Apple Cut Ties With Supplier Super Micro Computer Over Server Security Concerns

[MacRumors]

Apple cut ties with server supplier Super Micro Computer in 2016 after unearthing a potential security vulnerability in at least one of its data center servers, reports The Information.

The vulnerability in the server, which was part of Apple's technical infrastructure powering its web-based services, was discovered in the early months of 2016. According to Super Micro senior vice president of technology Tau Leng, Apple ended its business relationship with Super Micro Computer shortly after uncovering the security issue.

Leng's account of the incident makes it sound like Apple received bad firmware from an FTP site hosted by Super Micro that may have been infiltrated, which may have compromised the server.

According to Leng, when Apple was asked to provide the version number of the firmware it had downloaded after experiencing issues, Apple provided an invalid number. After that, Apple refused to provide more information to Super Micro.

Mr. Leng said Super Micro regularly provides firmware updates that data center customers like Apple can download from a private "FTP" site, hosted by Super Micro. He said the firmware updates come from outside chip manufacturers--in this case, a networking chip maker that he declined to name.

Sources who spoke to The Information said servers that handled Siri requests and App Store search functionality may have been compromised, but an Apple spokesperson said Apple did not receive bad firmware nor was any customer data stolen.

"Apple is deeply committed to protecting the privacy and security of our customers and the data we store," the spokesperson told The Information. "We are constantly monitoring for any attacks on our systems, working closely with vendors and regularly checking equipment for malware."

It's not quite clear what caused the vulnerability that led to the end of the agreement between Super Micro and Apple, but Apple has since moved on to other server suppliers, increasing orders from ZT and purchasing servers from Inspur.

Article Link: Apple Cut Ties With Supplier Super Micro Computer Over Server Security Concerns

 

[farewelwilliams]

problem was that they weren't using SFTP to start with.

 

[JoelTheSuperior]

Funny to think Apple once made their own servers.

 

[btrach144]

Always ensure the checksum matches! Apple shares part of the blame for not requesting SFTP and checksum checking abilities.

 

[now i see it]

So maybe your iPhone is encrypted & secure... but apple's server farms are made by third parties and that's where the vulnerability lies. Dont get to cozy with iCloud.

 

[PortableLover]

Well apple, its time to make your own servers again

 

[pat500000]

Terror of dependency. Good play, Apple.

 

[Bart Kela]

problem was that they weren't using SFTP to start with.

No, we don't know that. We are reading hearsay from the fired vendor and the word FTP is in quotation marks, so it possibly could have been SFTP.

SFTP doesn't guarantee that the downloads are clean or that the download server is safe, only that the download connection itself is secure.

Furthermore, both Supermicro and Apple contradict each other. Either someone is not telling the full truth or possibly both are not telling the complete truth. There's really no way to ascertain what happened from this article and we may never will.

The only real takeaway from this article is that Apple no longer sources server hardware from Supermicro. The rest of the words you can flush down the toilet.

My guess is that Mr. Leng is violating a confidentiality clause by discussing this with the media. If that is the case, it is likely that SuperMicro will never do business with Apple Inc. again as long as Tim Cook is in charge.

SuperMicro just burnt a bridge. Too bad for them.

 

[a.coward]

Leng's account of the incident makes it sound like Apple received bad firmware from an FTP site hosted by Super Micro that may have been infiltrated, which may have compromised the server.

Using FTP? Plain-text authentication? No encryption? There's your issue right there. Friends don't let friends run FTP (and Telnet).

 

[manhattanboy]

Using FTP? Plain-text authentication? No encryption? There's your issue right there. Friends don't let friends run FTP (and Telnet).

At a minimum I was wondering why there is no hash value to confirm the firmware updates. Super micro used to be great, but I guess cost cutting affects everybody these days.

 

[JosephAW]

Glad to hear someone in the bowels of Apple is still working for us little guys and watching over the security, although cutting the ties with them might be overkill unless we are not getting the whole story. I.E. Someone was passing this security flaw on to certain govmnts for cash.
Switching to another company may cause some outrage or data loss for the customers.

 

[Michaelgtrusa]

"Apple is deeply committed to protecting the privacy and security of our customers and the data we store,"

This is the tip of the iceberg.

Turns out to be a front company of china ties. https://en.wikipedia.org/wiki/Supermicro

This came up last year and our concerns wherev alid and came true without wishing.

 

[Bart Kela]

Looks like SuperMicro just screwed the pooch by coming out with their narrative. Their stock (NASDAQ:SMCI) closed down 8% in after-hours trading after the news broke.

They have probably lost Apple Inc. as a customer as long as Tim Cook is in charge. And by coming out with this information, they will probably lose some confidence by other customers further eroding their marketshare.

They warned in mid-2016 that they had lost two major data center customers, so Apple is not the only one, there is someone else out there who sacked SuperMicro.

The full story hasn't been told and it is unlikely that it will be. The main visibie thing will probably end up being lower revenue and earnings for SuperMicro for the next few years.

Today is a very bad day for SMCI shareholders and employees, all thanks to Mr. Leng who should have just kept his mouth shut like he had been doing for the past six months. Tomorrow may be worse.

Pity.

 

[Avieshek]

Will Apple spend it's billion dollars on marketing only?
Bulid your own damn servers Apple.

 

[konqerror]

Will Apple spend it's billion dollars on marketing only?
Bulid your own damn servers Apple.

