Apple and Amazon refute Bloomberg allegations of hardware hack by Chinese spies

New agency Bloomberg has fallen out with tech giants Amazon.com Inc (NASDAQ:AMZN) and Apple Inc (NASDAQ:AAPL) over a story about Chinese computer hacking.

Bloomberg Businessweek ran a long piece in which it alleged that hardware produced by Super Micro Inc (NASDAQ:SMCI), one of the world’s biggest suppliers of motherboards for computer servers, included microscopic microchips that could compromise network security.

NEW COVER: The Big Hack

China used a tiny chip in a huge hack that infiltrated Apple and Amazon https://t.co/GVLBnWaaue pic.twitter.com/4aNdEwPzAF

— Businessweek (@BW) October 4, 2018

The story, backed by testimony from 17 unnamed sources, said that the hardware hack was perpetrated by Chinese spies and that almost 30 US companies, among them Amazon and Apple, had used the modified motherboards at some point.

Bloomberg claimed that Amazon’s web services division (AWS) discovered the tiny microchip and reported it the US authorities.

Three senior Apple insiders reportedly told Bloomberg that the iPhone maker also found malicious chips on Supermicro motherboards in the summer of 2015. Apple cut its ties with Supermicro the following year.

Both Amazon and Apple refuted the allegations but to paraphrase Mandy Rice-Davies, a participant in an infamous British spy scandal of the 1960s, they would say that, wouldn’t they?

Apple unusually effusive in its denial​

“It’s untrue that AWS knew about a supply chain compromise, an issue with malicious chips, or hardware modifications when acquiring Elemental. It’s also untrue that AWS knew about servers containing malicious chips or modifications in data centres based in China, or that AWS worked with the FBI to investigate or provide data about malicious hardware,” Amazon said in a statement.

“We’ve found no evidence to support claims of malicious chips or hardware modifications,” the statement went on to say.

Apple, generally regarded as being more secretive than the average intelligence organisation, sounded royally cheesed off with Bloomberg’s pursuit of this story.

“Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple. Each time, we have conducted rigorous internal investigations based on their inquiries and each time we have found absolutely no evidence to support any of them. We have repeatedly and consistently offered factual responses, on the record, refuting virtually every aspect of Bloomberg’s story relating to Apple,” Apple’s statement said.

“We are deeply disappointed that in their dealings with us, Bloomberg’s reporters have not been open to the possibility that they or their sources might be wrong or misinformed. Our best guess is that they are confusing their story with a previously-reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple,” Apple said.

Regarding this morning’s ‘The Big Hack’ story, I can’t remember ever seeing a rebuttal from Apple this long or detailed—suggests Bloomberg may have blown it reporting this story: https://t.co/TJsHFgISfw

— Christian Bell (@cshbell) October 4, 2018

Bloomberg acknowledged the denials by the two tech heavyweights but said they were counted by “six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation”.

In all, 17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks, Bloomberg said.

Story by ProactiveInvestors