Doug S (foo.delete@this.bar.bar) on October 5, 2018 12:56 pm wrote:
> dmcq (dmcq.delete@this.fano.co.uk) on October 5, 2018 1:27 am wrote:
> > Maynard Handley (name99.delete@this.name99.org) on October 4, 2018 4:01 pm wrote:
> > > David Kanter (dkanter.delete@this.realworldtech.com) on October 4, 2018 8:23 am wrote:
> > > > Bloomberg released a fantastic report on Chinese intelligence inserting malicious
> > > > HW into supply chains for servers: https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies?srnd=premium
> > > >
> > > > It sure gives a different angle to the move to a hardware root-of-trust by the industry. In reality though,
> > > > I'm not sure if HW RoT is sufficient. You can always sniff capacitance across an exposed wire!
> > > >
> > > > David
> > >
> > > Apple just ratcheted up the level of denial:
> > > https://www.apple.com/newsroom/2018/10/what-businessweek-got-wrong-about-apple/
> > >
> > > Among other things:
> > > "Finally, in response to questions we have received from other news organizations since Businessweek
> > > published its story, we are not under any kind of gag order or other confidentiality obligations"
> >
> > Of course the would say that ;-) Anything they do now will just feed a feeding frenzy.
>
>
> The article says the information was very closely held within Apple, and the same is surely true of Amazon.
> I'll bet once this was discovered, the engineers involved go to their manager, who says we need to take this
> to the government. The FBI asks them not to discuss it with anyone else on national security grounds.
>
> Either the FBI talks to Bloomberg (either deliberately or via a leak) or the people at Apple/Amazon
> who know become concerned not getting any feedback from the FBI and worry other companies may be attacked
> and not know to defend themselves so they go to the press. Either way, when spokespeople at Apple/Amazon
> are contacted, they email various executives "hey do you know anything about this" and they contact
> some others but the people who know about it and didn't tell others within the company aren't contacted.
> Thus the company issues denials, because as far as anyone is aware the story is false.
>
> Meanwhile the guys who know about this read the story, then see their company making official denials. If they
> talk to someone "hey I was involved in this, it is true" then they might get in trouble. For making the company
> look bad issuing a denial they'd have to retract, for perhaps not following proper procedures when the FBI
> was contacted, for potentially whistleblowing to the press. They aren't likely to be rewarded for any of these
> things, and could possibly get fired (if they would leak this to the press, maybe they would leak other stuff,
> better get rid of them just in case) So there's an incentive for them to remain silent now.

FBI is a red herring to make denials easier, the CIA would have been contacted.
The parts came from China not the US.