The Big Hack


'The Big Hack' Articles

Kaspersky Lab Says Report Claiming China Hacked Apple's Former Server Supplier is Likely 'Untrue'

Russia-based cybersecurity company Kaspersky Lab today said that while "hardware supply chain attacks are a reality," evidence suggests Bloomberg Businessweek's report about Chinese intelligence tampering with server motherboards manufactured by Apple's former supplier Supermicro is "untrue." Apple data center Kaspersky Lab said the report "should be taken with a grain of salt" in its 14-page analysis of the alleged attack, obtained by MacRumors:The stories published by Bloomberg in October 2018 had a significant impact. For Supermicro, it meant a 40% stock valuation loss. For businesses owning Supermicro hardware, this can be translated into a lot of frustration, wasted time, and resources. Considering the strong denials from Apple and Amazon, the history of inaccurate articles published by Bloomberg, including but not limited to the usage of Heartbleed by U.S. intelligence prior to the public disclosure, as well as other facts from these stories, we believe they should be taken with a grain of salt.Kaspersky Lab added that the language in both Apple and Amazon statements denying the Bloomberg Businessweek report are "pretty strong" and "leaves little to no chance of retractions or denials at a later time." The firm added that the statements are regulated by the SEC in the United States. The key part of Apple's statement was as follows:On this we can be very clear: Apple has never found malicious chips, "hardware manipulations" or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We

NSA Senior Advisor Latest to Question Report Claiming China Hacked Apple's Former Server Supplier

Rob Joyce, Senior Advisor for Cybersecurity Strategy at the NSA, is the latest official to question the accuracy of Bloomberg Businessweek's bombshell "The Big Hack" report about Chinese spies compromising the U.S. tech supply chain. "I have pretty good understanding about what we're worried about and what we're working on from my position. I don't see it," said Joyce, speaking at a U.S. Chamber of Commerce cyber summit in Washington, D.C. today, according to a subscriber-only Politico report viewed by MacRumors. "I've got all sorts of commercial industry freaking out and just losing their minds about this concern, and nobody's found anything," Joyce added. Joyce, a former White House cybersecurity coordinator, noted that all of the companies named in the Bloomberg Businessweek report have issued strong denials, including Apple, Amazon, and Supermicro. He said those companies would "suffer a world of hurt" if regulators later determine that they lied. Apple's statement read in part:On this we can be very clear: Apple has never found malicious chips, "hardware manipulations" or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.Bloomberg Businessweek, citing 17 unnamed sources, claimed that Chinese spies planted tiny chips the size of a pencil tip on server motherboards manufactured by Supermicro at its Chinese factories. The servers were then sold to companies such as Apple and Amazon for

Apple Tells Congress 'Nothing Was Ever Found' to Suggest Alleged Supply Chain-Based Hack

Apple's top security chief told the U.S. Congress on Sunday that it had found no indication of suspicious transmissions or other evidence that its China supply chain was ever compromised (via Reuters). In a letter to the Senate and House commerce committees, Apple Vice President for Information Security George Stathakopoulos wrote that the company had repeatedly investigated and found no evidence to support Bloomberg Businessweek's bombshell report that alleged tiny chips were discovered inside Apple servers which allowed for backdoor transmissions to Chinese spies. "Apple's proprietary security tools are continuously scanning for precisely this kind of outbound traffic, as it indicates the existence of malware or other malicious activity. Nothing was ever found," he wrote in the letter provided to Reuters.Stathakopoulos repeated Apple's statements to the press that it had never found any such planted chips or been contacted by the FBI over the alleged matter. The letter follows a statement issued on Saturday by the U.S. Department of Homeland Security saying it had no reason to doubt the companies who denied that they had ever discovered the tiny chips. Apple, Amazon, and Supermicro all strongly rebutted the report, which alleged that Chinese intelligence planted microchips in Supermicro servers, which Apple and Amazon previously used in their data centers. Despite the denials, which are also backed by the UK's national cyber security agency, retired Apple general counsel Bruce Sewell, and other unnamed Apple senior executives, Bloomberg said it stood by its

Department of Homeland Security Has 'No Reason to Doubt' Apple's Denial of Supply Chain Compromise

The U.S. Department of Homeland Security today said it has "no reason to doubt" the companies who denied a bombshell Bloomberg Businessweek report this week about Chinese spies using a tiny chip to infiltrate U.S. companies. Homeland Security's full statement:The Department of Homeland Security is aware of the media reports of a technology supply chain compromise. Like our partners in the UK, the National Cyber Security Centre, at this time we have no reason to doubt the statements from the companies named in the story. Information and communications technology supply chain security is core to DHS's cybersecurity mission and we are committed to the security and integrity of the technology on which Americans and others around the world increasingly rely. Just this month – National Cybersecurity Awareness Month – we launched several government-industry initiatives to develop near- and long-term solutions to manage risk posed by the complex challenges of increasingly global supply chains. These initiatives will build on existing partnerships with a wide range of technology companies to strengthen our nation's collective cybersecurity and risk management efforts.Apple, Amazon, and Supermicro have all strongly refuted the report, which alleged that Chinese intelligence planted microchips in Supermicro servers, which Apple and Amazon previously used in their data centers. Apple and Bloomberg Businessweek are in a stalemate, with the former strongly refuting the report, and the latter standing by its reporting. Apple's denial has been backed by not only the Department

