Information has come to light about one of the largest corporate espionage programs by a nation-state. The Chinese government managed to gain unauthorized access to the servers of more than 30 American companies, including Apple.
It is reported that the American interests company Supermicro, which specializes in servers, was breached in China where government-linked organizations are said to have infiltrated the company's supply chain to attach microscopic chips, some the size of a pencil tip, onto motherboards that ended up in servers in the USA.
The goal was to create an entry point in the company's systems for retrieving IP or confidential information. While the servers were limited in terms of direct capabilities, they represented a «invisible gate» that could allow people from China to remotely modify the way a device operates for a potential malicious access to information.
As soon as the information was disclosed, the U.S. government spied in turn on the people behind the chips, but it is not known whether consumer data has been stolen by the attacks. This episode represents one of the most impressive espionage programs by the Chinese government to date.
The story says the chips were discovered and reported to the FBI by Amazon, which found them before its 2015 acquisition of Elemental Systems, a company that was involved in a number of US government contracts, and Apple, which used up to 7,000 Supermicro servers. Amazon reportedly removed all of the servers within a month. Apple did indeed cut ties with Supermicro in 2016, but denied the reports of security issues. Amazon completed the deal with Elemental Systems – reportedly worth $500 million – after switching its software to the AWS cloud.
Amazon, Apple, Supermicro and the Chinese Ministry of Foreign Affairs completely denied the story with strong and lengthy statements. It is said that the leaked information comes from 17, and possibly more, individuals, among whom are officials of the United States and people from Apple.
