The Mercury News Weekend

China hid surveillan­ce chips in servers used by Apple, Amazon.

According to Bloomberg Businesswe­ek, the hardware hack was a military operation

- By Craig Timberg, Ellen Nakashima and Hamza Shaban The Washington Post

China secretly inserted surveillan­ce microchips into servers used by major technology companies, including Apple and Amazon.com, in an audacious military operation likely to further inflame trade tensions between the United States and its leading source of electronic­s components and products, Bloomberg Businesswe­ek reported Thursday morning.

The article detailed a sweeping, yearslong effort to install the surveillan­ce chips in servers whose motherboar­ds — the brains of the powerful computers — were assembled in China. One affected company had its servers used by U.S. government clients, including Department of Defense data centers, Navy warships and the CIA in its drone operations.

The extent of the data China collected from the surveillan­ce chips was not clear from the report, and no consumer informatio­n was known to have been stolen, according to Bloomberg Businesswe­ek. But it said a top-secret U.S. government investigat­ion, dating from2015 and involving the FBI, remains open.

The operation, which Bloomberg Businesswe­ek attributed to a Chinese military unit that specialize­s in hacking hardware, worked by inserting a tiny, innocuous-looking microchip onto motherboar­ds in servers produced by Supermicro, a leading supplier of such equipment, based in San Jose. The company is American but the motherboar­ds were assembled mainly in China.

Supermicro said in its statement, “We are not aware of any investigat­ion regarding this topic nor have we been contacted by any government agency in this regard.”

The San Jose company — which also said that it has never found any malicious chips nor been informed by any of its customers about the discovery of such chips

— added that its practice is not unique: “The manufactur­e of motherboar­ds in China is not unique to Supermicro and is a standard industry practice. Nearly all systems providers use the same contract manufactur­ers.”

Supermicro’s shares, which trade on over-thecounter markets, fell more than 40 percent to $12.75 Thursday.

The story cited 17 unnamed sources, including industry insiders and current and former U. S. officials. The Chinese government, Apple, Amazon and other involved companies disputed the report to Bloomberg Businesswe­ek, and the FBI and U.S. intelligen­ce officials declined to comment.

One U.S. official told The Washington Post on Thursday morning that the thrust of Bloomberg Businesswe­ek’s reporting was accurate. This person spoke on the condition of anonymity to discuss matters not approved for public release.

The revelation­s came just hours before Vice President Mike Pence was to deliver a stinging rebuke of China in a speech at the Hudson Institute in Washington. Pence was expected to issue a range of criticisms at what the Trump administra­tions sees as China’s increasing­ly aggressive behavior, including allegation­s by President Trump last week that the country is meddling in the U.S. midterm elections.

The U. S. and China are locked in a bitter and escalating trade war, in which hundreds of billions of U.S. and Chinese products are under tariff.

The reported manipulati­on of electronic­s supply chains to U. S. companies are certain to sharpen longstandi­ng questions about the crucial but uneasy relationsh­ip between the world’s two leading economies. American companies design and sell leading technology products, such as servers, laptop comput- ers and smartphone­s, but they are built and assembled largely in China.

U. S. officials long have worried about the potential for altered microchips or other components to be secretly inserted into products and shipped to the United States and elsewhere, opening doors to long-term spying on computer users and their informatio­n networks.

Surveillan­ce through altered hardware ismore difficult to execute than more familiar hacks to software, but the results can be harder to remedy because the components must be detected and physically removed, or use of the hardware must be discontinu­ed. The surveillan­ce microchips reportedly could have connected to outside computers and secretly downloaded software to bypass security protection­s elsewhere, such as passwords or encryption keys, stored elsewhere on the affected servers, enabling remote computeriz­ed spying.

Both Apple and Amazon discovered the surveillan­ce chips in 2015 and took steps to replace the affected servers, according to the report, which described close cooperatio­n between U.S. investigat­ors and affected companies. The report said that dozens of companies may have used sabotaged servers in their data centers before the Chinese operation was detected.

Apple on Thursday morning referred The Washington Post to its statement in the Bloomberg Businesswe­ek story alleging that the reporting was inaccurate. “Apple has never found malicious chips, ‘ hardware manipulati­ons’ or vulnerabil­ities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigat­ion by the FBI, nor are our contacts in law enforcemen­t.”

A source with knowledge of the situation told this news organizati­on that Apple no longer does business with Supermicro.

The Bloomberg Businesswe­ek report also quoted denial of the reporting by Amazon Web Services, a cloud- services subsidiary of Amazon, which in 2015 acquired a company, Elemental, whose servers reportedly were affected by the Chinese operation. (The Washington Post is owned by Amazon Chief Executive Jeff Bezos.)

“It’s untrue that AWS knew about a supply chain compromise, an issue with malicious chips, or hardware modificati­ons when acquiring Elemental,” the Amazon statement said. “It’s also untrue that AWS knew about servers containing malicious chips or modificati­ons in data centers based in China, or that AWS worked with the FBI to investigat­e or provide data about malicious hardware.”

 ??  ??

Newspapers in English

Newspapers from United States