Supermicro along with Apple and Amazon refute claims in Bloomberg story

by Hilbert Hagedoorn on: 10/05/2018 07:59 AM | source: supermicro | 43 comment(s)

Super Micro Computer, Inc. (SMCI), a global leader in enterprise computing, storage, networking solutions and green computing technology, strongly refutes reports that servers it sold to customers contained malicious microchips in the motherboards of those systems.

In an article today, it is alleged that Supermicro motherboards sold to certain customers contained malicious chips on its motherboards in 2015. Supermicro has never found any malicious chips, nor been informed by any customer that such chips have been found.

Each company mentioned in the article (Supermicro, Apple, Amazonand Elemental) has issued strong statements denying the claims:

Apple stated on CNBC, "We are deeply disappointed that in their dealings with us, Bloomberg's reporters have not been open to the possibility that they or their sources might be wrong or misinformed. Our best guess is that they are confusing their story with a previously reported 2016 incident in which we discovered an infected driver on a single Supermicro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple."

Steve Schmidt, Chief Information Security Officer at Amazon Web Services stated, "As we shared with Bloomberg BusinessWeek multiple times over the last couple months, at no time, past or present, have we ever found any issues relating to modified hardware or malicious chips in Supermicro motherboards in any Elemental or Amazon systems.‎"

Supermicro has never been contacted by any government agencies either domestic or foreign regarding the alleged claims.

Supermicro takes all security claims very seriously and makes continuous investments in the security capabilities of their products. The manufacture of motherboards in China is not unique to Supermicro and is a standard industry practice. Nearly all systems providers use the same contract manufacturers. Supermicro qualifies and certifies every contract manufacturer and routinely inspects their facilities and processes closely.

Related Stories

SuperMicro to release two Supero X299 motherboards (updated) - 06/02/2017 04:03 PM
Supermicro presented its C7X299-PG at the IT trade show Computex in Taiwan. Much like all Intel board partners Supermicro is cooking up something nice as well. And I do say nice with a reason, as prev...

Review: SuperMicro C7Z270-CG Motherboard - 01/19/2017 09:51 AM
It is the era of the Z270 schipset, and in this article we cover the SuperMicro C7Z270-CG review. It is advertised as a server grade motherboard, but will it deliver in performance, features and aesth...

Review: SuperMicro C7Z170-SQ motherboard - 11/03/2015 09:08 AM
In this review we look at a SuperMicro C7Z170-SQ motherboard from their new Gaming series. SMC is predominantly active in the server market, however they have a new gaming line of consumer grade mainb...

SPARKLE CalibreCUTi Supermicro Computer - 01/19/2010 12:28 PM
Sparkle announced the Calibre CUTi, a revolutionary small form factor PC providing high definition 1080p playback and digital surround sound for a variety of multimedia formats displayed right on a us...

3 pages 1 2 3

vbetts
Moderator

Posts: 14180
Joined: 2006-07-04

#5592670 Posted on: 10/05/2018 01:16 PM

So basically it seems like the equivalent to clickbait for Bloomberg.

JamesSneed
Senior Member

Posts: 439
Joined: 2017-02-14

#5592681 Posted on: 10/05/2018 01:59 PM

I would expect a lawsuit to be imminent as Super MIcro has a very good case for damages. Amazon just handed the case to them by saying we told Bloomberg reporters for months that this server espionage was not the case.

HawaiianBrian
Senior Member

Posts: 234
Joined: 2014-10-22

#5592698 Posted on: 10/05/2018 02:41 PM

Bloomberg = Fake news. I don't like Trump but he's right about the whole "fake news" thing in the media.

WareTernal
Senior Member

Posts: 247
Joined: 2013-09-27

#5592873 Posted on: 10/05/2018 10:23 PM

So basically it seems like the equivalent to clickbait for Bloomberg.

Not just for Bloomberg

...This is a totally recycled story we've got here. The original story clearly said 'Amazon, Apple, and Supermicro disputed summaries of Bloomberg Businessweek’s reporting.'

I knew that chip could not do what it was being claimed to do.

