Security Market Segment LS
Wednesday, 10 October 2018 09:39

Bloomberg says big US telco hit by hardware tampering Featured

Bloomberg says big US telco hit by hardware tampering Pixabay

Apparently undeterred by strong criticism of a supply chain attack story it published last week, Bloomberg has put out another yarn, dealing with a similar theme, this time about a "major US telecommunications company" that allegedly encountered doctored hardware made by the US company Supermicro Computer.

Tuesday's story, written by Jordan Robertson and Michael Riley — the same reporters who filed a yarn last week claiming that chips are being implanted by a Chinese contractor on server motherboards sold by Supermicro and being used to spy on some companies — alleges that a security expert working for the telco in question found evidence of tampering.

Last week's story has been met with strong denials from Apple and Amazon, two companies named as being affected. It has also been contradicted by the US Department of Homeland Security and the British National Cyber Security Centre.

Additionally, a senior Apple security official wrote to the US Congress directly saying there was no evidence to back Bloomberg's claims while a former general counsel of the company said he had asked the FBI about the charges and been told that the agency knew nothing about it.

In Tuesday's story, headlined "New evidence of hacked Supermicro hardware found in US telecom", Bloomberg cited Yossi Appleboum, whom it described as a security expert working for Sepio Systems and a former hacker with the Israeli Army Intelligence Corps, as saying "unusual communications from a Supermicro server and a subsequent physical inspection revealed an implant built into the server’s Ethernet connector, a component that's used to attach network cables to the computer".

The story did not name the US telco in question. The website Motherboard  said it had contacted 10 major American providers and the four biggest companies — AT&T, Verizon, Sprint and T-Mobile — had denied they had been attacked. CenturyLink also issued a denial.

Bloomberg included a statement from Supermicro in Tuesday's story, again denying that any of its hardware had been compromised. The company said: "We are dismayed that Bloomberg would give us only limited information, no documentation, and half a day to respond to these new allegations.” To that, Bloomberg said Supermicro had been given 24 hours to respond.

The story also mentioned that Supermicro shares had fallen 47% after the first story on Thursday last week. After the new story appeared, the company's stock fell by 27%.

As iTWire has reported, citing a Business Insider story from 2013, Bloomberg has a practice of paying higher annual bonuses to those who write stories that move markets. The first story resulted in Lenovo shares falling by as much as 23% across Asia on Friday, while the stocks of ZTE Corporation, China's biggest telecommunications equipment maker, fell by about 14% in Hong Kong trading. And both Apple and Amazon lost a little less than 2% of their value following the report.

According to Tuesday's story, the tampering was done on an Ethernet connector, which it said appeared to be similar to a method used by the NSA, the details of which were leaked in 2013.

Further, it said that this made the server that had tampered equipment appear as two devices on the network. "The legitimate server was communicating one way, and the implant another, but all the traffic appeared to be coming from the same trusted server, which allowed it to pass through security filters," is how it was described.

Meanwhile, in a development related to last Thursday's story, hardware security expert Joe Fitzpatrick, who was briefly quoted by Bloomberg in that story, gave an interview to the podcast Risky Business in which he said he was not comfortable with the story.

Fitzpatrick also said that it appeared that various hypothetical situations he had outlined to Robertson had been adapted in the story to appear as if they had actually transpired.

"It was surprising to me that in a scenario where I would describe these things and then he would go and confirm these and 100 percent of what I described was confirmed by sources," was how he put it.

And he hinted that the report may have cited him as an anonymous source at a different point in the story from the place where he was quoted.


As part of our Lead Machine Methodology we will help you get more leads, more customers and more business. Let us help you develop your digital marketing campaign

Digital Marketing is ideal in these tough times and it can replace face to face marketing with person to person marketing via the phone conference calls and webinars

Significant opportunity pipelines can be developed and continually topped up with the help of Digital Marketing so that deals can be made and deals can be closed

- Newsletter adverts in dynamic GIF slideshow formats

- News site adverts from small to large sizes also as dynamic GIF slideshow formats

- Guest Editorial - get your message out there and put your CEO in the spotlight

- Promotional News and Content - displayed on the homepage and all pages

- Leverage our proven event promotion methodology - The Lead Machine gets you leads

Contact Andrew our digital campaign designer on 0412 390 000 or via email



Security requirements such as confidentiality, integrity and authentication have become mandatory in most industries.

Data encryption methods previously used only by military and intelligence services have become common practice in all data transfer networks across all platforms, in all industries where information is sensitive and vital (financial and government institutions, critical infrastructure, data centres, and service providers).

Get the full details on Layer-1 encryption solutions straight from PacketLight’s optical networks experts.

This white paper titled, “When 1% of the Light Equals 100% of the Information” is a must read for anyone within the fiber optics, cybersecurity or related industry sectors.

To access click Download here.


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments