US officials have shared details of a widespread hardware hack which saw Chinese spies infiltrate 30 American companies, including Amazon and Apple, in 2015 by planting rice-sized computer chips onto their server motherboards which gave hackers access to sensitive consumer and government data.
The unnamed officials detailed the astonishing breach for the first time publicly in an expose by Bloomberg Businessweek on Thursday.
Amazon, Apple and Super Micro Computer Inc, the server manufacturer which the officials say was compromised, all deny it officially but unnamed workers from both Apple and Amazon confirmed details of the hack, and how they dumped Supermicro afterwards.
All three companies suffered losses on Thursday when the news broke. Amazon and Apple’s stock prices dipped by up to two percent.
Supermicro, which was delisted by NASDAQ in August for failing to produce earnings reports on times but is still being traded on other exchanges, halved in value, losing $500million of its total worth in a matter of hours.
Chinese officials vaguely dismissed the attack and said the report amounted to nothing more than ‘gratuitous accusations’.
No data is believed to have been stolen and the other 28 companies affected were not named.
At the time of the attack, there were 7,000 Supermicro servers in use by Apple and many were facilitating its Siri voice assistant function, according to the report.
As for Amazon, the chips had made their way onto servers being used in China by Amazon Web Services, its enormously popular, global cloud platform.
Both Amazon and Apple severed ties with Supermicro in 2016 for, they say, unrelated reasons.
Supermicro is one of Silicon Valley’s most prolific hardware manufacturers and is the country’s largest supplier of motherboards. It is the third largest supplier in the world.
ts motherboards are built mostly in its own facilities in Taiwan and China but in 2015, it had been outsourcing to four Chinese subcontractors when demand for its products overwhelmed its own operations.
It was in these subcontractor factories that Chinese military spies posed as members of Supermicro or governmental officials and ordered the manufacturers to include the tiny chip in the motherboards.
Some were so small they were the size of a sharpened pencil head, the officials say.
Once a server was turned on, the chips operated almost like a Trojan Horse by disarming the server’s security capabilities and granting access to hackers overseas.
The chips could communicate with the hackers’ computers and slip new code onto the servers without detection.
US intelligence officials became aware of the plan in 2014 while it was still being conceived but they were unable to act because they did not know who among Supermicro’s customers was being targeted.
They did not know about the subcontractor factories or their role in it and they did not want to warn the company and its customers because it would have crippled them financially with little proof of a real hack.
In 2015, however, both Amazon and Apple discovered the breach for themselves and reported it, the insiders say.
Amazon handed over the compromised hardware to be examined, the officials say, and the investigation is still continuing to this day. Apple only alerted the government to it but did not give over the equipment, it was claimed.
The US officials cited by Bloomberg emphasized the scale of the attack by likening Supermicro to Microsoft to illustrate how widespread its reach is.
They said it was like ‘an attack on the whole world’.
The Chinese spies’ apparent goal was broad.
They wanted to, over time, harvest sensitive consumer data and government information from Supermicro’s customers.
The chips would not only harvest data but could slip new code into the products and compromise it by altering the server so that it accepted modifications without detection.
The chip could also communicate with computers being operated by the attackers in China once the server was installed and turned on.
At the time, Supermicro, which was founded by Taiwanese engineer Charles Liang in California in 1993, had more than 900 customers in 100 different countries.
While it is headquartered in San Jose, almost all of its staff are Taiwanese or Chinese, former employees told Bloomberg.
Many of its products are built in production facilities in the US and the Netherlands but its motherboards are almost all exclusively built in China.
viagra for sale cheap uk cheap viagra buy online is there a generic for cialis