Supermicro concludes 'Big Hack' investigation, says no tampering

Supermicro said an internal review of its production and testing process found no evidence of malicious hardware being implanted onto its motherboards, as a Bloomberg story had reported.

Executives at Super Micro Computer (Supermicro) contended Tuesday that their company did not fall victim to a major supply chain compromise described in a Bloomberg Businessweek story in October.

CEO Charles Liang and senior vice presidents David Weigand and Raju Penumatcha wrote in a letter to customers that a “thorough investigation” by a third-party firm concluded that malicious hardware had not been planted on Supermicro devices.

“Recent reports in the media wrongly alleged that bad actors had inserted a malicious chip or other hardware on our products during our manufacturing process,” the letter reads. “After thorough examination and a range of functional tests, the investigations firm found absolutely no evidence of malicious hardware on our motherboards.”

The Bloomberg story alleged Chinese operatives embedded rice grain-sized chips on motherboards that Supermicro supplied to major technology companies like Apple and Amazon Web Services. The report was immediately met with strong denials from Supermicro and other organizations implicated. Public officials like lawmakers, the FBI director, the director of national intelligence and others also scrutinized the Bloomberg story.

“As we have stated repeatedly since these allegations were reported, no government agency has ever informed us that it has found malicious hardware on our products; no customer has ever informed us that it found malicious hardware on our products; and we have never seen any evidence of malicious hardware on our products,” Supermicro wrote.

The San Jose, California, company said its investigation looked into the manufacturing, auditing, oversight and testing aspects of its production process and could not corroborate the Bloomberg report. The company noted that Supermicro employees are always present with subcontractors (a potential source of compromise), that subcontractors are vetted and that boards are routinely examined by X-rays and other methods for irregularities.

At a Wall Street Journal event in New York City on Tuesday, a senior U.S. government official added to the chorus casting doubt on a reported major supply chain attack, although without explicitly mentioning Supermicro.

“I’ve still seen no examples of hardware tampering, or seen examples of that from anyone else,” said Rob Joyce, a senior adviser for cybersecurity strategy at the National Security Agency.

Joyce noted that from a hacker’s perspective, hardware is one of the most difficult things for an adversary to actually compromise, compared with things like software and personnel.

“There’s certainly a hierarchy of supply chain. When you think about securing your businesses and networks you should be thinking down the pyramid. You need to think about the people you need to give your keys to the business kingdom. Next layer down is the software and services you use,” Joyce said. “You’ve got to worry about the people you intentionally let in first. Hardware is way down the list. It’s really hard to do, its expensive. It leaves a physical trail.”

Alongside its letter, Supermicro released a highly produced video defending its production and oversight process.

“We check every board. We check every layer of every board. And then, we check again,” the video says.

Jeff Stone contributed to this story.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure