dmcq (dmcq.delete@this.fano.co.uk) on October 5, 2018 1:27 am wrote:
> Maynard Handley (name99.delete@this.name99.org) on October 4, 2018 4:01 pm wrote:
> > David Kanter (dkanter.delete@this.realworldtech.com) on October 4, 2018 8:23 am wrote:
> > > Bloomberg released a fantastic report on Chinese intelligence inserting malicious
> > > HW into supply chains for servers: https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies?srnd=premium
> > >
> > > It sure gives a different angle to the move to a hardware root-of-trust by the industry. In reality though,
> > > I'm not sure if HW RoT is sufficient. You can always sniff capacitance across an exposed wire!
> > >
> > > David
> >
> > Apple just ratcheted up the level of denial:
> > https://www.apple.com/newsroom/2018/10/what-businessweek-got-wrong-about-apple/
> >
> > Among other things:
> > "Finally, in response to questions we have received from other news organizations since Businessweek
> > published its story, we are not under any kind of gag order or other confidentiality obligations"
>
> Of course the would say that ;-) Anything they do now will just feed a feeding frenzy.


The article says the information was very closely held within Apple, and the same is surely true of Amazon. I'll bet once this was discovered, the engineers involved go to their manager, who says we need to take this to the government. The FBI asks them not to discuss it with anyone else on national security grounds.

Either the FBI talks to Bloomberg (either deliberately or via a leak) or the people at Apple/Amazon who know become concerned not getting any feedback from the FBI and worry other companies may be attacked and not know to defend themselves so they go to the press. Either way, when spokespeople at Apple/Amazon are contacted, they email various executives "hey do you know anything about this" and they contact some others but the people who know about it and didn't tell others within the company aren't contacted. Thus the company issues denials, because as far as anyone is aware the story is false.

Meanwhile the guys who know about this read the story, then see their company making official denials. If they talk to someone "hey I was involved in this, it is true" then they might get in trouble. For making the company look bad issuing a denial they'd have to retract, for perhaps not following proper procedures when the FBI was contacted, for potentially whistleblowing to the press. They aren't likely to be rewarded for any of these things, and could possibly get fired (if they would leak this to the press, maybe they would leak other stuff, better get rid of them just in case) So there's an incentive for them to remain silent now.