SERVER MAKER Supermicro has told customers that its investigation into claims of a supply-chain attack on its motherboards has found no evidence of compromise.
In a letter published on Tuesday, the company claimed that the third-party investigations firm that it had brought in to examine the claims, made in a sensational Bloomberg article in October, found no evidence of compromise, either on the motherboards depicted in the article, or more recently manufactured motherboards.
"As we have stated repeatedly since these allegations were reported, no government agency has ever informed us that it has found malicious hardware on our products; no customer has ever informed us that it found malicious hardware on our products, and we have never seen any evidence of malicious hardware on our products," the company asserted.
"Today's announcement should lay to rest the unwarranted accusations made about Supermicro's motherboards," it continued. It's not clear whether the company plans to take legal action against Bloomberg, which continues to stand by its story.
Bloomberg had claimed that the company had fallen victim to a sophisticated supply-chain attack on its manufacturing facilities in China, compromising high-end servers destined for such clients as Apple and Amazon.
The attack is alleged to have involved the infiltration of the company's hardware with the introduction of tiny chips on server motherboards capable of exfiltrating data. The article suggested that the attack had been perpetrated by Chinese intelligence, and included interviews with a number of government and other sources to back-up the claims.
However, even at the time, many knowledgeable commentators cast doubt on the report. In November, Tavis Ormandy, a high-profile vulnerability researcher at Google, for example, called on Bloomberg to either provide proof to back-up its article or to retract it.
Independent security journalist Brian Krebs, meanwhile, claims to have been informed about the alleged compromise months before Bloomberg went public, but says that he was unable to make the story stand up.
In its letter, Supermicro was also keen to reiterate the various steps in its manufacturing process that, it claims, are "designed to protect the integrity and reliability" of its products:
"Among other safeguards:
- We test our products at every step of the manufacturing process. We test every layer of every board we manufacture throughout the process.
- We require that Supermicro employees be onsite with our assembly contractors, where we conduct multiple inspections, including automated optical, visual, electrical, and functional tests.
- The complexity of our motherboard design serves as an additional safeguard. Throughout our supply chain, each of our boards is tested repeatedly against its design to detect any aberration and to reject any board that does not match its design.
- To guard against tampering, no single employee, team, or contractor has unrestricted access to our complete board design.
- We regularly audit our contractors for process, quality, and controls." µ
CNIL slams firm's lack of transparency around user data
Some like it less hot
India's five message limit rolls out globally