I'm not so sure about that. This sounds feasible to me. One chip can do a lot.

Nothing new here yet. We still know nothing for sure.
Right now we've allegedly got anonymous 17 sources confirming various parts of this story.
My faith in 'anonymous sources' = 0.
We've got no sample, or even picture, of the hardware in question.
The FBI's refusal to comment, and denials of knowledge by all of the parties involved would be normal for a 'secret FBI investigation'.

HeavyHemi
Senior Member

Posts: 6018
Joined: 2008-10-27

#5592884 Posted on: 10/05/2018 10:43 PM

Bloomberg = Fake news. I don't like Trump but he's right about the whole "fake news" thing in the media.

This is the danger. Taking one story like this and painting all of media with it. So, no he's isn't especially since what he's claiming is 'fake news' are factual articles about him. So lets be careful in how we describe things.
Back on topic.
This story smelled from the beginning to me simply from the lack of even one physical device being uncovered. Not a one.

tunejunky
Senior Member

Posts: 800
Joined: 2017-08-18

#5592887 Posted on: 10/05/2018 10:53 PM

actually, in cases like these, the chance of Bloomberg (or the traditional media) being "fake" with allegations like these is zero.

why zero? because every printed story naming names and companies have been triple verified to avoid libel.

Bloomberg is first and foremost a business media outlet.

the fact that we've heard from corporate public relations means nothing. if these allegations were false the lawyers would be talking, not P.R. hacks.

WareTernal
Senior Member

Posts: 247
Joined: 2013-09-27

#5592894 Posted on: 10/05/2018 11:27 PM

So lets be careful in how we describe things.
Back on topic.
Next time, "let's be careful" and stay on topic in the first place...

the chance of Bloomberg (or the traditional media) being "fake" with allegations like these is zero
why zero? because every printed story naming names and companies have been triple verified
There's just no logic to back that up. If by "every printed story naming names", you mean the one Bloomberg story that we're talking about, the one that didn't name any names, and you just going on the authors word that everything is super verified and double fact checked with a blue star, then you just missed the point.

The strength of your opinion doesn't ~= fact.

Fox2232
Senior Member

Posts: 8504
Joined: 2012-07-20

#5592901 Posted on: 10/05/2018 11:39 PM

It had no ware enough traces to do what it calmed to do and super micro sells too many servers for no one to come forward with info.

That's correct. With few wires, there is only feasible vector of attack. That's flash memory for BIOS or other part. There just 3 additional wires from GND and Vcc are needed.
But their description is so vague that this simple to describe attack vector is very likely out of question.

lantian
Senior Member

Posts: 296
Joined: 2013-08-16

#5593054 Posted on: 10/06/2018 12:07 PM

Noisiv
Senior Member

Posts: 6560
Joined: 2010-11-16

#5593088 Posted on: 10/06/2018 01:47 PM

Have to say, that if these claims would be so wrong there would be Cease and Desist Order issued already for Bloomberg. Only PR responding and denying it gives it some actual legitimacy.

When was the last time you heard of Cease and Desist Order pulled over fake news? Ever...?

After all someone making false claims about you is enough ground for a lawsuit. Since that has not happened...

Lawsuit over what?
Reporting that "according to extensive interviews with government and corporate sources " and quoting people "one official says " is hardly illegal.

tunejunky
Senior Member

Posts: 800
Joined: 2017-08-18

#5593124 Posted on: 10/06/2018 03:18 PM
Next time, "let's be careful" and stay on topic in the first place...

There's just no logic to back that up. If by "every printed story naming names", you mean the one Bloomberg story that we're talking about, the one that didn't name any names, and you just going on the authors word that everything is super verified and double fact checked with a blue star, then you just missed the point.

The strength of your opinion doesn't ~= fact.

