Apple CEO Tim Cook Calls on Bloomberg to Retract Supply Chain Hack Story: 'There's No Truth to This'

[truthertech]

While what you say is true, no-one can argue with it, if you are suggesting we live in a World where the free-press has to provide sources that can be fact checked then all off a sudden we live in a a world without anonymous whistle blowers, is that what you want?

This has nothing to do with whistle blowers. It is a for profit journal trying to make a buck by publishing a sexy story. Yes, we want them to do that, but we want them to adhere to high journalistic standards, which are sadly in great decline nowadays and which is it increasingly obvious they didn't adhere to in this article. The Press has an obligation to do their own fact checking of anonymous sources, and it is an even greater obligation than with on the record sources for obvious reasons. That is highly probable that this story is completely false, shows how significantly the reporters and editors failed. The editors are especially at fault as they knew that the reporters, having spent three years chasing this enticing story, would likely not be objective in assessing whether and how to publish it.
[doublepost=1540054746][/doublepost]

But Bloomberg does not need to go about "producing evidence and witnesses to back up their assertions". They researched a story (we can go back and forth all day about whether you believe it or not) and presented their findings to the public. Bloomberg isn't going after Apple for a crime. They published a story and left it up to the public to draw their own conclusions.

No, that's not what happened. They published a story and then were presented with an astonishing amount of consistent denunciations and evidence, circumstantial and testimonial, that the story was false. With the credibility of both their organization and their investigation on the line, the ball is clearly in their court to go beyond "we stand by our story."

 

[WatchFromAfar]

This has nothing to do with whistle blowers. It is a for profit journal trying to make a buck by publishing a sexy story. Yes, we want them to do that, but we want them to adhere to high journalistic standards, which are sadly in great decline nowadays and which is it increasingly obvious they didn't adhere to in this article. The Press has an obligation to do their own fact checking of anonymous sources, and it is an even greater obligation than with on the record sources for obvious reasons. That is highly probable that this story is completely false, shows how significantly the reporters and editors failed. The editors are especially at fault as they knew that the reporters, having spent three years chasing this enticing story, would likely not be objective in assessing whether and how to publish it.
[doublepost=1540054746][/doublepost]


No, that's not what happened. They published a story and then were presented with an astonishing amount of consistent denunciations and evidence, circumstantial and testimonial, that the story was false. With the credibility of both their organization and their investigation on the line, the ball is clearly in their court to go beyond "we stand by our story."

Let's cut to the chase here. Do you think a 37-year old news organisation ( founded by Michael Bloomberg in 1981) just on a whim decided to make up a story?

 

[truthertech]

Let's cut to the chase here. Do you think a 37-year old news organisation ( founded by Michael Bloomberg in 1981) just on a whim decided to make up a story?

Please don't reduce it to such simplistic terms. No one suggested that. Quite the contrary, they undoubtedly began their investigation in good faith based on something a source passed on to them. Far from a whim, they spent three years working on the story, and it is likely that their investment in so much of their career into a single story, and the appeal of the story, blinded their objectivity. Even if all of their sources are repeating the same thing they heard second, third or fourth hand, the reporters can't bring themselves to admit that they still ended up with something that couldn't corroborate sufficiently to run as a major, breaking story. That's infinitely more believable than Tim Cook is risking his personal and Apple's entire corporate reputation, not to mention enormous civil liability, by lying.

 

[WatchFromAfar]

Please don't reduce it to such simplistic terms. No one suggested that. Quite the contrary, they undoubtedly began their investigation in good faith based on something a source passed on to them. Far from a whim, they spent three years working on the story, and it is likely that their investment in so much of their career into a single story, and the appeal of the story, blinded their objectivity. Even if all of their sources are repeating the same thing they heard second, third or fourth hand, the reporters can't bring themselves to admit that they still ended up with something that couldn't corroborate sufficiently to run as a major, breaking story. That's infinitely more believable than Tim Cook is risking his personal and Apple's entire corporate reputation, not to mention enormous civil liability, by lying.

I liked your post because obliviously you're a passionate person. But the stakes are very different. you've a journalist and no-body buys the story; in the grand scheme of things big deal, no-one cares. However if you are are in charge of the most profitable company known to man then you have appearances to keep up. Issue as many statements as you want saying "we don't think it's happening", doesn't mean it's not happening.

 

[macfacts]

No. Bloomberg made extraordinarily serious allegations against Apple.

It is up Bloomberg to put forward proof in the form of evidence and witnesses to back up their extraordinary claims.

