Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

cnbc.com

Post reply on HN
Print view View original

261–270 of 289 posts

Re: AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

#261

Post by simias »

bsder wrote: post #211
jackconnor wrote: post #169

Earlier quoted context omitted.

Well, if you're Apple/Amazon you have the SEC and your shareholders ready to ruin your life if you say anything that could even be interpreted as a lie. So, in this hypothetical you may not want to, but you will definitely feel forced to.

You can also have the government out to ruin your life if you don't cooperate. See: Joseph Nacchio and Qwest

I can't believe that the government would blackmail Tim Cook into writing such a strongly worded rebuttal and then, weeks later when the story is not making the front pages anymore, have him write a call for retraction which brings this story back in the news cycle. That makes zero practical sense. That's the problem with many conspiracy theories: they make it seem like the people pulling the strings are incredibly clever and powerful while at the same time completely clueless and coming up with extremely complex plans to achieve mundane goals.

I could believe it if the denials so far felt incomplete or ambiguously worded as if they were tiptoeing around something that they were not allowed to disclose. I could believe it if all we had coming from Apple and Amazon was the usual lawyer-speak "I won't confirm of deny" bullshit. Instead we've had completely unambiguous "this is completely false and never happened". If it turns out to be a lie it's going to be devastating for the trust in Apple or Amazon.

I mean think about it, if for some reason the US or Chinese agencies wanted to downplay or shift the blame they had so many easier ways to do it that would put them in an awkward position if somebody manages to prove the existence of these backdoored mobos. If the best spin they could come up with was "just deny everything and make sure to do so at a regular interval so people are constantly aware of our denial" they really need better PR people.

Re: AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

#262

Post by SEJeff »

will4274 wrote: post #210
SEJeff wrote: post #202

Earlier quoted context omitted.

The Apple and Amazon statements were bulletproof, and would very likely guarantee them shareholder lawsuits if they were in fact falsified. Additionally, the SEC would likely investigate if this did happen (since it would be fraud with harmed investors looking for blood)

> Additionally, the SEC would likely investigate if this did happen The phone companies all denied providing metadata to the NSA when the story first came out. I couldn't find the WaPo article from the same week, which I remembering reading in hardcopy, but here's a cite for the same from NPR: https://www.npr.org/templates/story/story.php?storyId=540913... . Did the SEC sue Verizon here?

Yeah I don't think those are really related. Apple was exceptionally clear that this simply didn't happen. Verizon is very careful about how they word that to say they didn't turn them over to the NSA, while omitting all of the other three letter agencies (DIA, FBI, DOJ, etc).

Compare that with Apple's statement, which is forcefully blunt and has no wiggle room:

    On this we can be very clear: Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.
The fact that they then asked Bloomberg to retract the story is also going a step further. The next step would be a libel lawsuit against Bloomberg, but that would be the thermonuclear option.

All of that said, the BMC on supermicro boxes is running a super old unpatched Linux and is absolutely chock full of exploits:

https://www.cvedetails.com/google-search-results.php?q=super...

I had to root one several years ago to fix a broken server we couldn't take out of service for $reasons.

Re: AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

#263

Post by ChicagoBoy11 »

sonnyblarney wrote: post #61
jackconnor wrote: post #16

There should be hundreds of thousands or millions of these hacked motherboards, and nobody has found a single one despite hardware geeks worldwide searching like it was Willy Wonka's final golden ticket. This story was bogus, it most likely came from a ton of rumors that got conflated, hence why they had to go with anonymous sources as opposed to any physical evidence. I'd be surprised if Bloomberg has any credibilit…

"There should be hundreds of thousands or millions of these hacked motherboards" No, the boards would be selectively hacked. And we know it happens because 'we' do it as well. Surely there is evidence floating around but it's also unlikely that companies would want to admit the breach. I kind of believe Apple and Amazon though, there's too much risk if they were to be caught lying. This is a weird one ...

Is there, though? Take the latest Google example where they were less than forthcoming about user data that was accessed. Did anything ultimately happen to them? I think the same would happen in this case. If it were found, I'm sure they could quickly come up with some BS excuse that it was the best way to prevent the potential damage from being greater, that all along they had been investigating and doing whatever they could to mitigate the damage, yada yada yada. Then cue massive outrage. Followed by everyone else using their thing products as usual

Re: AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

#264

Post by moftz »

drb91 wrote: post #126
moftz wrote: post #107

Earlier quoted context omitted.

You only want to slip in as few of these implants as possible to get in. You obviously want to hit as many networks as possible but only for targets that actually make sense. Hitting a DoD network has higher value than hitting the Mormon church's streaming servers. If these implants are real, they aren't cheap and the less that are in the wild, the less chance someone will find one on accident. If the implant actuall…

Any evidence of this theory?

No evidence whatsoever. Just all speculation based on previous targeted malware attacks that are public knowledge.

Re: AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

#265

Post by ardy42 »

PeterisP wrote: post #253
ardy42 wrote: post #236

Earlier quoted context omitted.

