A Cybersecurity Fiasco: Chinese Spies Plant a Microchip to Tamper US Tech-Giants’ Server

Bloomberg Businessweek reported earlier this month that Chinese spies allegedly exploited the technical supply chain of 30 major US companies, including Apple and Amazon by planting tiny microchips on motherboards used on their servers.

The malicious chips, which were not part of the original server motherboards designed by the U.S-based company Super Micro, had been inserted during the manufacturing process in China.

The chips, which Bloomberg said have been the subject of a top-secret U.S. government investigation started in 2015, would allow attackers to covertly modify these servers, bypass software security checks, gather intellectual property, trade secrets and essentially give the Chinese government a complete backdoor into these American companies’ network.

If true, this might be one of the largest corporate espionage and hardware hacking programs in the history of cybersecurity.

APPLE, AMAZON AND SUPERMICRO REJECTS THE BLOOMBERG REPORT

However, the impacted companies such as Apple and Amazon are fiercely disputing the claims. Meanwhile, Supermicro and Chinese Ministry of Foreign Affairs have also strongly denied Bloomberg’s findings by releasing lengthy statements.

Some highlights from the responses released by Apple, Supermicro and Amazon, according to a Bloomberg report are listed below:

APPLE

“Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.”

SUPERMICRO

“While we would cooperate with any government investigation, we are not aware of any investigation regarding this topic nor have we been contacted by any government agency in this regard. We are not aware of any customer dropping Supermicro as a supplier for this type of issue.

Furthermore, Supermicro doesn’t design or manufacture networking chips or the associated firmware and we, as well as other leading server/storage companies, procure them from the same leading networking companies.”

AMAZON

“It’s untrue that AWS knew about a supply chain compromise, an issue with malicious chips, or hardware modifications when acquiring Elemental. It’s also untrue that AWS knew about servers containing malicious chips or modifications in data centers based in China, or that AWS worked with the FBI to investigate or provide data about malicious hardware.

We’ve re-reviewed our records relating to the Elemental acquisition for any issues related to SuperMicro, including re-examining a third-party security audit that we conducted in 2015 as part of our due diligence prior to the acquisition. We’ve found no evidence to support claims of malicious chips or hardware modifications.”

VERDICT

These assertive statements are leading national security experts to question who exactly is telling the truth. The prospect of this kind of attack is very real, but the fact that both Bloomberg and the companies named in the story are rivaling is confusing everyone, and a sign that we are probably not done hearing about this story anytime soon.

However, If the Bloomberg story turns out to be true, Amazon and Apple would seem to be lying and invalidating a potential global security risk. Ultimately, a deeper look into this potential attack shall be conceded.