In the United States, if you are arrested and charged with a crime, the government has the burden of producing proof, revealing evidence and witnesses, that can be examined and questioned by you or your attorney, to back up their allegations.

While this is not (on the surface) a criminal prosecution, Bloomberg should nevertheless still have that same burden producing evidence and witnesses to back up their assertions.

Until that happens, I'm presuming the allegations against Apple are false.

Watergate was fake news too, no anonymous sources were named

 

[[AUT] Thomas]

otoh, i‘ve heard from sources in the cybersecurity-scene that, while those things definitely happen, in this particular case it seems rather unlikely.

Exactly that.

BB fails to provide clear information. If they have so good sources, can we please have the modell and/or P/N of the MB that had the chip on it. Can we have one of their sources provide a picture (preferably digitally signed RAW out of cam please, e.g. a Nikon NEF file -for exactly that kind of situation NEFs are signed) of a MB WITH the chip on it? THAT would be first thing everyone would do if they found such a chip on the MB. Make a f****ing picture.
Unless this is some kind of specially crafted mainboard just for Apple (doubt that) everyone here would be able to compare it to other MB of the same model and PCB Rev.

Fact: Above info was NOT provided. All BB has is a claiming someone found something on some mainboard.

EDIT: I suppose for BB it's now all-in. If they retract the story SM and every SM shareholder will sue them into bankruptcy. Following that, BB shareholders will do the same with the people responsible for the story...

 

[truthertech]

Watergate was fake news too, no anonymous sources were named

You must not have read anything about Watergate and the Washington Post reporting. It was backed up by public records of initial arrests, identified suspects with demonstrated relationships, a law enforcement investigation, money trails, extraordinary detail and live witnesses, recordings, etc.

It's interesting, though, to use your analogy and follow it through if it were analogous to "Supermicrogate." To use it as you suggest, it would be as though the Washington Post reported that a bunch of anonymous sources from law enforcement and the hotel and office industry reported that the Republican party was breaking into offices at such places at the Watergate Hotel and Trump Tower, but every source remained anonymous, and every single place denied that a burglary had taken place and law enforcement in DC, at the local, state and national level all denied that they had any record of burglaries, and finally, the Post couldn't produce a single bit of physical evidence, including any records that were missing or taken, but the Post still ran a front page story accusing them of it.
[doublepost=1540063588][/doublepost]

I liked your post because obliviously you're a passionate person. But the stakes are very different. you've a journalist and no-body buys the story; in the grand scheme of things big deal, no-one cares. However if you are are in charge of the most profitable company known to man then you have appearances to keep up. Issue as many statements as you want saying "we don't think it's happening", doesn't mean it's not happening.

Again, please be accurate. Apple, and Tim Cook, have not issued any such vague denials/non denials. Indeed, the remarkably detailed absolute denials, are so very far from your suggested "we don't think it's happening," as to make me wonder if you have read any of them. Moreover, it would have been so simple for Apple PR to simply put out a release that read "we are unaware of any intrusion, and believe the reporters' sources are referring a several year old single incident involving SuperMicro that was previously reported by us and resulted in no data loss, etc." and that would have been the end of it instead of lying and risking all.

 

[citysnaps]

Watergate was fake news too, no anonymous sources were named

Really. No anonymous sources were needed. Five burglars were caught in the act at the DNC headquarters (located within Wash DC's Watergate office complex), arrested, and charged with multiple crimes, based on loads of collected evidence. Later, a grand jury indicted them along with Howard Hunt and Gordon Liddy and sent to prison. Based on...evidence. No anonymous sources involved.

The same thing is true with respect to the resulting cover-up by the White House, with many charged with crimes and convicted. Based on...evidence and testimony from named witnesses.

 

[nsayer]

Watergate was fake news too, no anonymous sources were named

Deep Throat worked for the FBI.

Just sayin'.

 

[omihek]

What would happen if it wasn't? Not saying its real but saying WHAT IF...? Something is definitely fishy here but which side it is will only be known in about 10-20 years

I'll stick with the American view, innocent until proven guilty. Just because someone packages their accusations in a professional way doesn't make them any more valid. It's on Bloomberg to prove what they said, but so far they haven't been very convincing. Apple on the other hand have been very open and very willing to share exactly what they've done to investigate these claims. They have found absolutely nothing to suggest Bloomberg's story is even remotely true. I'm with Apple all the way on this one.

