Could China have used microchips to infiltrate American companies?
Bloomberg Businessweek reports that Chinese spies planted tiny microchips in servers used by around 30 US companies, including Amazon and Apple.
The report comes from Bloomberg Businessweek and it is clear: 30 companies in the United States, including Amazon and Apple, were attacked by Chinese spies who compromised the technology supply chain. According to the article, this was perhaps the most daring hardware hacking operation ever, and the only one publicly reported. Apparently, a unit of the Chinese armed forces 'forced' manufacturers to insert microchips into servers designed by Americans.
The chips were not much bigger than a grain of rice, says Bloomberg, but they were able to subvert the machines they were installed in. And what did they do? They siphoned off data and let in new code, working in the same way as a Trojan horse. The publication says Amazon and Apple discovered the attack through internal investigations and reported it to the US authorities.
Although there is no direct evidence that company or user data was stolen or altered, both companies worked quietly to remove the compromised servers from their infrastructure. Both companies also strongly deny the story.
Amazon says it is untrue that it knew about servers containing malicious chips or modifications in its China-based data centres, or that it worked with the FBI to investigate or provide data on this malicious hardware. Apple is just as firm: it says it has never found this kind of microchip, hardware manipulation or deliberately planted vulnerability in any server.
Nothing is known yet about how the chips were used
The attack was reportedly carried out through Super Micro Computer Inc, commonly known as Supermicro, which is based in the United States. The company is one of the world's largest suppliers of motherboards and subcontracts manufacturers in factories in China and other countries.
Supermicro motherboards are used all over the world, from MRI machines, for example, to weapons systems and the data centres run by tech giants. The company builds servers for hundreds of customers, including Elemental Technologies, the video compression startup Amazon bought in 2015.
A former US intelligence official told Bloomberg to think of Supermicro "as the Microsoft of hardware". "Attacking Supermicro motherboards is like attacking Windows. It's like attacking the whole world."
A worldwide attack
According to the report, Elemental (through Supermicro) was the first target of the Chinese military. The company's servers could be found in US Department of Defense data centres, in CIA drone operations and on the internal networks of Navy warships. In total, the attack is said to have affected around 30 American companies, including government contractors and a major bank.
Parts of this story had been reported before. Apple did end its business relationship with Supermicro in 2016, but the iPhone maker said this was due to a small, unrelated security incident. Amazon also reportedly distanced itself from the compromised Supermicro servers by selling its infrastructure in China to a rival, for reasons that are still unknown.
In a statement to Bloomberg, Amazon admits it found vulnerabilities in Supermicro products, but says they were software problems, not hardware. Facebook, another potential customer, also found problems with that company's products, identifying malware in the software and removing the servers from its data centres.
The American publication's report has not yet been confirmed on the record by US Intelligence sources. The FBI and the Office of the Director of National Intelligence (which represents the CIA and the NSA) declined to comment on the story. However, it is common knowledge that hardware subversions like these are major wins for any country's intelligence services, and the NSA itself has been caught carrying out very similar operations.
They promise big rewards in the form of stolen information, but unlike software attacks, they leave a physical trail behind. As Bloomberg reports, the fallout from this operation will be hard to judge, as has been the case with other large-scale attacks and security breaches. Also according to the report, the US authorities' investigation is still ongoing, three years after it was opened.
