Tuesday's story, written by Jordan Robertson and Michael Riley — the same reporters who filed a yarn last week claiming that chips are being implanted by a Chinese contractor on server motherboards sold by Supermicro and being used to spy on some companies — alleges that a security expert working for the telco in question found evidence of tampering.
Last week's story has been met with strong denials from Apple and Amazon, two companies named as being affected. It has also been contradicted by the US Department of Homeland Security and the British National Cyber Security Centre.
Additionally, a senior Apple security official wrote to the US Congress directly saying there was no evidence to back Bloomberg's claims while a former general counsel of the company said he had asked the FBI about the charges and been told that the agency knew nothing about it.
Yikes, the latest Bloomberg cyber story is even worse - doubles down on prior tale, then fronts a dude claiming hijacked Ethernet ports - which makes little to no sense and again has no evidence. Then tries to frame China as admitting everything.— Kevin Beaumont (@GossiTheDog) October 9, 2018
The story did not name the US telco in question. The website Motherboard said it had contacted 10 major American providers and the four biggest companies — AT&T, Verizon, Sprint and T-Mobile — had denied they had been attacked. CenturyLink also issued a denial.
Bloomberg included a statement from Supermicro in Tuesday's story, again denying that any of its hardware had been compromised. The company said: "We are dismayed that Bloomberg would give us only limited information, no documentation, and half a day to respond to these new allegations.” To that, Bloomberg said Supermicro had been given 24 hours to respond.
The story also mentioned that Supermicro shares had fallen 47% after the first story on Thursday last week. After the new story appeared, the company's stock fell by 27%.
As iTWire has reported, citing a Business Insider story from 2013, Bloomberg has a practice of paying higher annual bonuses to those who write stories that move markets. The first story resulted in Lenovo shares falling by as much as 23% across Asia on Friday, while the stocks of ZTE Corporation, China's biggest telecommunications equipment maker, fell by about 14% in Hong Kong trading. And both Apple and Amazon lost a little less than 2% of their value following the report.
For the record, I have real problems with the sourcing on both stories. But I recognize that hardware and/or firmware modification is possible and China is in a great position to do both. The only way to detect either is network monitoring, which you should be doing anyway.— Jake Williams (@MalwareJake) October 9, 2018
According to Tuesday's story, the tampering was done on an Ethernet connector, which it said appeared to be similar to a method used by the NSA, the details of which were leaked in 2013.
Further, it said that this made the server that had tampered equipment appear as two devices on the network. "The legitimate server was communicating one way, and the implant another, but all the traffic appeared to be coming from the same trusted server, which allowed it to pass through security filters," is how it was described.
Meanwhile, in a development related to last Thursday's story, hardware security expert Joe Fitzpatrick, who was briefly quoted by Bloomberg in that story, gave an interview to the podcast Risky Business in which he said he was not comfortable with the story.
Fitzpatrick also said that it appeared that various hypothetical situations he had outlined to Robertson had been adapted in the story to appear as if they had actually transpired.
"It was surprising to me that in a scenario where I would describe these things and then he would go and confirm these and 100 percent of what I described was confirmed by sources," was how he put it.
And he hinted that the report may have cited him as an anonymous source at a different point in the story from the place where he was quoted.