Chinese spies have reportedly infiltrated the server infrastructure of major tech companies including Amazon and Apple. According to Bloomberg Businessweek, the supply chain for servers used by nearly 30 US companies and major government organizations including Department of Homeland Security, was compromised by cyber security arm affiliated with the government.
The operation, detailed in a new article, shows one of the most expansive hardware hacking ever carried out by a company or a nation state. While software-based hacking is a known phenomenon in the tech industry, hardware hacking is deemed as difficult to execute in real life. However, this new explosive report claims that China forced local manufacturers to insert microchips into servers designed by an US-based firm. The chip planted were “not much bigger than a grain of rice,” reports Businessweek.
The attack was reportedly carried out by planting separate chip inside motherboards manufactured by US-based server company Super Micro Computer Inc, also called as Supermicro. Supermicro is one of the world’s biggest supplier of server motherboards, and it contracts manufacturing of these motherboards to factories in China and Southeast Asia. Bloomberg reports that motherboards designed by Supermicro are used in specialty products like MRI machines and data centers controlling drone and other weapon systems.
Amazon, the world’s biggest provider of public cloud service and Apple, the world’s first trillion dollar company, are two of the biggest customers of Supermicro. The company supplies serves to hundreds of customers, including Elemental Technologies, which was acquired by Amazon in 2015, to improve video compression technique powering its Prime Video Service.
The report claims that Elemental was the prime target of Chinese spies, who used Supermicro’s servers as a path to get into the company. Elemental’s servers are deployed in the “Department of Defense data centers, the CIA’s drone operations, and the onboard networks of Navy warships,” says Bloomberg and adds that an attack on Elemental could affect 30 US companies including government contractors and leading bank.
The report notes Amazon and Apple discovered this additional chip inside the motherboard designed by Supermicro and decided to cut ties with the company. It says Apple severed its relationship with Supermicro in 2016 while Amazon distanced itself from Supermicro by selling its Chinese infrastructure to a local cloud partner. Amazon and Facebook are believed to have found vulnerabilities in the servers using Supermicro’s products and have said that they were software-based but both the companies decided to get rid of such servers from their data centers immediately.
Apple, which also discovered additional chip planted in Supermicro-designed servers, decided not to report to US government and immediately started taking them off its data centers, reports Bloomberg. However, Apple has strongly refuted those claims and said, “Each time, we have conducted rigorous internal investigations based on their inquiries and each time we have found absolutely no evidence to support any of them.” “Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement,” the company said in a statement posted on its website.
Watch: How Realme phones are made
While software-based intrusions could help an attacker get into one system or systems connected to a host, a hardware attack could compromise an entire array of devices and has the potential to disrupt the entire ecosystem of devices. Bloomberg says the US intelligence community is still investigating the impact of microchip planted in Supermicro’s servers but neither of the agencies have confirmed the findings. The risks associated with a tampered motherboard or a server are endless, but there are no visible signs of any attack being carried out in public. The Chinese government has denied the claims published by Bloomberg.