DHS, Apple push back on Bloomberg supply chain story

U.S. and British security agencies have backed statements by Apple and Amazon Web Services disputing an explosive news report claiming that the Chinese compromised hardware used by the tech giants.

U.S. and British security agencies have backed statements by Apple and Amazon Web Services disputing an explosive news report claiming that Chinese intelligence agents planted malicious computer chips in equipment used by the tech giants.

“[A]t this time we have no reason to doubt the statements from the companies named in the story,” the Department Homeland Security said on Saturday. That echoed a Friday statement from Britain’s National Cyber Security Centre, which said the agency had “no reason to doubt the detailed assessments made by AWS and Apple.”

The blockbuster story from Bloomberg Businessweek claims that Chinese spies placed the tiny chips on server motherboards supplied by Super Micro Computing Inc., setting up a backdoor to some 30 companies, including Apple and AWS. Such a compromise would represent an espionage operation of staggering proportions.

Apple, AWS, and Supermicro all responded with vigorous, detailed denials of key elements of the story.

“At no time, past or present, have we ever found any issues relating to modified hardware or malicious chips in Supermicro motherboards in any Elemental or Amazon systems,” AWS Chief Information Security Officer Steve Schmidt wrote in a blog post.

Apple said it had “repeatedly explained to Bloomberg reporters and editors over the past 12 months” that “there is no truth” to claims that Apple found malicious chips in servers on its network in 2015. In a letter to Congress, VP of Information Security George Stathakopoulos said Apple had not found any indication of outbound traffic from its networks or other evidence of a supply-chain compromise as alleged in the Bloomberg story.

Bloomberg also reported that Apple and Amazon officials notified U.S. officials of the compromises as part of an ongoing investigation. Both companies said they had never taken part in any such investigation.

“Apple never had any contact with the FBI or any other agency about such an incident,” Apple said. “We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.”

In its own statement, Supermicro said it has “never found any malicious chips” on its motherboards, “nor been informed by any customer that such chips have been found.”

Bloomberg says it stands by its reporting, which draws on 17 anonymous corporate and government sources.

A ‘plausible’ attack

The Bloomberg story took the cybersecurity community by storm, leading to speculation on how the attack outlined in the story could have played out.

“[T]he attack described in the article is actually plausible,” wrote Nicholas Weaver, a researcher at the International Computer Science Institute in Berkeley, Calif.

The baseboard management controller (BMC) that was the fulcrum of the reported attack “loads at least some data from such a [malicious] chip,” Weaver wrote in Lawfare. That chip only needs two wires to communicate, he added, “so it would only take two connections for a rogue chip to mask the contents of a SEEPROM or SPI FLASH, replacing the contents and thereby corrupting the BMC by installing the backdoor code.”

The claims made in the Bloomberg story aside, there is no doubt among cybersecurity experts that the supply chain represents a logical vector for nation-state hackers to compromise critical infrastructure. Combing the mountains of computer code used by U.S. defense companies, for example, for vulnerabilities is a daunting task. And U.S. officials have publicly warned of the vulnerability of corporate supply chains to hacking. America’s counterintelligence agency has said 2017 was a “watershed” year in public reporting of big software supply-chain breaches, with seven incidents reported compared to just four between 2014 and 2016.

In responding to the Bloomberg story, DHS and NCSC took the opportunity to publicize their work to secure the supply chain. NCSC urged “anybody with credible intelligence about these reports to contact us,” while DHS touted its recent efforts with critical infrastructure companies to get a clearer picture of supply-chain risk.

The push to designate AI as the next critical infrastructure sector

The designation would unlock a range of federal services, tools and resources for an industry that policymakers view as increasingly tied to national and economic security.

The long-awaited Trump cyber strategy has arrived

Plankey vows to boot China from U.S. supply chain, advocate for CISA budget

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure