Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Businessweek got wrong about Apple

apple.com

Post reply on HN
Print view View original

61–70 of 183 posts

Re: What Businessweek got wrong about Apple

#61

Post by [deleted] »

matchagaucho wrote: post #45
mikekchar wrote: post #38

Earlier quoted context omitted.

My general response whenever there is something like this: Look at the past stories by the reporter. Bloomberg handily lists them for you. https://www.bloomberg.com/authors/AQrv1y2ieI0/jordan-roberts... Take a look at those stories in the strong light of being able to see them in retrospect and decide for yourself if this reporter is prone to going to press without a full understanding of the situation. I have my opi…

hmmm... definitely a trend of reporting on hacks. And perhaps with sensationalist clickbait headlines. But they are confirmed hacks (Equifax, FB, Cambridge Analytica).

[deleted]

Re: What Businessweek got wrong about Apple

#62

Post by GordonS »

akavel wrote: post #16
GordonS wrote: post #15

The cynic in me wonders about the plausibility of all this. Firstly, why would you add a new chip to a board, rather than alter an existing one? That would be essentially undetectable. Secondly, why Bloomberg? It's an odd organisation to get a scoop on something like this. Thirdly, they talk of the PLA approaching plant owners and such; to do all this, a lot of people would need to know about it, from the top to the…

Can you delete one of your 2 nearly identical comments?

Done, and thanks for pointing this out. I wrote this on mobile, and thought the app (Materialistic) had lost what I'd written, hence I wrote it again.

Not targeting you with this, but it seems a bit harsh to get downvoted for what was obviously a mistake.

Re: What Businessweek got wrong about Apple

#63

Post by wanderingjew »

Jerry2 wrote: post #12

Both Apple and Amazon have released VERY STRONG denial statements that bring the whole Bloomberg narrative into question. It's also convenient that no one has yet been able to verify or find any of these mysterious Chinese chips on any of the Supermicro servers in the wild. So what is the real story here? Did Bloomberg reporters deliberately deceive everyone or were they deceived by the US IC ("intelligence community…

The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit.

What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and even the position of the 'exploit' in the article's graphics is accurate. This is obfuscated because of an ongoing investigation. It's real, but there's purposeful misinformation, combined with a journalistic game of telephone or chinese whispers.

It's also about the worst possible way to drop and 0-day, but whatever.

Re: What Businessweek got wrong about Apple

#64

Post by okket »

wanderingjew wrote: post #63
Jerry2 wrote: post #12

Both Apple and Amazon have released VERY STRONG denial statements that bring the whole Bloomberg narrative into question. It's also convenient that no one has yet been able to verify or find any of these mysterious Chinese chips on any of the Supermicro servers in the wild. So what is the real story here? Did Bloomberg reporters deliberately deceive everyone or were they deceived by the US IC ("intelligence community…

The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit. What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and eve…

This also illustrates why hardware implants do not work as a mass infiltration tool. The idea is not getting caught, otherwise risking the whole operation. Implementing a threat like this is counterproductive.

Re: What Businessweek got wrong about Apple

#65

Post by darawk »

wanderingjew wrote: post #63
Jerry2 wrote: post #12

Both Apple and Amazon have released VERY STRONG denial statements that bring the whole Bloomberg narrative into question. It's also convenient that no one has yet been able to verify or find any of these mysterious Chinese chips on any of the Supermicro servers in the wild. So what is the real story here? Did Bloomberg reporters deliberately deceive everyone or were they deceived by the US IC ("intelligence community…

The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit. What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and eve…

Why would Apple and Amazon release such vehement denials, though? If it were an ongoing investigation, wouldn't they use more hedging and obfuscatory language? They could just as easily say "we're not aware of anything like this, but we take all allegations of this nature seriously and are looking into it". The whole situation is just odd.

Re: What Businessweek got wrong about Apple

#66

Post by xiphias2 »

peterlk wrote: post #30
Jerry2 wrote: post #12

Both Apple and Amazon have released VERY STRONG denial statements that bring the whole Bloomberg narrative into question. It's also convenient that no one has yet been able to verify or find any of these mysterious Chinese chips on any of the Supermicro servers in the wild. So what is the real story here? Did Bloomberg reporters deliberately deceive everyone or were they deceived by the US IC ("intelligence community…

To be clear, there is a very real threat of China embedding chips that do "bad things" inside chips that are sold to the US (source: I once worked on a government contract and saw such chips - they were, to my knowledge, unrelated to this specific case). I'm not sure where that points, but there are strong motivations at play.

The key is ,,inside chips''. There's no reason to do those bad things on the die using an extra chip, as it's too easy to prove.

Re: What Businessweek got wrong about Apple

#67

Post by cm2187 »

rickycook wrote: post #60
cm2187 wrote: post #51

Earlier quoted context omitted.

The article suggested the chips were hidden under components. You would have to tear apart the motherboard and know what to expect exactly. The number of companies who do this kind of audit must be in the single digit if any. Now the article may or may not be a hoax, but a few years ago the NSA was exposed doing exactly that. So at the very least it is credible. As for detection, I’d rather expect this devices to be…

well, the article said that amazon noticed pings to c&c servers in its beijing datacentre. it did also say that these were more sophisticated hardware attacks but didn’t make it clear if these chips were also found

Yes, sorry, agree. On stealthness, the article mentioned that “In one case, the malicious chips were thin enough that they’d been embedded between the layers of fiberglass onto which the other components were attached” but also says that the chips came in different sizes so some could have been easier to detect.

Re: What Businessweek got wrong about Apple

#68

Post by AstralStorm »

darawk wrote: post #65
wanderingjew wrote: post #63

Earlier quoted context omitted.

The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit. What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and eve…

Why would Apple and Amazon release such vehement denials, though? If it were an ongoing investigation, wouldn't they use more hedging and obfuscatory language? They could just as easily say "we're not aware of anything like this, but we take all allegations of this nature seriously and are looking into it". The whole situation is just odd.

Obviously to quiet their contractor and client fears. Shareholders know that replacing the hardware would be a major cost and PR damage intense.

Re: What Businessweek got wrong about Apple

#69

Post by IOT_Apprentice »

From 2016: Report: Apple designing its own servers to avoid snooping Apple suspects that servers are intercepted and modified during shipping.

"Apple has long suspected that servers it ordered from the traditional supply chain were intercepted during shipping, with additional chips and firmware added to them by unknown third parties in order to make them vulnerable to infiltration, according to a person familiar with the matter," the report said. "At one point, Apple even assigned people to take photographs of motherboards and annotate the function of each chip, explaining why it was supposed to be there. Building its own servers with motherboards it designed would be the most surefire way for Apple to prevent unauthorized snooping via extra chips." https://arstechnica.com/information-technology/2016/03/repor...

Re: What Businessweek got wrong about Apple

#70

Post by Arn_Thor »

darawk wrote: post #65
wanderingjew wrote: post #63

Earlier quoted context omitted.

The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit. What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and eve…

Why would Apple and Amazon release such vehement denials, though? If it were an ongoing investigation, wouldn't they use more hedging and obfuscatory language? They could just as easily say "we're not aware of anything like this, but we take all allegations of this nature seriously and are looking into it". The whole situation is just odd.

Their reputations could take a huge hit from this story alone, so a strong denial is the first defense. If they are unaware of any investigation, as they claim, then that makes even more sense.
Post reply on HN