Cloud Native/NFV

Chinese Hardware Hack Threatens US Tech Supply Chain – Bloomberg

Chinese spies compromised server hardware for nearly 30 US companies, including Amazon and Apple, as well as the US government, in a bold espionage attempt to compromise the US's entire technology supply chain, according to a Bloomberg report early Thursday.

Amazon.com Inc. (Nasdaq: AMZN) discovered spy chips mounted on the motherboards of servers manufactured by Super Micro Computer for Elemental Technologies, in 2015. Amazon was considering acquiring Elemental, which made video streaming software, to bolster its Prime video service, according to the Bloomberg report. Apple discovered the attacks independently at about the same time in its own data center server hardware.

The allegations, if true, have broad implications. Super Micro Computer, also known as Supermicro, is one of the world's biggest suppliers of server motherboards. Elemental's servers can be found in Department of Defense Data Centers, CIA drone operations and onboard networks for Navy warships. And Elemental is just one of hundreds of Supermicro customers, Bloomberg reports.

Amazon reported their findings to US authorities. The US government is continuing to probe the incident more than three years later. It determined the chips allow attackers to "create a stealth doorway into any network that included the altered machines," Bloomberg said. "Multiple people familiar with the matter say investigators found that the chips had been inserted at factories run by manufacturing subcontractors in China," according to the report. China, which dominates electronics manufacturing, is uniquely poised to pull off this kind of attack, though even China would find an attack on this level extremely difficult.

By BalticServers.com [GFDL or CC BY-SA 3.0 ], from Wikimedia Commons
By BalticServers.com [GFDL or CC BY-SA 3.0 ], from Wikimedia Commons

Now entering its fifth year, the 2020 Vision Executive Summit is an exclusive meeting of global CSP executives focused on navigating the disruptive forces at work in telecom today. Join us in Lisbon on December 4-6 to meet with fellow experts as we define the future of next-gen communications and how to make it profitable.

Bloomberg says US officials describe the incident as "the most significant supply chain attack known to have been carried out against American companies."

Bloomberg reports:

One official says investigators found that it eventually affected almost 30 companies, including a major bank, government contractors, and the world's most valuable company, Apple Inc. Apple was an important Supermicro customer and had planned to order more than 30,000 of its servers in two years for a new global network of data centers. Three senior insiders at Apple say that in the summer of 2015, it, too, found malicious chips on Supermicro motherboards. Apple severed ties with Supermicro the following year, for what it described as unrelated reasons.

In emailed statements, Amazon (which announced its acquisition of Elemental in September 2015), Apple, and Supermicro disputed summaries of Bloomberg Businessweek's reporting. "It's untrue that AWS knew about a supply chain compromise, an issue with malicious chips, or hardware modifications when acquiring Elemental," Amazon wrote. "On this we can be very clear: Apple has never found malicious chips, 'hardware manipulations' or vulnerabilities purposely planted in any server," Apple wrote. "We remain unaware of any such investigation," wrote a spokesman for Supermicro, Perry Hayes. The Chinese government didn't directly address questions about manipulation of Supermicro servers, issuing a statement that read, in part, "Supply chain safety in cyberspace is an issue of common concern, and China is also a victim." The FBI and the Office of the Director of National Intelligence, representing the CIA and NSA, declined to comment.

On the other hand, Bloomberg says it has 17 people confirming its story, including "six current and former senior national security officials," and Amazon and Apple insiders.

"One government official says China's goal was long-term access to high-value corporate secrets and sensitive government networks. No consumer data is known to have been stolen," says Bloomberg.

Bloomberg has a great deal more information in its in-depth report: The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies.

The Bloomberg investigation lends credence to claims that China is implanting spy technology in the electronics it exports to the US, which at times have appeared like political posturing, notes my colleague Jamie Davies at Telecoms.com. (See Maybe the Chinese espionage rhetoric is more than political hot air.)

Huawei Technologies Co. Ltd. and ZTE Corp. (Shenzhen: 000063; Hong Kong: 0763) have been subject to sweeping bans by the US government in doing business in America. Huawei recently launched an effort to convince the Federal Communications Commission to open the doors to US trade. (See Huawei Hasn't Given Up on US Market, Pitches the FCC.)

— Mitch Wagner Follow me on Twitter Visit my LinkedIn profile Visit me on Tumblr Follow me on Facebook Executive Editor, Light Reading

brooks7 10/8/2018 | 5:50:32 PM
Re: Apple, Amazon & Chinese denials https://www.youtube.com/watch?v=RwXEQYW0RSQ


Some more follow-up on this.

Mitch Wagner 10/5/2018 | 1:32:21 PM
Apple, Amazon & Chinese denials Apple and Amazon's denials, in response to the Bloomberg article, are unusually vehement and specific.


Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple. Each time, we have conducted rigorous internal investigations based on their inquiries and each time we have found absolutely no evidence to support any of them. We have repeatedly and consistently offered factual responses, on the record, refuting virtually every aspect of Bloomberg's story relating to Apple.

On this we can be very clear: Apple has never found malicious chips, "hardware manipulations" or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.


Today, Bloomberg BusinessWeek published a story claiming that AWS was aware of modified hardware or malicious chips in SuperMicro motherboards in Elemental Media's hardware at the time Amazon acquired Elemental in 2015, and that Amazon was aware of modified hardware or chips in AWS's China Region.

As we shared with Bloomberg BusinessWeek multiple times over the last couple months, this is untrue. At no time, past or present, have we ever found any issues relating to modified hardware or malicious chips in SuperMicro motherboards in any Elemental or Amazon systems. Nor have we engaged in an investigation with the government.

There are so many inaccuracies in ‎this article as it relates to Amazon that they're hard to count.

Bloomberg BusinessWeek published the denials in full (also an unusual step), along with a statement from China's Ministry of Foreign Affairs.
Sign In