> Not necessarily received, but at least seen them and verified that the described thing actually exists. If they don't even have a single frigging photo that they can show us (up until now they have only shown CGI renderings that they fabricated themselves showing how it might have looked), then that seems to imply that they haven't done any due diligence. I don't know about you, but I certainly couldn't get a photo…

If you're not holding that motherboard in your hands, then you definitely "don't have accurate information to base a story on" if that story is about inserted extra hardware - the story Bloomberg reported relies on analysis of that motherboard. If you find an anomaly in the dev server but can't open it up to look at the motherboard, then you can blow the whistle that something weird is happening, but you're not quali…

> If you're not holding that motherboard in your hands, then you definitely "don't have accurate information to base a story on" if that story is about inserted extra hardware - the story Bloomberg reported relies on analysis of that motherboard.

I disagree. What if you have a the text of a government report describing the reactions to its discovery in detail (e.g. "an implant was found attached to the BMC of some Supermicro boards, here's our plan for securing the supply chain against implants as small as 1x1mm...")? What if they were shown a report but not given a copy? What if you have consistent testimony from five credible people whose backgrounds check out who read the only copy of the report in a secure reading room? What if all that is verbally confirmed by other insiders?

> In this case, the relevant documents would be the technical details of that malware - photos of the motherboard with the inserted hardware, schematics and analysis of where and how the inserted chip connects to the "real" parts, dumps of the firmware alterations, microscopy analysis of the extra chip after decapping it.

The Bloomberg reporters aren't security researchers. All of the stuff you describe is well outside their areas of expertise or what they can be reasonable expected to do. They're doing their job if they report what they learn from others, it's not their job to perform research or replicate research themselves.

Journalism is more like history than archeology, but a lot of people seem to want it to be the other way around.

Re: AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

#266

Post by kevinmchugh »

sooheon wrote: post #218
kevinmchugh wrote: post #157

Earlier quoted context omitted.

What's perverse about it? Bloomberg decided that the market is a good way to measure impact of their stories. They're business reporters, so that makes sense. The incentive is not directional; it doesn't rely on reporters causing a stock to lose value or gain it.

> The incentive is not directional The magnitude matters. Meaning journalists have an incentive to stretch the truth in either direction, as long as it'll get a reaction. A journalist now has to weigh this monetary incentive against their other incentives for being non-hyperbolic, truthful journalists.

The business insider article linked above makes it sound like a relatively nuanced measure. If the article makes a big splash but then gets wiped away by follow-up reporting, it doesn't sound like it gets rewarded.

Think about articles that don't move the market: did they contain novel, important information? If so, why didn't the market move?

It seems like this incentive encourages prioritizing stories which are unreported and meaningful.

Re: AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

#267

Post by sonnyblarney »

drb91 wrote: post #243
acct1771 wrote: post #231

Earlier quoted context omitted.

Do you truly believe his point to be unrelated, this isn't a debate about GP's tone? I think what parent touches on in their "tangent" is indeed the most important thing to come out of this story.

I do truly believe it to be unrelated and veering into attractive-but-unsubstantiated conspiracy territory.

The United States spends 10's of billions of dollars spying on it's enemies. They hack, install spyware, require backdoors, use phishing, social engineering. So does China, Russia etc. and this is not a conspiracy.

Re: AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

#268

Post by nneonneo »

vlovich123 wrote: post #215
stupidbird wrote: post #207

Earlier quoted context omitted.

If they were instructed to do so by the government they would not really have a choice, which would very likely produce leaks. If true, this is vastly different from the government requesting a backdoor or various warrant canaries, this would be an actual national security threat.

Is there any mechanism that the government can use to force you to lie? I know they can keep you silent but forcing you to say anything, true or otherwise, feels like a huge 1st amendment issue as the government can't typically compel speech, can it? I'm not a lawyer so curious on the perspective of someone who might know the details better.

Under certain circumstances the government can force a person or corporation to produce speech that is true - for instance, they are allowed to force you to file your taxes. However, there has never been a case to my knowledge where the government has been able to compel a lie - and any attempt to do so would immediately be subject to a legal case over constitutionality.

Re: AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

#269

Post by ufmace »

stevehawk wrote: post #178
kbenson wrote: post #170

Earlier quoted context omitted.

If the intelligence community expects what they say to be reported as fact, then they need to pony up at least something to verify their claims. Otherwise the news media is just a mouthpiece for the intelligence community. That's particularly bad because one of their jobs is to be a check against just such behavior.

But it likely isn't the IC saying it so much as a whistleblower saying.

Of course intelligence agencies would never do such a thing as have one of their officers pretend to be a whistleblower in order to trick the news media into publishing their propaganda. /s

Re: AWS CEO Jassy follows Apple in calling for retraction of Chinese spy chip story

#270

Post by monocasa »

PeterisP wrote: post #254
monocasa wrote: post #156

Earlier quoted context omitted.

These were supposedly targeted attacks. Why would Bloomberg have access to AWS and Apple internally designed boards?

Because the sources in AWS and Apple who reported this issue to Bloomberg have access to the boards they're reporting about? What details and evidence about these boards have these sources provided to Bloomberg? Are there any details or evidence?

Not if they've been destroyed or handed over to the authorities.
Post reply on HN