Apple today released the following statement, verbatim:
The October 8, 2018 issue of Bloomberg Businessweek incorrectly reports that Apple found “malicious chips” in servers on its network in 2015. As Apple has repeatedly explained to Bloomberg reporters and editors over the past 12 months, there is no truth to these claims.
Apple provided Bloomberg Businessweek with the following statement before their story was published:
Over the course of the past year, Bloomberg has contacted us multiple times with claims, sometimes vague and sometimes elaborate, of an alleged security incident at Apple. Each time, we have conducted rigorous internal investigations based on their inquiries and each time we have found absolutely no evidence to support any of them. We have repeatedly and consistently offered factual responses, on the record, refuting virtually every aspect of Bloomberg’s story relating to Apple.
On this we can be very clear: Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.
In response to Bloomberg’s latest version of the narrative, we present the following facts: Siri and Topsy never shared servers; Siri has never been deployed on servers sold to us by Super Micro; and Topsy data was limited to approximately 2,000 Super Micro servers, not 7,000. None of those servers have ever been found to hold malicious chips.
As a matter of practice, before servers are put into production at Apple they are inspected for security vulnerabilities and we update all firmware and software with the latest protections. We did not uncover any unusual vulnerabilities in the servers we purchased from Super Micro when we updated the firmware and software according to our standard procedures.
We are deeply disappointed that in their dealings with us, Bloomberg’s reporters have not been open to the possibility that they or their sources might be wrong or misinformed. Our best guess is that they are confusing their story with a previously-reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple.
While there has been no claim that customer data was involved, we take these allegations seriously and we want users to know that we do everything possible to safeguard the personal information they entrust to us. We also want them to know that what Bloomberg is reporting about Apple is inaccurate.
Apple has always believed in being transparent about the ways we handle and protect data. If there were ever such an event as Bloomberg News has claimed, we would be forthcoming about it and we would work closely with law enforcement. Apple engineers conduct regular and rigorous security screenings to ensure that our systems are safe. We know that security is an endless race and that’s why we constantly fortify our systems against increasingly sophisticated hackers and cybercriminals who want to steal our data.
—
The published Businessweek story also claims that Apple “reported the incident to the FBI but kept details about what it had detected tightly held, even internally.” In November 2017, after we had first been presented with this allegation, we provided the following information to Bloomberg as part of a lengthy and detailed, on-the-record response. It first addresses their reporters’ unsubstantiated claims about a supposed internal investigation:
Despite numerous discussions across multiple teams and organizations, no one at Apple has ever heard of this investigation. Businessweek has refused to provide us with any information to track down the supposed proceedings or findings. Nor have they demonstrated any understanding of the standard procedures which were supposedly circumvented.
No one from Apple ever reached out to the FBI about anything like this, and we have never heard from the FBI about an investigation of this kind — much less tried to restrict it.
In an appearance this morning on Bloomberg Television, reporter Jordan Robertson made further claims about the supposed discovery of malicious chips, saying, “In Apple’s case, our understanding is it was a random spot check of some problematic servers that led to this detection.”
As we have previously informed Bloomberg, this is completely untrue. Apple has never found malicious chips in our servers.
Finally, in response to questions we have received from other news organizations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations.
Source: Apple Inc.
MacDailyNews Take: Something’s rotten at Bloomberg Businessweek.
SEE ALSO:
Apple strongly disputes Bloomberg BusinessWeek report that Chinese ‘spy’ chips were found in iCloud servers – October 4, 2018
Click Whores
The old supply line check rumors to screw aapl stock do not work anymore. So, now this.
A boogeyman claim to support the president’s war on China.
“War on China”? “WAR ON CHINA”? Wow. That unfortunate, defenseless, misunderstood, beleaguered Far East nation is being picked on by the big, bad bully Occidental President. My heart truly bleeds for them. When will we in the West cease picking on our humble Asian brothers and let them go quietly about their business of blocking off the seas around them with their expanding navy and air force, interfering in US elections, stealing Western technology, blocking international goods from their markets, and so very much more. When? WHEN? We should, one and all, apologize here and now for our unwarranted and unprovoked “war” on Zhongguo and surrender to them on our knees without condition. MCGA!
A common enemy to both Apple and Bloomberg seems to be pushing this spy story forward. I suspect the CIA’s top management or else a break-away segment working independently. But what is the benefit in undermining this large swath of Apple-related companies along with a business writer who may or may not be a CIA ally? If my suspicion is true, then it has to be part of the current China/US dynamic, an economic war with China exerting its growing influence in world-wide monetary policy with its partner, Russia, and who controls shipping lanes in the high seas, while the US is losing influence. So Hiram could be right.
Seems to me nobody here read the source article. There is an incredible amount of detailed information about the issue. Far too much for me to believe this is a hoax. Forget Apple and AWS specifics being disputed, its entirely feasible Supermicro boards were compromised as described.
Sure I read it. Seems impressive, but when you re-read it, just search for the sections Apple is mentioned in. When you do that, you’ll realize that the Apple parts are more thinly sourced and very limited in scope.
Essentially, they came up with that Apple found bad server boards in May 2015, and within a few months removed 7000 server boards by Supermicro, and cancelled their contract. Supposedly these servers were going to small server farms to help speed up Siri.
Apple refutes the whole thing, and either way, it would have had nothing to do with actual production or IP or privacy of customer information. The meat of the article seems to be Amazon Web Services.
Actually, the Bloomberg story says that Apple found the chips in May 2015, but then didn’t cancel their contract until early the next year. So, Bloomberg would have readers believe that Apple found horrendously-compromised equipment, and then kept working with the vendor for at least another 8 months.
That seems amazingly unlikely.
Seems to me like a firing offense for a reporter to persist in light of Apple’s statements.