SuperMicro server spy chip story returns, with no more proof than before

Inside one of Apple's U.S. data centers

On October 4, 2018, a Bloomberg report based on what the venue said was a multi-year investigation claimed that Apple, Amazon, and 30 other companies had been the victim of an espionage campaign in which rice-sized chips had been planted on motherboards made by Super Micro. Once delivered, the motherboards supposedly created a backdoor into infrastructure like Apple's iCloud.

It has been two and a half years, and Bloomberg has issued another round of reporting on the story. The new story cites new "sources" that lack first-hand information on the tale, and instead say that they were "briefed" about the matter.

SuperMicro has refuted the details of the report again. In a statement to Bloomberg the company says that there has been no contact by the U.S. government or any of its customers about the claims.

Furthermore, SuperMicro calls the continued saga "a mishmash of disparate and inaccurate allegations" and it "draws farfetched conclusions."

Bloomberg itself cites the NSA as standing by previous comments denying the claims, including a statement that the agency was "befuddled" by the report.

In 2018, following the original claims, Apple was quick to deny allegations, insisting that it had conducted a "massive, granular, and siloed investigation."

Amazon also issued a very clear denial of the story.

"There are so many inaccuracies in this article as it relates to Amazon that they're hard to count," Amazon said in its statement, refuting several specific claims, and specifically citing that there was no modified hardware found.

Several subsequent accounts have cast further doubt, such as one from the senior advisor for Cybersecurity Strategy to the director of the U.S. National Security Agency. Additionally, The U.S. Department of Homeland Security commented that it had "no reason to doubt" the positions of Apple and Amazon.

Apple CEO Tim Cook also spoke about Bloomberg's allegations. Apple's CEO denied the report, and took issue with how the story's reporters communicated with Apple.

"There is no truth in their story about Apple," Cook said in 2018. "They need to do that right thing and retract it."

"I was involved in our response to this story from the beginning," said Cook. "I personally talked to the Bloomberg reporters along with Bruce Sewell who was then our general counsel. We were very clear with them that this did not happen, and answered all their questions. Each time they brought this up to us, the story changed and each time we investigated we found nothing."

"We turned the company upside down. Email searches, datacenter records, financial records, shipment records," Cook added. "We really forensically whipped through the company to dig very deep and each time we came back to the same conclusion: This did not happen. There's no truth to this."

Super Micro itself said that it would continue to investigate the allegations found in the report. At the same time, Super Micro CEO Charles Liang echoed Cook's call for a retraction.

"Bloomberg's recent story has created unwarranted confusion and concern for our customers, and has caused our customers, and us, harm," Liang said at the time. "Bloomberg should act responsibly and retract its unsupported allegations that malicious hardware components were implanted on our motherboards during the manufacturing process."

Other analyses proved that the vector of attack that Bloomberg proposed was impossible. Specifically, that report said that there were some "fairly astounding plausibility and feasibility gaps," and added that the story was notably light on details and difficult to navigate. No additional details were provided in Friday's new recounting of the saga.

SuperMicro servers are still being purchased by the Federal government, and never left the allowable purchases list at any time.

In the face of debunks, and Apple, Amazon, SuperMicro, plus at least three Federal agencies calling for a retraction, Bloomberg stands by its reporting.