Did you hear about the report that said China has been covertly adding tiny microchips to server motherboards that were manufactured in the country? It came out last week, and had the tech world in a tizzy. And why wouldn’t it? The kind of supply chain attack that was presented is quite scary, and certainly possible. And the ramifications of it being true, if it is, could be devastating to our national security. Not surprisingly, the companies who would be victims here claim this is a non-story. That’s not to say there’s nothing here — the report exists for a reason. Just, this is a really big deal and up to this point no one wants to admit it’s true. And why would they? The issue was reported by Bloomberg, who went into great detail on what they uncovered and why it is going on. The feature piece was titled “The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies” and it understandably raised some eyebrows, especially since it claimed nearly 30 major companies or organizations were victimized, including tech giants Amazon and Apple. Bloomberg’s reporting was quite detailed, and the picture it painted was one of deception combined with great technology that was used to fool everyone. It’s a brilliant scheme, really, as secretly installing the chips inside the Super Micro motherboards manufactured by Chinese subcontractors would make it really difficult for anyone to even realize something was amiss. There would be a supply-chain trail, of course, but why would anyone think there was a problem unless they were told to look for one? If true, the microchips would allow backdoor access to a server, which could lead to all sorts of problems. As the Bloomberg report put it, the Chinese spy chips were there to exploit the baseboard management controller, which can let a remote administrator control the computer while modifying existing firmware on the system, likely for malicious purposes. The chip could allow Chinese spies to open a back door into a company’s servers and have free reign to do whatever they’d like. It would be quite the scam, especially since most people probably would not know what to look for to even identify the issue’s existence. IT people could, however, if they noticed when the chip was sending information back to the spies who were using it. As long as the network was being monitored, that communication would obviously be pretty suspicious. But is it a real issue? The answer is not entirely clear. Bloomberg of course stands by their report, which is in-depth and quite worrisome. Apple, Amazon and Super Micro have come out with strong denials of there even being an issue, and an apparent lack of evidence seems to back up their claims. There are no specific details of the Chinese spy chip, only a report that one exists. Up to this point, there is no record of anyone who has actually found one. Therefore, it is easy to conclude that this threat is more conjecture than reality, though that does not mean it is a myth. That said, the Department of Homeland Security released a statement casting doubt on Bloomberg’s report. It reads: “The Department of Homeland Security is aware of the media reports of a technology supply chain compromise. Like our partners in the UK, the National Cyber Security Centre, at this time we have no reason to doubt the statements from the companies named in the story. Information and communications technology supply chain security is core to DHS’s cybersecurity mission and we are committed to the security and integrity of the technology on which Americans and others around the world increasingly rely. “Just this month — National Cybersecurity Awareness Month — we launched several government-industry initiatives to develop near- and long-term solutions to manage risk posed by the complex challenges of increasingly global supply chains. These initiatives will build on existing partnerships with a wide range of technology companies to strengthen our nation’s collective cybersecurity and risk management efforts.” The Bloomberg report named nearly 30 companies as targets of the scheme, which would mean if it is true, the investigations that are going into it right now should ultimately turn up some kind of evidence that proves its existence. Whether or not their findings will be made public is anyone’s guess, so even if it is real, there’s a chance we’ll never know about it. And if a chip is found? Any company affected will have to deal with the knowledge that their servers may have been hacked. The fallout from such a revelation could be dramatic, especially if the rabbit hole they go down leads to the discovery of even more troubles. On a national-security level, it would show how vulnerable our systems can be, especially as tech manufacturing gets outsourced to other, perhaps less-than-friendly countries. Seen through the lens of the trade war the United States is currently in with China, it could make an already strained relationship that much more testy. After all, if Chinese spies have found a way to infiltrate some of America’s most prominent and important tech companies, especially those who millions of people trust and rely on, it would only further the idea that U.S. companies should not trust their Chinese counterparts with building their tech. Should I worry about it? Unfortunately, there seems to be no way of knowing whether or not the spy chips actually exist and, if so, who all they have affected and how. You could be concerned if your motherboard was pieced together by Super Micro, but again, they are denying the story altogether. At this point, all we can do is wait for the investigations to play out and, if they uncover something, figure out what kind of damage was caused. Only from there could we know what steps should be taken, if we can take any at all.<doc-sep>Data center equipment run by Amazon Web Services and Apple may have been subject to surveillance from the Chinese government via a tiny microchip inserted during the equipment manufacturing process, according to a Bloomberg BusinessWeek report on Thursday. The claims in the report have been strongly disputed by the technology giants. The chips, which Bloomberg said have been the subject of a top secret U.S. government investigation starting in 2015, were used for gathering intellectual property and trade secrets from American companies and may have been introduced by Super Micro, a Silicon Valley company that manufacturers parts for servers in China. Apple, AWS and Super Micro dispute the report. Apple said it did not find the chips as asserted by BusinessWeek — which cited anonymous government and corporate sources. Super Micro reportedly denied that it introduced the chips during the manufacturing. Shares of Super Micro plummeted more than 40 percent following the report. Trading of the small server company's common stock on the Nasdaq was suspended on Aug. 23 after repeatedly missing SEC filing deadlines. Super Micro shares now trade on over-the-counter markets. Apple shares edged 1 percent lower in Thursday trading, while Amazon fell about 1.5 percent.<doc-sep>
It’s not just regular people, apparently even major corporations aren’t free from the risks of being hacked. According to a recent report that seems straight out of a spy thriller, Apple, Amazon, and various US government contractors were hacked by groups based in China, looking to steal more than just data. The microchips used - Courtesy Bloomberg Business Week In fact, according to Bloomberg Business Week, authorities believe no actual consumer data was stolen from the breaches. However, the Chinese perpetrators apparent used tiny microchips smuggled into the American companies’ offices in order to get their hands on trade secrets. The chips allegedly used were miniscule, about the size of the head of a pencil. They were supposedly added to server motherboards built by Super Micro, a Taiwanese-American conglomerate, which were purchased and used by the likes of Amazon Web Services and Apple. The operation went well beyond any software-based securities the companies could have prepared. Instead, because the chips had networking capability, memory, and processing power, they could simply directly intercept and transfer data. And because they looked just like coupling pieces, no one was the wiser. According to the report, US officials describe the operation as “the most significant supply chain attack known to have been carried out against American companies.” Apple is still denying the report, and even that it worked with FBI to investigate this matter in 2015 “On this, we can be very clear: Apple has never found malicious chips, ‘hardware manipulations’ or vulnerabilities purposely planted in any server.” the company said. “Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.” Amazon also said it had found to evidence to support the claims that it discovered chips or worked with the government. Whether the companies are attempting to save face or have been instructed by the FBI to not reveal the matter is still unclear. Supposedly, the chips were inserted into Super Micro's servers builds sometime during the production process, allegedly by operatives of the People’s Liberation Army. You know, China’s official military. The claims are so brazen, it’s not likely they’re untrue, which could then possibly lead to the many companies partnering Chinese manufacturing to shift out of the country. That in itself would be a massive flow, considering how many of them rely on the cheap labour there, but it also could spark another round in the current trade war between the US and China. And how much that affects the price of devices in the rest of the world remains to be seen.