WRONG
they named the companies, who are able to sue for false claims, market interference, and a chilling effect.

and i'm not going on ANYBODY's WORD.
you are obviously unacquainted with business at the corporate level. "Bloomberg" is not just highly regarded, It Has Professional Standards that lead its industry.

i stand by every word i posted.

until the lawyers for Amazon, SuperMicro, and Apple speak i stand with Bloomberg.

and obtw, it is simplicity itself (not counting the actual device) for the Chinese to plant bugs in specific batches of mobo's.
they're in China, with Chinese workers, working for a Chinese company that is beholden to its repressive government.

i've spent the first 10 years of my career riding herd on Dual Use electronics (because of Cold War export controls) and i can testify factually on the pervasive attempts to buy, steal, copy, or borrow technology by the Russians and Chinese. it never stops...ever.

Astyanax
Senior Member

Posts: 1040
Joined: 2018-03-21

#5593383 Posted on: 10/07/2018 09:02 AM
This is the danger. Taking one story like this and painting all of media with it. So, no he's isn't especially since what he's claiming is 'fake news' are factual articles about him. So lets be careful in how we describe things.
Back on topic.
This story smelled from the beginning to me simply from the lack of even one physical device being uncovered. Not a one.

not just the lack of evidence of it, i asked a pcb engineer and she said the particular placement of the chip would make it impossible to tell actual data from electronic noise.

sykozis
Senior Member

Posts: 20812
Joined: 2008-07-14

#5593481 Posted on: 10/07/2018 03:41 PM
actually, in cases like these, the chance of Bloomberg (or the traditional media) being "fake" with allegations like these is zero.

why zero? because every printed story naming names and companies have been triple verified to avoid libel.

Bloomberg is first and foremost a business media outlet.

the fact that we've heard from corporate public relations means nothing. if these allegations were false the lawyers would be talking, not P.R. hacks.
Amazon's response wasn't from a "PR hack".... It was from the Chief Information Security Officer at AWS...

Bloomberg claims that affected systems were sold to specific customers. The issue here is that the manufacturing plant in China would not know exactly what customers would get what boards, making it impossible to target specific companies. The manufacturing plant would also have to modify intended circuits and add a lot of new circuits to account for the functionality of these "smaller than a grain of rice" chips. When did China develop the technology to create such a small chip and all the traces necessary to pull off such a feat? The necessary traces alone would make the chip larger than a grain of rice.

tunejunky
Senior Member

Posts: 800
Joined: 2017-08-18

#5593787 Posted on: 10/08/2018 02:55 PM
Amazon's response wasn't from a "PR hack".... It was from the Chief Information Security Officer at AWS...

Bloomberg claims that affected systems were sold to specific customers. The issue here is that the manufacturing plant in China would not know exactly what customers would get what boards, making it impossible to target specific companies. The manufacturing plant would also have to modify intended circuits and add a lot of new circuits to account for the functionality of these "smaller than a grain of rice" chips. When did China develop the technology to create such a small chip and all the traces necessary to pull off such a feat? The necessary traces alone would make the chip larger than a grain of rice.

you are forgetting that this is a state actor.
SuperMicro may or may not know where the shipments are bound, but China can easily manipulate that with export controls.
also, passive sensor technology has been progressing by leaps and bounds. who knows what the State Labs in China (or here) produce?
the U.S., back when only the U.S. and Japan made computer components, had back-doors into just about every hdd and a lot of the early networks. some of which were hardware, not software. i know this for a fact as i worked for the premier manufacturer of optical drives and optical technology and we had to operate under certain controls...and these were ROM.
every early laptop was essentially "bugged" until Chinese manufacturing came online.
this is not paranoia, it's fact of record so i'm very cynical.

fantaskarsef
Senior Member

Posts: 9924
Joined: 2014-07-21

#5593851 Posted on: 10/08/2018 04:34 PM
Apparently, neither was a concrete case given where this alleged placement of chips really happened, nor who gave the information away. Fake news coming from the pentagon?
https://translate.google.at/translate?sl=de&tl=en&js=y&prev=-t&hl=de&ie=UTF-8&u=https%3A%2F%2Ffm4.orf.at%2Fstories%2F2940104%2F&edit-text=&act=url

3 pages 1 2 3

Post New Comment
Click here to post a comment for this news story on the message forum.