China said to insert spy chips into Supermicro servers
In this article (5)
An explosive report has accused Chinese intelligence agencies of sneaking a tiny chip into servers assembled in China for US chip maker Supermicro that introduced hardware vulnerabilities enabling stealth access to any network using the altered devices.
US investigators have found evidence of an unprecedented supply chain attack on servers used by companies including Amazon and Apple.
The allegedly compromised components were used by video streaming company Elemental Technologies for its services compressing video files and optimizing them for different devices.
According to the report, a third party company hired by AWS to scrutinize Elemental’s security in advance of Amazon’s potential acquisition of the company discovered a tiny microchip in a sample server that was not part of the original design. Apple was also reportedly a major Supermicro customer, using its components for a global network of data centers, the report adds.
This chip allegedly allows for the creation of a stealth doorway into any network using the altered servers. The investigation reportedly subsequently found evidence that the chips had been inserted by four subcontractors of Supermicro’s primary manufacturers for its motherboards, which are based in Shanghai and Taiwan.
Interactions between Chinese officials, manufacturers and middlemen in China intercepted by investigators suggest that middlemen offered bribes and threats to coerce the subcontractors to insert the chips on behalf of a PLA unit specializing in hardware attacks, the report claims.
But Amazon, Apple and Supermicro have all subsequently released statements challenging the report. Apple has been particularly firm in its denial of the report, stating that the company has repeatedly found “absolutely no evidence” to support Bloomberg’s claims, and has consistently provided statements refuting almost all aspects of the story as it relates to Apple.
Supermicro has also stated that it is unaware of any investigation and has not been contacted by the government, while China’s Ministry of Foreign Affairs has insisted that the nation “is a resolute defender of cybersecurity” and that supply chain security is a concern of all governments.
Questions & Answers
Q.Which specific companies were reportedly using the compromised server components?
Which specific companies were reportedly using the compromised server components?
The report states that Amazon and Apple used servers containing the altered devices. Also, video streaming company Elemental Technologies reportedly used these components for its services.
Q.How was the alleged spy chip first discovered?
How was the alleged spy chip first discovered?
A third-party company, hired by AWS to check Elemental's security before Amazon's potential acquisition, reportedly found a tiny microchip in a sample server that was not part of the original design.
Q.Which entities are suspected of being involved in inserting the chips?
Which entities are suspected of being involved in inserting the chips?
The investigation reportedly found evidence that four subcontractors of Supermicro's primary motherboard manufacturers inserted the chips. Chinese officials, manufacturers, and middlemen were also implicated in the scheme.
Q.What have the accused companies and the Chinese government said in response to the report?
What have the accused companies and the Chinese government said in response to the report?
Amazon, Apple, and Supermicro have all released statements challenging the report's claims. China's Ministry of Foreign Affairs insists the nation is a resolute defender of cybersecurity.
Reader pulse
Are your supply chain security protocols robust enough?
20,773 votes so far