Apple's Former Legal Chief Bruce Sewell Says FBI 'Never Heard' of Supermicro Allegations Last Year

Apple's efforts to thoroughly deny this week's bombshell Bloomberg Businessweek report now extend to a former top executive. Apple's former general counsel Bruce Sewell Apple's recently retired general counsel Bruce Sewell told Reuters he called the FBI's then-general counsel James Baker last year after being told by Bloomberg of an open investigation into Supermicro, and was told that nobody at the federal law enforcement agency knew what the story was about. "I got on the phone with him personally and said, 'Do you know anything about this?," Sewell said of his conversation with Baker, reports Reuters. "He said, 'I've never heard of this, but give me 24 hours to make sure.' He called me back 24 hours later and said 'Nobody here knows what this story is about.'" Sewell's comments are consistent with a statement Apple shared with Bloomberg Businessweek and on its Newsroom on Thursday:On this we can be very clear: Apple has never found malicious chips, "hardware manipulations" or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.Also from Apple's Newsroom:No one from Apple ever reached out to the FBI about anything like this, and we have never heard from the FBI about an investigation of this kind — much less tried to restrict it.Apple later clarified that it is not under any kind of gag order or other confidentiality obligations after speculation mounted. Amazon and Supermicro have also

UK's Cyber Security Agency Supports Apple's Denial That Chinese Spies Infiltrated iCloud Servers

The United Kingdom's National Cyber Security Centre has backed Apple's and Amazon's denials of a Bloomberg Businessweek report that claimed Chinese spies planted tiny chips the size of a pencil tip on motherboards manufactured by Supermicro, which both Apple and Amazon used at one time in data center servers. "We are aware of the media reports but at this stage have no reason to doubt the detailed assessments made by AWS and Apple," the agency, a unit of the GCHQ, said in a statement provided to Reuters today. "The NCSC engages confidentially with security researchers and urges anybody with credible intelligence about these reports to contact us," it added. Apple was a Supermicro customer for several years, using its servers to power the likes of iCloud, Siri, and the App Store, although it severed ties with the company in 2016 due to a previously-reported and allegedly unrelated incident in which Apple discovered an infected driver on a single server in one of its labs. Bloomberg Businessweek yesterday reported that Apple discovered the suspicious microchips around May 2015, after detecting odd network activity and firmware problems. Two senior Apple insiders were cited as saying the company reported the incident to the FBI, but kept details tightly held. The insiders cited in the report said in the summer of 2015, a few weeks after Apple identified the malicious chips, the company started removing all Supermicro servers from its data centers. Every one of the 7,000 or so Supermicro servers was replaced in a matter of weeks, according to one of the

Apple Further Refutes Bloomberg Report Suggesting Chinese Spies Tampered With iCloud Servers

Apple has gone to unusual lengths to thoroughly and definitively refute a Bloomberg Businessweek article that today suggested Chinese spies had planted microchips in the Chinese-made Supermicro server motherboards that Apple uses in its facilities. Following the publishing of the article, Apple released a strongly worded statement calling Businessweek's report inaccurate with no evidence to support the claims, and this afternoon, Apple went further and published an entire rebuttal on its website. Apple's press release includes the same statement that was initially provided to Bloomberg Businessweek, along with additional information that the company says it shared with Bloomberg Businessweek ahead of when the server article was released. While Bloomberg Businessweek's report claims that Apple reported the alleged microchip incident to the FBI in 2015, Apple told the news site in no uncertain terms that no one from Apple ever reached out to the FBI, nor had Apple ever heard from the FBI about an investigation. Apple also told Bloomberg Businessweek that despite "numerous discussions" across teams and organizations, no one at Apple had heard anything about the supposed microchip investigation. Apple's updated statement clarifies that Apple is not under any kind of gag order or held to a confidentiality obligation, and it says clearly that the report is "completely untrue" and that no malicious chips have been found in Apple servers. The full additional statement is below:The published Businessweek story also claims that Apple "reported the incident to the

Apple Denies Report Claiming Chinese Spies Planted Microchips in iCloud Servers

Bloomberg Businessweek today reports that around three years ago, the Chinese military began inserting microchips on Supermicro server motherboards while they were being manufactured in China, providing the Chinese government with a stealth doorway into any network that used the tampered hardware. The report cites an official who said investigators found the attack eventually affected nearly 30 companies, including Apple and Amazon, along with a major bank and government contractors in the United States. The microchip was placed on the motherboards in a way that allowed it to inject its own code or alter the order of the instructions the CPU was meant to follow, according to the report. One government official said China's goal was "long-term access to high-value corporate secrets and sensitive government networks." No consumer data is known to have been stolen, according to the report, but the extent of the attack appears to be unclear. Apple was a longtime Supermicro customer, with plans to order more than 30,000 of its server motherboards in two years for its global network of data centers, which power services like the App Store and Siri.Documents seen by Businessweek show that in 2014, Apple planned to order more than 6,000 Supermicro servers for installation in 17 locations, including Amsterdam, Chicago, Hong Kong, Los Angeles, New York, San Jose, Singapore, and Tokyo, plus 4,000 servers for its existing North Carolina and Oregon data centers. Those orders were supposed to double, to 20,000, by 2015.The report claims Apple had around 7,000 of the