 

[citysnaps]

But Bloomberg does not need to go about "producing evidence and witnesses to back up their assertions". They researched a story (we can go back and forth all day about whether you believe it or not) and presented their findings to the public. Bloomberg isn't going after Apple for a crime. They published a story and left it up to the public to draw their own conclusions.

That might be perfectly OK for you and others who aren't too fussy, not needing evidence and named sources to back up Bloomberg's allegations. And I'm OK with that, knowing the bar for assessing the truth is not very high for many.

For me though, as I stated earlier, I'll continue to believe the allegations against Apple are false, until evidence and witnesses are produced that support the allegations.

You are certainly free to continue believing that whatever is published and not substantiated is indeed fact.

 

[Juan007]

Apple should sue Bloomberg out of existence if they refuse to retract. There's no excuse for this, it's terrible journalism and even worse management. Admit you're wrong when you're wrong.

 

[cwt2nospam]

Bloomberg doesn't make computers nor smartphones. Why would Apple care if Bloomberg gets to see some internal documents.

Wow. Are you really that dumb, or are you trolling?

 

[RogerWilco]

Take a look at your MacBook’s motherboard. Now try to add a working uC with minimum core functionality, sufficient amount of on chip memory and network access with only 6 Pins without altering the motherboard so it could stay undiscovered. This is simply not possible today and surely wasn’t 4 to 6 years ago.
This hack doesn’t work without Supermicro being involved and knowing about it beforehand. And there are lots of People to be silenced afterwards that it would again be hard to keep it secret.
This is a dumb story to disparage the Chinese for some (political?) reason.

If it would be possible why stop with Supermicro? And while we are at that, Mobilephones would make a way better target.

The fake components were found on SuperMicro motherboards by security consultant Yossi Appleboum. One was disguised as an Ethernet socket, apparently a ploy used at various times by many intelligence services. Tim Cook's blanket denial that Apple was involved may be true, but that still does not preclude Bloomberg's allegations of hardware hacked by Chinese operatives -- likely after it left the control of Apple and is subcontractors.

 

[MacBram]

strange indeed. i‘ve heard that the denial-statements from the tech companies sounded strangely similar... could be that they are under pressure from their manufacturers (or from chinese governement or hackers - maybe there’s some ceo-blackmailing going on). or there’s some behind the scenes intelligence-investigation going on.

otoh, i‘ve heard from sources in the cybersecurity-scene that, while those things definitely happen, in this particular case it seems rather unlikely.

No, what's strangely similar, is the story being similar to what the reporters got a year ago from one of the named sources, a hardware security consultant. He only gets one quote in the article, but he has done some interviews since about how he's uncomfortable with the whole story -- they went back and forth with him for a number of months about his personal takes on hypotheticals, and what "he would do" if he was to hack something, and "what could it look like", and asked for a photo of a chip such as the type he mentioned (one type of chip among numerous candidates)...

And now he is amazed at his own "foresight", because, lo and behold, everything he said appears in the article as exactly what was confirmed by the unnamed sources, down to the sample photo. Despite his saying that there were other, simpler, better ways to achieve the same results.

 

[cwt2nospam]

The fake components were found on SuperMicro motherboards by security consultant Yossi Appleboum. One was disguised as an Ethernet socket, apparently a ploy used at various times by many intelligence services. Tim Cook's blanket denial that Apple was involved may be true, but that still does not preclude Bloomberg's allegations of hardware hacked by Chinese operatives -- likely after it left the control of Apple and is subcontractors.

Were they found in products delivered to customers? No. So somebody stuck a part on, knowing that it would be found by QA people. Why? So that a story like this would have the tiniest shred of credibility so that some people could use it to claim it was "possible". Meanwhile, there is NO evidence that anything has made it out of a factory. This despite the fact that there would be potentially millions of motherboards available for close examination by thousands of experts. Hundreds of thousands if you include the hacker community!

 

[Williesleg]

Hey Timmy Cook,
There's one way out of this - in the article, Bloomberg says you used to have a ton of Supermicro servers. Now you don't.

Show us a recent picture of your datacenter, you know, the one that should still have Supermicro servers in it.

Or are you lying?

 

[Tigger11]

Let's cut to the chase here. Do you think a 37-year old news organisation ( founded by Michael Bloomberg in 1981) just on a whim decided to make up a story?

There are 3 big issues
1) Technically the chip can't do what Bloomberg said, that is the opinion of me and 49 other engineers at work, we all had to read the article completely and prepare a document about the feasibility of it occurring for our New VP, who called an emergency meeting Monday morning after reading the Bloomberg article to be sure we didn't have one of those Supermicro servers. I have refrained from calculating how much that effort cost us financially, and I know its happened at alot of other companies even just in town here.

