The tiny surveillance chip, which is not much bigger than a grain of rice, can bypass all security checks and give Beijing secret access to internal networks, Bloomberg BusinessWeek reported citing 17 unnamed intelligence and company sources. According to Bloomberg BusinessWeek, a unit of the Chinese People’s Liberation Army intruded the supply chain of US-based computer hardware maker Super Micro Computer Inc to plant malicious chips that could be used to steal corporate and government secrets. “Apple made its discovery of suspicious chips inside Supermicro servers around May 2015, after detecting odd network activity and firmware problems, according to a person familiar with the timeline,” the report said. “Since the implants were small, the amount of code they contained was small as well. But they were capable of doing two very important things: telling the device to communicate with one of several anonymous computers elsewhere on the internet that was loaded with more complex code; and preparing the device’s operating system to accept this new code.” According to the publication, the chips were reportedly added to help Chinese government spy on American companies and their users, which is “more difficult to pull off and potentially more devastating, promising the kind of long-term, stealth access that spy agencies are willing to invest millions of dollars and many years to get.” “Depending on the board model, the chips varied slightly in size, suggesting that the attackers had supplied different factories with different batches,” the report said. In regards to this, Apple issued a statement, which reads, “Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple. Each time, we have conducted rigorous internal investigations based on their inquiries and each time we have found absolutely no evidence to support any of them. We have repeatedly and consistently offered factual responses, on the record, refuting virtually every aspect of Bloomberg’s story relating to Apple. “On this we can be very clear: Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.” “We’ve re-reviewed our records relating to the Elemental acquisition for any issues related to SuperMicro, including re-examining a third-party security audit that we conducted in 2015 as part of our due diligence prior to the acquisition. We’ve found no evidence to support claims of malicious chips or hardware modifications.” Similarly, Supermicro also strongly denied Bloomberg’s findings and said in its statement, “While we would cooperate with any government investigation, we are not aware of any investigation regarding this topic nor have we been contacted by any government agency in this regard. We are not aware of any customer dropping Supermicro as a supplier for this type of issue. “Furthermore, Supermicro doesn’t design or manufacture networking chips or the associated firmware and we, as well as other leading server/storage companies, procure them from the same leading networking companies.”
