Apple refutes security break report
October 4th 2018
Apple:
The October 8, 2018 issue of Bloomberg Businessweek incorrectly reports that Apple found "malicious chips"Â in servers on its network in 2015. As Apple has repeatedly explained to Bloomberg reporters and editors over the past 12 months, there is no truth to these claims.
The report is pretty interesting is that alleges China state-sponsored spying resulted in a tiny chip being installed into a server logic board manufacturer. Sources say Apple and Amazon were two tech companies affected.
Both Apple and Amazon are strongly refuting the claim. It's very unusual for Apple to issue a rebuttal in a general press release.
On this we can be very clear: Apple has never found malicious chips, "hardware manipulations" or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.
Apple suggests Bloomberg's sourcing may be confused with a different incident.
Our best guess is that they are confusing their story with a previously-reported 2016 incident in which we discovered an infected driver on a single Super Micro server in one of our labs. That one-time event was determined to be accidental and not a targeted attack against Apple.
Beyond that, Apple provided some details of how it inspects procured hardware:
As a matter of practice, before servers are put into production at Apple they are inspected for security vulnerabilities and we update all firmware and software with the latest protections. We did not uncover any unusual vulnerabilities in the servers we purchased from Super Micro when we updated the firmware and software according to our standard procedures.