2) Given the story as Bloomberg has posted it, Tim Cook and Jeff Bezos has to know about it. Given their strong denials, which are HUGE SEC violations, we have to assume that either they are both tired of their jobs and want to be removed from the Board of Directors of the companies and fined 10s of millions of dollars each, or the story is not true. I don't believe Jeff or Tim want to lose their jobs or pay big fines, so the story isn't true.

3) The trail of Apple replacing 7000 servers in a few weeks per the story would be so easy to find, and there is nothing about it, in any trade, annual report, etc, I've dug through them since the article. That is alot of money spent by Apple and alot of money received by some vendor and there is nothing out there. If there was it would be trivial for Bloomberg to show it. As you can you see from Apple's annual report 2017 page 32, Apple had to buy 7000 servers, replace 7000 servers etc then Apple would be trying to explain that, or they could point to IBM, HP, Dell delivering 7000 servers to Apple, but there is no such support and so Bloomberg either wants us to believe that two or more companies are lying in their annual reports, or that 7000 servers are so cheap its in the noise region. Also we get leaks on all kinds of things at Apple, how does the effort to replace 7000 servers scattered all across the world, not get us one rumor.


What do I think happened? A couple of years ago Supermicro shipped a board to Apple with an infected driver, we know that happened, Apple told us about it when it happened they found it in their lab before the computer was put to actual use. The response to that (which Apple wasn't happy with) and a better price from another company is what led to Apple to cancel any further purchases from Supermicro. Someone thought the infected driver was a chip (as in a USB driver chip) instead of firmware which it really was and the theory was born. Supermicro lost an order of 1000s of servers from Apple, and suddenly Apple has removed 7000 Supermicro servers for the problem according to Bloomberg. If any of the stories on counterfeit parts served are part on this story, I might be one of the 17 sources, since I am definitely not shy about counterfeit parts likely coming from China, but counterfeit parts are a totally different thing. But the whole article is technically inaccurate, so why would you would be surprised that the sources are quoted inaccurately. Bloomberg says that x-rays of the boards and the parts exist, but yet have yet to show them to us. We literally get pictures of the inside of the new iPhone and its new processor within days of it shipping, yet Bloomberg works on an article for 18 months according to them, and yet can't put a picture of the chip or the board in question into the article. Also its very interesting that Bloomberg is blaming none of the Big Three for making these boards, but instead blaming 4 factories which I and others are pretty sure can be tracked to one now nonexistent company. So its kinda like saying Toys-R-Us made the boards in question, aren't going to get sued by a company that doesn't exist anymore especially if you don't specifically mention them by name.
-Tig

 

[WatchFromAfar]

There are 3 big issues
1) Technically the chip can't do what Bloomberg said, that is the opinion of me and 49 other engineers at work, we all had to read the article completely and prepare a document about the feasibility of it occurring for our New VP, who called an emergency meeting Monday morning after reading the Bloomberg article to be sure we didn't have one of those Supermicro servers. I have refrained from calculating how much that effort cost us financially, and I know its happened at alot of other companies even just in town here.

2) Given the story as Bloomberg has posted it, Tim Cook and Jeff Bezos has to know about it. Given their strong denials, which are HUGE SEC violations, we have to assume that either they are both tired of their jobs and want to be removed from the Board of Directors of the companies and fined 10s of millions of dollars each, or the story is not true. I don't believe Jeff or Tim want to lose their jobs or pay big fines, so the story isn't true.

3) The trail of Apple replacing 7000 servers in a few weeks per the story would be so easy to find, and there is nothing about it, in any trade, annual report, etc, I've dug through them since the article. That is alot of money spent by Apple and alot of money received by some vendor and there is nothing out there. If there was it would be trivial for Bloomberg to show it. As you can you see from Apple's annual report 2017 page 32, Apple had to buy 7000 servers, replace 7000 servers etc then Apple would be trying to explain that, or they could point to IBM, HP, Dell delivering 7000 servers to Apple, but there is no such support and so Bloomberg either wants us to believe that two or more companies are lying in their annual reports, or that 7000 servers are so cheap its in the noise region. Also we get leaks on all kinds of things at Apple, how does the effort to replace 7000 servers scattered all across the world, not get us one rumor.


