Thursday, October 4th 2018
Supermicro Refutes Claims in Bloomberg Article
Super Micro Computer, Inc. (SMCI), a global leader in enterprise computing, storage, networking solutions and green computing technology, strongly refutes reports that servers it sold to customers contained malicious microchips in the motherboards of those systems. In an article today, it is alleged that Supermicro motherboards sold to certain customers contained malicious chips on its motherboards in 2015. Supermicro has never found any malicious chips, nor been informed by any customer that such chips have been found.
Each company mentioned in the article (Supermicro, Apple, Amazon and Elemental) has issued strong statements denying the claims:
Apple stated on CNBC, "We are deeply disappointed that in their dealings with us, Bloomberg's reporters have not been open to the possibility that they or their sources might be wrong or misinformed. Our best guess is that they are confusing their story with a previously reported 2016 incident in which we discovered an infected driver on a single Supermicro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple."
Steve Schmidt, Chief Information Security Officer at Amazon Web Services stated, "As we shared with Bloomberg BusinessWeek multiple times over the last couple months, at no time, past or present, have we ever found any issues relating to modified hardware or malicious chips in Supermicro motherboards in any Elemental or Amazon systems."
Supermicro has never been contacted by any government agencies either domestic or foreign regarding the alleged claims.
Supermicro takes all security claims very seriously and makes continuous investments in the security capabilities of their products. The manufacture of motherboards in China is not unique to Supermicro and is a standard industry practice. Nearly all systems providers use the same contract manufacturers. Supermicro qualifies and certifies every contract manufacturer and routinely inspects their facilities and processes closely.
Each company mentioned in the article (Supermicro, Apple, Amazon and Elemental) has issued strong statements denying the claims:
Apple stated on CNBC, "We are deeply disappointed that in their dealings with us, Bloomberg's reporters have not been open to the possibility that they or their sources might be wrong or misinformed. Our best guess is that they are confusing their story with a previously reported 2016 incident in which we discovered an infected driver on a single Supermicro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple."
Steve Schmidt, Chief Information Security Officer at Amazon Web Services stated, "As we shared with Bloomberg BusinessWeek multiple times over the last couple months, at no time, past or present, have we ever found any issues relating to modified hardware or malicious chips in Supermicro motherboards in any Elemental or Amazon systems."
Supermicro has never been contacted by any government agencies either domestic or foreign regarding the alleged claims.
Supermicro takes all security claims very seriously and makes continuous investments in the security capabilities of their products. The manufacture of motherboards in China is not unique to Supermicro and is a standard industry practice. Nearly all systems providers use the same contract manufacturers. Supermicro qualifies and certifies every contract manufacturer and routinely inspects their facilities and processes closely.
24 Comments on Supermicro Refutes Claims in Bloomberg Article
ED: "IME subsystem primarily consists of proprietary firmware running on a separate microprocessor that performs tasks during boot-up, while the computer is running, and while it is asleep. As long as the chipset or SoC is connected to current (via battery or power supply), it continues to run even when the system is turned off."
edit: Crap, even QAnon has something to say. I won't direct you to it.. I'm not in the mood for ridicule. Q has been a curious figure to me for a year now though.. and I still don't know what to think. Disinfo everywhere. Not just SM or China.. it's everywhere.
b.) At least the Intel Management Engine does what it says on the tin, for better or for worse. There literally ISN'T a tin in this case. So yeah, it's worse.
AWS can claim they never found anything because they didn't conduct the audit themselves. As for during the purchasing of Elementals it happened prior so they can say they never found anything there as well during their review.
The Indian government already stated for the past 20 years it doesn't need aid from the UK, but if the UK government insists on absolving its colonial guilt by handing us 100s of millions of your tax monies each year (which is chump-change for a $3.2 trillion/$7.8 trillion PPP economy that's overtaking Britain's as we speak), then we'll use it for whatever we want.
Space exploration is never an unproductive use of money, and the UK is better off bankrolling the Indian space program. NASA and ESA hate our space program because we get things done at 1/10th their budgets, and have a very nice success rate. Just this month we launched three British satellites for a fraction of the cost the French were asking, saving "£illions."
You're welcome. Back to topic.
edit: Ahem! That wasn't meant to be racist either! Besides, I'm Asian myself. :p
Supermicro would obviously deny this, especially as their stock price has dropped 41% since this story broke.
- Two Amazon employees
- Three Apple employees
- Six intelligence agencies officials
- Six other people that Bloomberg says confirmed various different aspects of the story
WT?