CNBC reported that both companies strongly denied the allegations.
In a statement to Bloomberg, Apple argued it has never found malicious chips, hardware manipulations or any other vulnerabilities in any of their servers. The company also claimed that it did not have contact with the FBI or any other agency about such an incident.
Amazon Chief Information Security Officer Steve Schmidt wrote in a blog post that the company at “no time, past or present” found any issues related to modified hardware or malicious chips in any Amazon systems.
Furthermore, China’s Ministry of Foreign Affairs denied having any knowledge of this matter, declaring it is a defender of cybersecurity, according to Bloomberg.
However, something appears to be going on.
Bloomberg’s detailed expose cited up to 17 people with knowledge of the chips, some which had even seen photographs of them. In fact, the chips were allegedly smaller than the tip of a sharpened pencil and were strategically placed in the equipment on servers during the manufacturing process at a facility belonging to Chinese company Supermicro, which assembled the servers.
The sources, who were granted anonymity because of the sensitive nature of the investigation, weren’t the only ones who had knowledge of the chips. Six current and former senior national security officials were also able to provide details about the discovery and the government’s subsequent investigation.
At Supermicro facilities, which are located in China and the U.S., hackers apparently found what Bloomberg called a “perfect conduit for what U.S. officials now describe as the most significant supply chain attack known to have been carried out against American companies.”
This is no small matter, and the implications of such a hack are serious.
One official told Bloomberg that U.S. investigators found that the attack impacted almost 30 companies, including government contractors, a major bank and Apple. The chips were reportedly used to collect intellectual property and trade secrets from American companies.
Bloomberg reported that data from the Department of Defense, Navy warships, NASA, Congress, and the Department of Homeland Security have been used on servers that could have been compromised.
The chips have apparently been the subject of a secret U.S. government investigation since 2015.
Aside from the 17 sources with knowledge of the chips, three senior insiders at Apple told Bloomberg that in the summer of 2015, the company found malicious chips on Supermicro motherboards. Apple reportedly severed ties with the company in 2016, but cited the reasons were unrelated to any chips.
The insiders also said that after Apple discovered the chips, it started removing all Supermicro servers from its data centers. Within a matter of weeks, roughly 7,000 Supermicro servers were replaced. The company reportedly contacted the FBI about the discovery but, as it tends to be with the most information, kept quiet on any details.
During the investigation that followed, Amazon discovered some of the chips hidden in some of its hardware. In fact, one person who had access to photos said the chips were so thin that they could fit between layers of fiberglass on other components.
One government official told Bloomberg that the goal of the hack was long-term access to sensitive government networks and important corporate secrets.
“Hardware attacks are about access,” a former senior official said.
In short, the reason behind such an attack was “to open doors that other attackers can go through,” officials familiar with the investigation told Bloomberg.
It was explained that chips planted on hardware manipulate core operating instructions, allowing attackers to change how devices function in whatever ways they choose.
The extent of the data collected was not immediately known. According to the report, no consumer data was accessed or stolen.
Bloomberg stated that China has always had a “distinct advantage” to spy on U.S. companies because it makes 75 percent of the world’s mobile phones and 90 percent of its PCs.
The investigators concluded that a unit of the People’s Liberation Army was responsible for the attacks, according to people briefed on the group’s activities.
The investigation, which reportedly involves the FBI, remains open.
Bloomberg reported that in the three years since the discovery of the chips, no commercial product to detect any similar hacks has emerged, noting that it is immensely difficult to keep up with technology.
But the bigger issue here is privacy, and what we can do to protect it.