What do I think happened? A couple of years ago Supermicro shipped a board to Apple with an infected driver, we know that happened, Apple told us about it when it happened they found it in their lab before the computer was put to actual use. The response to that (which Apple wasn't happy with) and a better price from another company is what led to Apple to cancel any further purchases from Supermicro. Someone thought the infected driver was a chip (as in a USB driver chip) instead of firmware which it really was and the theory was born. Supermicro lost an order of 1000s of servers from Apple, and suddenly Apple has removed 7000 Supermicro servers for the problem according to Bloomberg. If any of the stories on counterfeit parts served are part on this story, I might be one of the 17 sources, since I am definitely not shy about counterfeit parts likely coming from China, but counterfeit parts are a totally different thing. But the whole article is technically inaccurate, so why would you would be surprised that the sources are quoted inaccurately. Bloomberg says that x-rays of the boards and the parts exist, but yet have yet to show them to us. We literally get pictures of the inside of the new iPhone and its new processor within days of it shipping, yet Bloomberg works on an article for 18 months according to them, and yet can't put a picture of the chip or the board in question into the article. Also its very interesting that Bloomberg is blaming none of the Big Three for making these boards, but instead blaming 4 factories which I and others are pretty sure can be tracked to one now nonexistent company. So its kinda like saying Toys-R-Us made the boards in question, aren't going to get sued by a company that doesn't exist anymore especially if you don't specifically mention them by name.
-Tig

Jesus that's a damn fine response, with more technical detail than the Bloomberg piece!

 

[DVD9]

Bloomberg has continued to stand by its original report, which, based on info obtained from 17 unnamed sources

A congressional investigation would be welcome and should be a given, but all the investigations are focused on blaming Putin for the hurricanes.

 

[[AUT] Thomas]

That might be perfectly OK for you and others who aren't too fussy, not needing evidence and named sources to back up Bloomberg's allegations. And I'm OK with that, knowing the bar for assessing the truth is not very high for many.

I don't know how that's handled in the US, but (at least here) media has certain responsibilities.
The first problem we have here is that they present their story as fact -repeatedly.
The second problem is they don't seem to have any accurate information on what they claim.
(The 2.5th problem is that they claim to have it, but don't release it.)
The third problem is that their article IMHO is defamation (Supermicro, Apple) if not true.
The forth problem is that defamation usually shifts the burden of proof -if the aggrieved party(ies) takes the issue to court.
In case of the latter, BB will have to present some kind of evidence. Publishing something like that, without having anything (beyond 3rd party statements) that makes this believable, isn't proper journalism, meaning BB has to take full responsibility for the content they published and can't hide behind some media/press laws.

However, this is where things get interesting.
If BB retracts the article, they'll get sued for sure by SM and their shareholders.
If BB doesn't retract the article AND the story is indeed wrong, Apple & SM should still sue them.
Although, if there's some (little) truth to this (with the article still being inaccurate) Apple & SM would probably not take this to court.

So, basically I'm waiting for legal action to happen -or not. If there's a US lawyer among us here I'd be interested in his point of view regarding the above... [IANAL]

 

[WatchFromAfar]

A couple of years ago Supermicro shipped a board to Apple with an infected driver, we know that happened

I just got to say, then there is truth to the story that Apple bought a server that was infected. It makes no difference if it went out into the wild or not these things exist. Yes Apple caught that one, who knows what they didn't catch...

 

[jona2125]

I just got to say, then there is truth to the story that Apple bought a server that was infected. It makes no difference if it went out into the wild or not these things exist. Yes Apple caught that one, who knows what they didn't catch...

The server was not delivered infected it was a firmware that was installed upon delivery to Apple. Apple had claimed that the server firmware was downloaded from SuperMicro servers. The problematic issue happened at building MR09

 

[WatchFromAfar]

The server was not delivered infected it was a firmware that was installed upon delivery to Apple. Apple had claimed that the server firmware was downloaded from SuperMicro servers. The problematic issue happened at building MR09

OK, my point is this is happening, regardless of where in the supply chain, regardless if Apple or another company notices it. You can be pedantic about the day to day issues but Bloomberg, in the general sense, are right. For Tim Cook to come out and say it's not happening is therefore an out and out lie.

 

[jona2125]

OK, my point is this is happening, regardless of where in the supply chain, regardless if Apple or another company notices it. You can be pedantic about the day to day issues but Bloomberg, in the general sense, are right. For Tim Cook to come out and say it's not happening is therefore an out and out lie.

Oh no worries I'm not on Apple's side on this. They don't "lie" they navigate specific truth with extreme precision. I personally am hoping for something to break on this.