New Evidence of Hacked Supermicro Hardware Found in U.S. Telecom

vlemon (76)in #technology • 6 years ago

All three companies at the heart of last weeks Bloomberg Chinese hacking story (Apple, Amazon, Super Micro) have denied the claims strenuously, and the US’s Department of Homeland Security says it ‘has no reason to doubt’ the companies denials, throwing the focus back onto the Bloomberg report’s reliance on anonymous sources and unsubstantiated claims.
Bloomberg is unbowed, and yesterday produced a follow-on story that a ‘major US telecommunications company’ had discovered manipulated hardware from Super Micro Computer Inc, in its network, constituting fresh evidence of hardware tampering in China’s technology supply chain.
This latest instalment quotes a named security expert, Yossi Appleboum, who discovered an implant built in to a Supermicro server’s Ethernet connector, and quotes other sources verifying that Applebaum’s approach is credible.
It also goes on to quote the Norwegian National Security Agency saying they have been ‘aware of an issue’ connected to Supermicro hardware since June, and quotes security industry sources suggesting wider appreciation of the existence of hardware implants in devices coming out of China.

There’s nothing new in competing nation states spying on each other. Thus, it has always been, whether through ‘humint’, software or hardware.
The Bloomberg report may or may not be true. But as we noted yesterday, the key implication for investors is that organisations will increasingly have to assume they have been hacked – that the snooper is already inside the fortress, and that their data is already out there. That means valuable data needs to be encrypted, both at rest and in transit, and encryption keys will need to be closely guarded.