Supermicro

On October 4, 2018, Bloomberg Businessweek published a report, citing unnamed corporate and governmental sources, which claimed that the Chinese People's Liberation Army had forced Supermicro's Chinese sub-contractors to add microchips with hardware backdoors to its servers. The report claimed that the compromised servers had been sold to U.S. government divisions (including the CIA and Department of Defense) and contractors and at least 30 commercial clients (including Apple).[10] The backdoor was reportedly discovered by Amazon during a review of Elemental Technologies, a Supermicro client that Amazon would acquire in 2015.[10][11][12]

Supermicro denied the report, stating that they had not been contacted by government agencies and were unaware of any investigation. Amazon and Apple also denied the Bloomberg claims, and the article has faced skepticism over its validity.[13][11][14] One of its named sources stated that the attack detailed seemed theoretical and that he "couldn't rationalize in [his] head that this is the approach that anyone could take."[15] FBI director Christopher A. Wray, in testimony before the U.S. Senate Homeland Security and Governmental Affairs Committee, commented, "Be careful what you read."[16] On October 22 Supermicro announced that "despite the lack of any proof that a malicious hardware chip exists" it was reviewing its motherboards for potential spy chips in response to the article.[17]

On October 9, 2018, Bloomberg issued a second report, alleging that Supermicro-manufactured datacenter servers of an unnamed U.S. telecom firm had been compromised by a hardware implant on an Ethernet connector. The report cited former Israel intelligence officer Yossi Appleboum, who had analyzed and documented the implant. The Bloomberg report did not connect these findings to the previous report.[18][19] Appleboum has since said that his company had found such implants "...in different vendors, not just Supermicro..."[20]

Supermicro filed a letter with the Securities and Exchange Commission stating that it was "confident" that "no malicious hardware chip had been implanted" during the manufacture of its motherboards. It was also reported that the chief executives of Apple and Amazon Web Services rejected claims about the reports regarding hardware backdoors in Supermicro servers.[21]