https://www.servethehome.com/yossi-appleboum-disagrees-bloomberg-is-positioning-his-research-against-supermicro/ citing Yossi Appleboum CEO of Sepio Systems. Here is that story. I reached out to Mr. Appleboum for comment via telephone. Whereas the Bloomberg story singles out Supermicro servers, Mr. Appleboum’s sentiment is that this is an industrywide issue. Other very large server and networking manufacturers are certainly impacted, perhaps more so. He also stated that as an industry, or a society, we have two options: we go with the narrative that a US company, Supermicro, is the only one impacted as the Bloomberg reporting suggests, or we recognize that this is a persistent threat that impacts the entire hardware supply chain
FUD.
He is talking about a well known POTENTIAL attack vector. Still no evidence of the specific claims which, btw, don't make many sense:
1- Bloomberg initially pointed to supermicro servers and, specifically, a small microchip embedded into the board. Where is that microchip? Where is the research? Anything?
2- Then Appleboum says Bloomberg misquoted him because he never said anything specific (ie, Supermicro) but that it is a widespread problem.Well, again, where are their forensic evidence? Anything?
3- The description of the embedded chip doesn't make any sense. Of course, that is unsurprising when it comes to MSM but.... in this case it is not possible to check the facts from the technical sources because.... where is it? Anything?
4- I would certainly be greatly interested in knowing more about that spectacular microchip the size of a tiny SMC capacitor that features integrated cpu, ram, etc and is able to work and process at baseband frequencies. THAT is the evidence I would like to see, no matter if it has been used on a large scale attack or not.
Even though there is not evidence of this case, as I said it is a well known possible attack vector (usually by replacement in-situ or in the last stages on the supply chain not at manufacturing) and there are many countermeasures that are security best practices since many years: Isolated networks/segmentation, Data leak detection/prevention, etc....
It is way easier to implement this attacks by firmware modification though... Anyway, not going to completely shit over what they are saying because it is theoretical posible but until no specific evidence is shown I tag it as (plausible) FUD.