You realize Apple doesn't build or fully design their own computers either. Things like circuit design have been done by an outside vendor forever: you remember that the first Powerbooks were with Sony. I've seen Compal and Quanta show up for Apple, no different from Dell and HP.

Always ensure the checksum matches! Apple shares part of the blame for not requesting SFTP and checksum checking abilities.

Yeah, Windows computers since Windows 8 have required signed firmware updates as part of Secure Boot. It was an optional Dell feature since before that. It protects against viruses adding themselves to firmware.

 

[M2M]

I don't think they used plaintext ftp but rather sftp (if Apple would even allow themselves to download plaintext ftp they are partly to blame as well). Anyway what may have happened is that a competitor of S-Micro broke into their sftp Server and changed the files. Now Apple moving to a competitor of s-micro (Chinese one) is interesting but also maybe not the best choice. Anyway also apples manufacturers (Foxconn) frequently leak information so they also may not be secure themselves.

 

[mw360]

Always ensure the checksum matches! Apple shares part of the blame for not requesting SFTP and checksum checking abilities.

You don't have enough information to start handing out blame. SFTP is often casually referred to as FTP, and its entirely possible the fake firmware (if it exists) came with a fake checksum.

 

[btrach144]

You don't have enough information to start handing out blame. SFTP is often casually referred to as FTP, and its entirely possible the fake firmware (if it exists) came with a fake checksum.

And you don't have enough information to defend Apple and Super Micro. This isn't a court. Its the public perception and you're guilty until proven innocent. I'm going to assume Apple and SM made extremely poor choices until they provide data that states otherwise.

Hope for the best, prepare for the worst.

 

[JoelTheSuperior]

And you don't have enough information to defend Apple and Super Micro. This isn't a court. Its the public perception and you're guilty until proven innocent. I'm going to assume Apple and SM made extremely poor choices until they provide data that states otherwise.

Hope for the best, prepare for the worst.

I must admit though that this is surprising - Supermicro have always been one of the better server / motherboard manufacturers and I've actually used their servers myself for commercial purposes. They've always been a brand that I would recommend assuming budgets allow (as they certainly aren't one of the cheapest providers).

 

[luis1966]

And you don't have enough information to defend Apple and Super Micro. This isn't a court. Its the public perception and you're guilty until proven innocent. I'm going to assume Apple and SM made extremely poor choices until they provide data that states otherwise.

Hope for the best, prepare for the worst.

No, he is simply telling that from the article you can not make the claims you did. He is right.

 

[PinkyMacGodess]

Well apple, its time to make your own servers again

Apple should have bought the hardware division of Sun Microsystems.
[doublepost=1487947500][/doublepost]

No, we don't know that. We are reading hearsay from the fired vendor and the word FTP is in quotation marks, so it possibly could have been SFTP.

SFTP doesn't guarantee that the downloads are clean or that the download server is safe, only that the download connection itself is secure.

Furthermore, both Supermicro and Apple contradict each other. Either someone is not telling the full truth or possibly both are not telling the complete truth. There's really no way to ascertain what happened from this article and we may never will.

The only real takeaway from this article is that Apple no longer sources server hardware from Supermicro. The rest of the words you can flush down the toilet.

My guess is that Mr. Leng is violating a confidentiality clause by discussing this with the media. If that is the case, it is likely that SuperMicro will never do business with Apple Inc. again as long as Tim Cook is in charge.

SuperMicro just burnt a bridge. Too bad for them.

Bolded section: Yes! You can use FedEx same day delivery, paying big bucks, but if the stuff in the envelope is crap, it's crap...

Super Micro started sliding years ago. They innovated on a lot of things, and lost their focus about the time I was closing my company down. We thought of partnering with them, but by that time there wasn't much profit in building servers around this market. But anyway...

 

[Michaelgtrusa]

Apple should have bought the hardware division of Sun Microsystems.
[doublepost=1487947500][/doublepost]

Bolded section: Yes! You can use FedEx same day delivery, paying big bucks, but if the stuff in the envelope is crap, it's crap...

Super Micro started sliding years ago. They innovated on a lot of things, and lost their focus about the time I was closing my company down. We thought of partnering with them, but by that time there wasn't much profit in building servers around this market. But anyway...

Agreed. Buy an American server. We invented the damn thing.

 

[nt5672]

What I don't understand is how any company can be sure that a box delivered complete from China is secure? Who knows what is lurking in the firmware? Of course these days, with the NSA, who can be sure that a box delivered complete from US is secure (if that is even possible these days)? Governments here and abroad have sure screwed the pooch! Not sure who to trust.

At least at one time, Apple was shipping known good chips to be installed in its own products in China. I wonder if they still are, or if they just rely on Chinese assurances that the firmware is what Apple expects?

 

[typonaut]

Funny to think Apple once made their own servers.

Better than that, Apple used to run at least some of its internet server services on Macs (long before MacOS X), and had its own search/indexer CGI.
[doublepost=1487955614][/doublepost]

I wonder if they still are, or if they just rely on Chinese assurances that the firmware is what Apple expects?

Perhaps the reasurance is that they receive the source code?
[doublepost=1487955899][/doublepost]

Apple should have bought the hardware division of Sun Microsystems.

Apple should build its own servers.

 

[btrach144]

No, he is simply telling that from the article you can not make the claims you did. He is right.

Its the internet, not the court of law. We can assume whatever we want. Sorry that hurts your feelings but I'm not really sorry.

Everything I said is plausible and until Apple or SM prove otherwise, I can make such claims.