- Super Micro, which sells server motherboards to companies like Apple and Amazon, was accused of being infiltrated by Chinese spies in a bombshell Bloomberg Businessweek story published in October.
- Super Micro said on Tuesday that it had hired a third-party firm which had not found any evidence backing up the Bloomberg story.
- Super Micro stock is still 20% lower than it was before the report.
- A Bloomberg News representative declined to comment on Super Micro's findings.
Super Micro, one of the largest server companies in the world, said on Tuesday in a letter to customers that it found "no evidence" of malicious microchips on its server motherboards.
In the letter signed by Super Micro's CEO, the company said that it hopes Tuesday's letter will "lay to rest the unwarranted accusations" raised by a Bloomberg Businessweek story that has come under intense scrutiny.
In early October, Bloomberg published a story that said that Chinese spies were able to implant tiny microchips on servers used by companies like Apple and Amazon. The report was explosive, and Super Micro stock plunged after publication. It's still trading at 20% lower than it was before the report.
Super Micro said on Tuesday it had hired a third-party investigations firm that found no malicious hardware on any Super Micro motherboards, and it had specifically tested the types of motherboards discussed in the article. Reuters reports that the third-party firm is Nardello & Co.
"Today, we want to share with you the results of this testing: After thorough examination and a range of functional tests, the investigations firm found absolutely no evidence of malicious hardware on our motherboards," Super Micro said in the letter.
Super Micro also published a video that said that the allegations in the Bloomberg story were "impossible" due to the complexity of the technology and safeguards in the manufacturing process, and called the San Jose-based company an "American success story."
In addition, Rob Joyce, a Homeland Security advisor and NSA official, also said on Tuesday that despite his call for additional information, he has not seen any evidence supporting the Bloomberg Businessweek story.
No other reporters have been able to independently corroborate the allegations and Apple CEO Tim Cook has asked for a retraction.
A Bloomberg News spokesperson declined to comment on Tuesday's letter when reached by Business Insider.
"Our reporters and editors thoroughly vet every story before publication, and this was no exception," Bloomberg News previously said about the story.
The Washington Post reported last month that different Bloomberg reporters are still digging on the story.
The full letter is republished below:
Super Micro Computer, Inc.
980 Rock Avenue
San Jose, CA 95131 USA
December 11, 2018
Testing Finds No Malicious Hardware on Supermicro Motherboards
Dear Valued Customer,
Recent reports in the media wrongly alleged that bad actors had inserted a malicious chip or other hardware on our products during our manufacturing process.
Because the security and integrity of our products is our highest priority, we undertook a thorough investigation with the assistance of a leading, third-party investigations firm. A representative sample of our motherboards was tested, including the specific type of motherboard depicted in the article and motherboards purchased by companies referenced in the article, as well as more recently manufactured motherboards.
Today, we want to share with you the results of this testing: After thorough examination and a range of functional tests, the investigations firm found absolutely no evidence of malicious hardware on our motherboards.
These findings were no surprise to us. As we have stated repeatedly, our process is designed to protect the integrity and reliability of our products. Among other safeguards:
- We test our products at every step of the manufacturing process. We test every layer of every board we manufacture throughout the process.
- We require that Supermicro employees be onsite with our assembly contractors, where we conduct multiple inspections, including automated optical, visual, electrical, and functional tests.
- The complexity of our motherboard design serves as an additional safeguard. Throughout our supply chain, each of our boards is tested repeatedly against its design to detect any aberration and to reject any board that does not match its design.
- To guard against tampering, no single employee, team, or contractor has unrestricted access to our complete board design.
- We regularly audit our contractors for process, quality, and controls.
We appreciate the industry support regarding this matter from many of our customers, like Apple and AWS. We are also grateful for numerous senior government officials, including representatives of the Department of Homeland Security, the Director of National Intelligence, and the Director of the FBI, who early on appropriately questioned the truth of the media reports.
As we have stated repeatedly since these allegations were reported, no government agency has ever informed us that it has found malicious hardware on our products; no customer has ever informed us that it found malicious hardware on our products; and we have never seen any evidence of malicious hardware on our products.
Today's announcement should lay to rest the unwarranted accusations made about Supermicro's motherboards. We know that many of you are also addressing these issues with your own customers. To assist in those conversations, we have prepared a short video that highlights our quality assurance process.
We appreciate your patience as we have diligently conducted a thorough investigation into the reports. We are truly proud of the security, integrity, and quality of our products. And we are proud to stand by our products. Please contact our team if you have any questions.
Sincerely,
Charles Liang
President & CEO
David Weigand
SVP and Chief Compliance Officer
Raju Penumatcha
SVP and Chief Product Officer
Good morning from #WSJCyber, where @RGB_Lights says he's still seen no evidence of hardware tampering after putting out a call to verify the @business story.
- Jeff Stone (@jeffstone500) December 11, 2018