Security researcher questions espionage against Apple; new evidence appears

And here we are again to talk about the developments caused by the affirmation of Bloomberg Businessweek that Apple, Amazon and others have been spied on by the Chinese government. You have no idea what I’m talking about? Then check out the articles below (in chronological order):

Assuming that you are already fully aware of the subject, let’s move on to the new chapters.

Security researcher questions history

The security researcher Joe Fitzpatrick, one of the few sources cited (nominally) in the investigation of Bloomberg, said this week on the podcast Risky Business, who felt uncomfortable after reading the magazine article. And he explained the reason.

Fitzpatrick spoke with Jordan Robertson (one of the journalists responsible for the Bloomberg) last year, just before giving a presentation on hardware implants at the DEF CON hacker convention. The reasons behind the conversation were not clear to Fitzpatrick until the magazine’s publication last month.

That’s because, in conversations with Robertson, the expert detailed how hardware implants work – specifically highlighting proof-of-concept devices that he demonstrated at Black Hat (another hacker convention) in 2016. And that’s when he found everything strange . According to a conversation with podcast host Patrick Gray, Fitzpatrick said that what basically happened was: everything he described to Robertson was 100% confirmed by the magazine’s sources. Not to mention that, for him, the story told “does not make sense”, since, in his words, there are easier and more economical methods of installing a backdoor on a computer network.

Spreading the fear of hardware, uncertainty and doubt is directly related to my financial gain, but that doesn’t make sense because there are many easier ways to do this. There are so many easier hardware ways, there are software, there are firmware approaches. The approach you are describing is not scalable. It is not logical. It’s not how I would do that. Or how someone I know would do that.

In an email response, the journalist confirmed that the idea “seemed crazy”, but said that “many sources” corroborated this information. Fitzpatrick was not convinced but, despite being skeptical, replied that “if they wanted to [criar uma] backdoor on each motherboard [dos servidores] from Super Micro, I think this is the approach that makes sense ”. Deep down, however, Fitzpatrick still felt that the approach chosen did not make much sense.

Alleged microchip used to spy on AppleAlleged microchip used to spy on Apple

Calm down that the story gets more interesting. Robertson, until then, had not shown any physical proof that the microchip in question existed, saying that everything had been described to him by protected sources. And indeed, Robertson in September asked Fitzpatrick what a “signal amplifier or coupler” looks like, suggesting that this would be the Chinese government’s approach to spying on servers. Fitzpatrick then sent Robertson a link to a very small signal coupler sold by Mouser Electronics. And that was the component shown by Bloomberg in the images that illustrate the magazine.

It turns out, for Fitzpatrick, that kind of component would be an unlikely choice for espionage. He suggested, for example, the use of chips that mimic the SOIC-8 package. In addition, signal couplers of this size are not standard on server motherboards that do not include Wi-Fi or LTE (it is not known whether Apple servers have such capability or not).

THE Bloomberg, of course, maintained its position, and gave the following statement:

As a typical journalistic practice, we look for many people who are experts on the subject to help us understand and describe the technical aspects of the attack. The specific ways in which the implant worked were described, confirmed and developed by our primary sources who have direct knowledge of Super Micro’s compromised hardware. Joe Fitzpatrick was not one of those 17 individual primary sources that included company employees and government officials, and his direct quote from the story describes a hypothetical example of how a hardware attack could play out, as the story makes clear. Our reporters and editors carefully examined each story before publication, and this was no exception.

Fitzpatrick, for his part, claimed to have the experience and knowledge to analyze the technical details of the matter and see that everything is quite confusing. “They are not entirely wrong, but they are theorists. I am not aware of the other conversations – the other 17 sources and what they said – but I can infer, based on the technical side of things, that the non-technical side of things can be confused in the same way. ”

New evidence

THE Bloomberg said yesterday that a major American telecommunications company discovered hardware handled by the same Super Micro on its network. Everything, however, was removed last August. And for the vehicle, we are faced with new evidence of tampering done on critical technology components destined for the United States, according to a security expert.

Yossi Appleboum, the expert in question, provided documents, analysis and other evidence of the discovery after the original story was published. Bloomberg Businessweek.

Yossi Appleboum

Appleboum is executive co-director of Sepio Systems (based in Gaithersburg, Maryland), specializing in hardware security and contracted to verify large telecom data centers cited by Bloomberg. After identifying unusual communications from a Super Micro server, a physical inspection revealed an implant embedded in the server’s Ethernet connector.

The executive said, however, he had seen similar manipulations of computer hardware from different vendors and not just Super Micro products. “Super Micro is a victim – just like everyone else,” he said. Appleboum said his concern is that there are countless points in the supply chain in China where this kind of manipulation can happen – and that deducing where exactly that happens is practically impossible. “That is the problem with the Chinese supply chain.”

Super Micro gave the following statement to the vehicle:

The safety of our customers and the integrity of our products are fundamental to our business and the values ​​of our company. We take care to ensure the integrity of our products throughout the manufacturing process and the security of the supply chain is an important topic of discussion for our industry. We are not yet aware of any unauthorized components and we have not been informed by any customer that such components have been found. We were sad to receive limited information from Bloomberg, no documentation and [apenas] noon to respond to these new claims.

THE Bloomberghowever, he said he contacted Super Micro at 9:23 am on Monday and gave the company 24 hours to respond. Super Micro’s shares plunged 41% last week (the biggest drop since it went public in 2007); after the note Bloomberg, shares fell another 27%.

Although different, the vehicle reported that the espionage methods share the same characteristics (giving invisible access to data on a computer network on which the server is installed).

Appleboum said that one of the main signs of the implant is that the manipulated Ethernet connector has sides made of metal instead of the usual plastic ones. The metal is needed to diffuse the heat from the chip hidden inside, which works like a mini-computer. “The module looks really innocent, high quality and ‘original’, but it was added as part of an attack on the supply chain.”

It is unclear whether the telecommunications company contacted the FBI about the discovery – an agency spokesman declined to comment. An AT&T spokesman said that “these devices are not part of our network and we were not affected”; one from Verizon boiled down to saying that “we were not affected”; Sprint stated “we do not have Super Micro equipment deployed in our network”; T-Mobile did not respond to a request for comment.

There are many more details on server manipulation found at this telecommunications company, in the Bloomberg. If you are interested in the subject, be sure to read it.

Tim Cook in China

With all this going on, Tim Cook this week decided to show up in China. And at timing of the visit, it is clear that everyone is betting that the Apple CEO is in Shanghai because of this controversy.

Of course, the reason for the visit does not prevent the executive from also fulfilling a lighter, motivational and even marketing agenda, such as visiting Apple stores, a yoga studio in which people use Apple Watch to monitor activities, use their watch to pay for water transport (ferry) and praise the performance of some photographers equipped with their iPhones XS Max – all on the social network Weibo, in which Cook has an official account.

Behind the scenes, of course, the Apple CEO is likely to meet with government officials and Apple vendors to try to understand this whole mess.

via AppleInsider: 1, 2, 3