countries spend billions on research and development when they can steal it? Securing our intellectual property must be our top priority.

[Blue_Tires]

14. Greenwald and Snowden were unavailable for yeah, yeah, you know the rest...

[TomVilmer]

15. Acyually no.

What is your point?

[Blue_Tires]

16. My usual standard response

Last edited Thu Oct 4, 2018, 05:38 PM - Edit history (1)

when other nations get caught spying is "Greenwald and Snowden were unavailable for comment", since they start ducking and hiding whenever some other country starts fucking around with the almighty "individual privacy rights" or whatever...

[TomVilmer]

17. I read news anywhere I can find it...

... and if fx would like to read criticism about what China is doing against "individual privacy rights", I can find it all at The Intercept. This is is from a quick Google-search for China there:
https://www.google.com/search?q=china+site%3Atheintercept.com
- Google Executive Declines to Say If China Censors Its Citizens
- World's Leading Human Rights Groups Tell Google to Cancel Its ...
- Google Struggles to Contain Employee Uproar Over China ...
- Senior Google Scientist Resigns Over “Forfeiture of Our Values” in China

And this is from a quick search for Snowden:
https://www.google.com/search?q=russia+critism+Snowden
- Edward Snowden describes Russian government as corrupt | US ...
National Security Agency whistleblower Edward Snowden has delivered his most trenchant criticism yet of the Russian government, describing ...
- Edward Snowden blasts integrity of Russia's presidential election ...
- Former National Security Agency contractor Edward Snowden Sunday criticized the integrity of Russia's presidential election just before exit ...

And BTW here is a WikiLeaks' Russian collection of Spy Files about surveillance contractors in Russia:
https://wikileaks.org/spyfiles/russia/
I do not like the way WikiLeaks drops stuff without a strong journalistic filter, since they do not care at all about when innocent peoples names gets hit. But I do find good info there.

I use them all when ever I need info, but I am as critical to their sourcing and methods, as I am when I use MSNBC. Love the shows there, but they are only really good, when the president is marked R.

[Blue_Tires]

18. As I have illustrated multiple times

First of all, Greenwald was in bed with Eric Schmidt to the point where he actually redacted his name from his own fucking story to protect him (Assange outed him anyway) so wake me up when we see a Chinese story that isn't from a Google perspective. And FWIW, Google is as bad as anyone as far as privacy rights go, but you'll never, EVER read that on the Intercept site.


Snowden's Russian "criticisms" are solely because of folks like me throwing that shit in his face all the time... It's just to keep up appearances. You will also notice that his "criticisms" are tame, VERY narrow in scope and on relatively minor issues -- But MH17? Silence... Skripal? Silence... Ukraine? Silence... Tampering with the 2016 election? Silence... Nemtsov, a whistleblower shot on a public street close enough that Snowden probably heard the shots? Silence...
Other journalists and dissidents murdered, imprisoned or just "disappeared?" Silence... Rampant online disinformation campaigns, the kind he used to call out the NSA for? Silence... Russia bombs a hospital in Syria? Silence...


I get that you're new here, but I've been debunking Greenwald/Snowden bullshit damn near daily for five straight years so I've got receipts for literally *everything*... And you can place your trust in the Intercept if you dare, but by this point it's no better than Sputnik.

[TomVilmer]

19. Please do repeat all your stories again...

... BTW I am way older than you in this forum, and I place my trust nowhere. I "debunk" everything I ever read, and do not care if it is Sputnik or MSNBC. Everybody has a bias...

I directed you to a page full of links, where The Intercept is shaming Google for the BS it does together with the Chinese leaders. And then you screw your blinders even tighter, and concludes it never happens, for "you'll never, EVER read that on the Intercept site". 🤦

I also know what not to take serious, but sometimes it is interesting to see the shape of other peoples bubbles.

[Blue_Tires]

20. What do you mean you're "older than me on the forums?"

I've been here since '03, rookie... So you'd best mind the gap.

And the fact that you're trying to talk at me like you know me despite me never having seen you before, and the fact that you're a sleeper account with 500 posts in 10 freaking years were already strikes 1 and 2... Defending the Putincept is strike 3. If you "get your news wherever you find it", then that means Drudge and Breitbart are just as legit to you, right?? And since you're one of the "elder statesmen" on DU, surely you would have seen my arguments (documented with countless links) at some point already? Either way you know how to use the "search" function so you go find them.

(As an aside, every time I come back to DU some sleeper account immediately tries to fuck with me... Why is that?)

Mr. Vilmer, I bid you farewell.

[Mosby]

23. Your profile says you joined in '09

[dalton99a]

21. The problem is the location of the supply chain

The hardware hack took the form of an implant placed on motherboards at the time of manufacturing by Chinese subcontractors hired by Supermicro Computer Inc., the supplier to the companies in question. Allegedly these implants were able to pass visually as other components. Original designs for motherboards were modified by the subcontracted Chinese manufacturers to include the part, connecting it to the "baseboard management controller" — something like the often-criticized Management Engine used by Intel, if you know what that is. Controllers like these functionally have additional privileges over the system, allowing for unobserved modification of things like system memory and other low-level operations. That means although the additional hardware may not be powerful enough in itself to do anything nefarious directly, it's in a position to surreptitiously load external software that can.

According to Bloomberg, this hardware-based infiltration has been under investigation by U.S. agencies aware of the possibility since at least as early as 2014, with affected companies noticing the suspicious hardware modifications as early as 2015. According to Bloomberg, in the last three years "no commercially viable way to detect attacks like the one on Supermicro’s motherboards has emerged."