What Businessweek got wrong about Apple • Hacker News Board

Re: What Businessweek got wrong about Apple

#131

Post by matchagaucho » Fri, Oct 05, 2018, 1:16 PM UTC

baybal2 wrote: post #105

sterlind wrote: post #99

Earlier quoted context omitted.

Further in the article, Bloomberg mentions a chip, smaller than a pencil tip, sandwiched inside the PCB itself, under other traces. That seems bananas difficult to pull off, but could x-ray inspection find such a thing if it existed?

I specifically mention non-automatic inspection as automatic one may well not have the "paranoid mode," unlike a human who specifically told to go over every individual square millimetre.

Minimum quantity orders for these servers are typically 10,000.

Even at 1,000, I don't see how humans could reliably detect this.

Re: What Businessweek got wrong about Apple

#132

Post by Theodores » Fri, Oct 05, 2018, 1:21 PM UTC

Theodores wrote: post #106

wanderingjew wrote: post #63

Earlier quoted context omitted.

The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit. What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and eve…

> "chinese whispers" Does anyone have a better phrase for this? A Chinese workmate called me out for using that phrase in his presence. Until then I had used the phrase since childhood without thinking that there were connotations and with nobody complaining. However, after that one fateful conversation I did see that my language could be improved. But how? Does anyone have a concise alternative that conveys the same…

The Telephone Game is not common parlance in British English, just American English. So a better phrase is sought than that to convey the idea.

Re: What Businessweek got wrong about Apple

#133

Post by fulafel » Fri, Oct 05, 2018, 1:22 PM UTC

dvfjsdhgfv wrote: post #126

ytjohn wrote: post #122

Earlier quoted context omitted.

Heh. One colleague has "Hope is not a valid deployment strategy" as a signature. Most places might be blocking this type of activity by default. For most of our security audits, it's just assumed that the SM IPMI or Dell idrac is vulnerable to one exploit or another. We mitigate that by controlling the traffic. I feel this is common practice in most places that understand vlans and firewalls. However, while blocking…

That's my point. Security people were analyzing network traffic for decades trying to spot something that doesn't fit, host-wise, pattern-wise or even packet-wise (see The Museum of Broken Packets[0], for example). And someone managed to somehow hide all this traffic from security experts working for Amazon and Apple, for months or years? I'm very curious to see how. [0] http://lcamtuf.coredump.cx/mobp/

I think you misread - "Unicorn jumping over a rainbow level rare" was about catching it, not missing it.

Re: What Businessweek got wrong about Apple

#134

Post by SiempreViernes » Fri, Oct 05, 2018, 1:41 PM UTC

GordonS wrote: post #118

ItsMe000001 wrote: post #87

Earlier quoted context omitted.

Because "getting caught"'s only consequence is that you have to use a new method. There is no punishment, no negative cost to be applied retroactively to compare it to the received benefits. The net effect still is highly positive since while it worked you got what you wanted. Same as in every spy operation, ever.

I'm not sure about that - this could really bolster the MAGA crowed, and I can imagine calls in the near future for manufacturing to be moved to the US. I doubt much will actually move, but it's a possibility.

I think respect for the feelings of the MAGA crowd is not high in the PLA's list of concerns.

The Trump doctrine is largely built on fictions anyways, and the international community seems to have settled on "distraction" as the only worthwhile strategy for dealing with him.

Re: What Businessweek got wrong about Apple

#135

Post by chasd00 » Fri, Oct 05, 2018, 1:46 PM UTC

Incredibly interesting story and discussion, this is why i come to this site.

Isn't this practice known, if not common, in the infosec/intelligence communities at the nation level? There's lots of stories of hardware exploits in copy machines, faxes, etc that took place during the Cold War.

Re: What Businessweek got wrong about Apple

#136

Post by _Codemonkeyism » Fri, Oct 05, 2018, 1:55 PM UTC

baxtr wrote: post #4

In an appearance this morning on Bloomberg Television, reporter Jordan Robertson made further claims about the supposed discovery of malicious chips, saying, “In Apple’s case, our understanding is it was a random spot check of some problematic servers that led to this detection.” As we have previously informed Bloomberg, this is completely untrue. Apple has never found malicious chips in our servers. Finally, in resp…

Free get out of jail card: Three letter agency force me.

