This can be one of one of the largest corporate spying and hardware hacking campaigns ever launched by a nation-state.
Bloomberg has revealed in its recently published report that a nation-state has launched a significant supply chain attack. It is believed to be one of the largest corporate spying and hardware hacking campaigns ever launched by a nation-state. The espionage campaign is launched through a very small surveillance chip, which is only the size of a grain of rice. This chip is hidden in the servers currently in use by about 30 US firms including the bigwigs Apple, Amazon, and Elemental.
According to Bloomberg, these chips weren’t part of the server motherboard originally. These have been designed by Super Micro, a US-based firm. Reportedly, the malicious chips were inserted when the server motherboards were undergoing manufacturing process, which was carried out in China by their subcontractors.
See: Software used in FBI’s biometric database contains Russian code: Report
Amazon notified the US authorities about the discovery, which sent shockwaves across the intelligence fraternity since these servers are also in use at the Department of Defense data centers, the Navy warships’ onboard networks, and the drone operations from the CIA.
The probe has been active for over three years and investigators believe that the chips have been inserted to let the attackers get an entry to any network that is connected to the servers. This attack is a lot more serious and severe than other software-based attacks identified so far considering that hardware attacks are quite difficult to identify immediately, and by the time these are, a lot of information has been leaked. Spy agencies are the most important beneficiaries of such campaigns and are keen on investing into such a campaign.
The report suggests that Chinese-government sponsored groups infiltrated the supply chain for installing tiny surveillance chips. The devices then were deployed by mainstream US firms as well as the US military, US intelligence agencies, and many other important organizations. Apple, however, discovered the chips installed in Super Micro servers in 2015 after identifying firmware issues and suspicious network activities.
Although the chips were tiny these are capable of performing two key tasks; firstly, the chips can force the device to communicate with an anonymous computer anywhere on the internet, which may be loaded with complex code. Secondly, the chips can prepare the device to accept the new code.
Naturally, the Chinese government is believed to be involved in this campaign, and the primary objective seems to be to spy on US firms and the military.
See: Chinese hackers stole 614 gigabytes of US Navy’s anti-ship missile data
However, after the report was published, Amazon, Apple, and Super Micro all denied the claim from Bloomberg. Apple stated that it hasn’t ever identified malicious chips on the server motherboards from Super Micro or any other hardware manipulations resulting from the planting of tiny chips. The company also denied contacting the FBI or any other investigation agency regarding finding tiny surveillance chips.
Amazon also claims that the story from Bloomberg is untrue and denied anything related to identifying a supply chain compromise or hardware hack. It also denied contacting the FBI for investigation of the incident.
Super Micro and Chinese Foreign Affairs Ministry also denied the findings of the report.