Re: What Businessweek got wrong about Apple

#137

Post by reitanqild » Fri, Oct 05, 2018, 2:07 PM UTC

Theodores wrote: post #106

wanderingjew wrote: post #63

Earlier quoted context omitted.

The reason Bloomberg is so sure about this is because chips/'infected' Supermicro boards were originally found at Bloomberg. They noticed odd web traffic coming from a server, took a look, found nothing, looked closer, and finally found a hardware exploit. What you're seeing in the Bloomberg piece is a bunch of half-truths backed by soild data. It is a BMC exploit, and they are doing it through the BMC EPROM, and eve…

> "chinese whispers" Does anyone have a better phrase for this? A Chinese workmate called me out for using that phrase in his presence. Until then I had used the phrase since childhood without thinking that there were connotations and with nobody complaining. However, after that one fateful conversation I did see that my language could be improved. But how? Does anyone have a concise alternative that conveys the same…

"Pass the message" or just "whispering game" seems to be the same.

Re: What Businessweek got wrong about Apple

#138

Post by liftbigweights » Fri, Oct 05, 2018, 2:10 PM UTC

Jerry2 wrote: post #12

Both Apple and Amazon have released VERY STRONG denial statements that bring the whole Bloomberg narrative into question. It's also convenient that no one has yet been able to verify or find any of these mysterious Chinese chips on any of the Supermicro servers in the wild. So what is the real story here? Did Bloomberg reporters deliberately deceive everyone or were they deceived by the US IC ("intelligence community…

It is very odd. If there was any truth to the story, I wouldn't expect such strong denial from apple and amazon.

There has been a noticable uptick in anti-chinese news lately, particularly on business oriented news ( cnbc, bloomberg, fox business, et al ). Obviously some elements of the government or power structure has instructed them to do so. But why?

Also, if the IC wanted to put pressure on tech companies, wouldn't they just contact apple and amazon directly. Maybe there is a rift within the IC with one group being pro-china and another being anti-china?

Or is the IC and news companies done targeting social media tech companies and switching their attention to regular tech companies? Just have to wait and see.

Re: What Businessweek got wrong about Apple

#139

Post by chrisdhoover » Fri, Oct 05, 2018, 2:17 PM UTC

sterlind wrote: post #49

Jerry2 wrote: post #12

Both Apple and Amazon have released VERY STRONG denial statements that bring the whole Bloomberg narrative into question. It's also convenient that no one has yet been able to verify or find any of these mysterious Chinese chips on any of the Supermicro servers in the wild. So what is the real story here? Did Bloomberg reporters deliberately deceive everyone or were they deceived by the US IC ("intelligence community…

Remember when Clapper gave the "least untruthful answer possible" about domestic bulk collection? [0] It's naive to think Apple and Amazon couldn't lie in response to the article, if the intelligence was highly-classified. They may be under extremely strict gag orders (e.g. "give no response whatsoever, including silence, other than denial") and protected by promises of indemnity, as telcos were in the wake of the NS…

The proof of the pudding is in the eating. That makes sense. I ate the pudding it tasted good it proved to me its deliciousness. There is no proof in a pudding that is not eaten.

Re: What Businessweek got wrong about Apple

#140

Post by morisy » Fri, Oct 05, 2018, 2:17 PM UTC

jdorfman wrote: post #11

Stupid legal question, could this end up becoming a defamation lawsuit?

Not a stupid question at all. Assuming the story is false (which I don't assume, and actually think it's probably correct) it would likely depend on the care and process that went into the reporter. Were the editors and reporters reckless and ignore what Apple and Amazon told them? For a cover story of this magnitude, almost certainly not. But it also wouldn't be out of the question for Apple and Amazon to sue if the story was truly completely off.

When I've been sued or threatened with defamation lawsuits, the first thing we go over is how we're going to show we did due diligence, how we came to the conclusions, how we reached out for comment and incorporated that comment into the process.

If Apple and Amazon can figure out the sources, there's also potential for them to sue the background sources, though that's usually tough and messy (because then you have to prove they not only defamed you, but also that they were the ones who were the original source so doesn't happen much).