Business Korea, an English-language business and financial magazine in South Korea, reported widespread use of Supermicro servers among the country’s financial institutions, large corporations, and government-run research institutes, in an article published on Oct. 8.
Two government-run institutes are named: the Electronics and Telecommunications Research Institute (ETRI), one of South Korea’s leading institutes in research and development of wireless communication, and Korea Aerospace Research Institute (KARI), a government agency that is mainly responsible for the country’s satellite, rocket, and lunar exploration projects.
Many private companies also use Supermicro servers, such as South Korean electronics giants Samsung and LG, mobile service provider KT, and the publicly listed steel-making company POSCO. One research institute is identified: Korea Institute of Science and Technology (KIST), which is dedicated to the R&D of research fields such as brain science, robotics, and materials science.
According to the Bloomberg report, microchips were inserted into the servers at factories run by Supermicro’s manufacturing subcontractors in China. The chips would allow cyber attackers “to create a stealth doorway into any network that included the altered machines.”
Bloomberg’s investigation revealed that the spy chips have affected almost 30 companies, including Amazon and Apple, though both firms have refuted the claims in the Bloomberg article. Supermicro has also denied that it has sold servers containing the chips to customers.
Lim Jong-in, a professor at the Graduate School of Information Security at Korea University, pointed out that even if companies were compromised by Chinese spyware, they may not necessarily be able to detect the problem, according to an Oct. 8 by Korea’s English-language newspaper Korea Times.
“Korea has been largely depending on China in the IT area. It would be difficult to refuse to use Chinese products unconditionally without finding clear evidence,” Lim said. “But if Korea continues to use Chinese products, the nation would lose its credibility with the United States and other countries.”
Lim suggested that the South Korean government should improve its capability to detect any form of cyberattacks. As for private companies, he suggested that they need to “consider consumer protection when choosing partners, rather than considering the price issue only.”
The alleged spy chip has “amplified concerns over Huawei’s 5G equipment,” according to another report by Business Korea published on Oct. 8. 5G is the next generation of wireless mobile communications technology that is set to revolutionize different industries, including transportation and manufacturing.
Huawei is China’s largest telecommunications service provider. The company’s ties to the Chinese military—and hence, its risks to national security—have led a number of governments, including the United States, United Kingdom, and Australia, to shut it out of those countries.
The spy chip allegations have lent further credibility to the idea that Chinese-manufactured tech parts can be exploited by Beijing to conduct espionage.
The concerns over Huawei in South Korea centers around two local mobile service providers, KT and LG Uplus, who have yet to announce which company they will buy their 5G equipment from.
European Union
While it is unclear if any European company is affected by the spy chip, the European Commission is nonetheless being watchful of potential cyberattacks from China.The EU’s executive body, the European Commission, is drafting documents about concerns toward Beijing and possibly coming up with new defensive measures. The drafting process came amid a meeting with governmental experts, foreign affairs officials, and industry lobbyists to discuss a recent study conducted by PricewaterhouseCoopers. PwC will finalize the report and provide it to the Commission later this month.
The study, citing estimates from non-profit think tank the European Centre for International Political Economy (ECIPE), concluded that Europe alone would face a possible loss of 60 billion euros (about $68.7 billion) and roughly 289,000 jobs in 2018 due to cyber theft of trade secrets.
Germany is the country most affected by cyber theft among EU member states, according to the study, with 17 percent of all German companies having reported theft of sensitive data between 2015 and 2017. The study raised the example of German conglomerate ThyssenKrupp, a firm focused on industrial engineering and steel production, which had its project data stolen by hackers located in southeast Asia in 2016.
The PwC study proposed several recommendations, including the creation of a cross-border EU cybersecurity investigative department, that is responsible for prosecuting cyber theft of trade secrets. Another recommendation is for the EU to sign bilateral agreements on countering cyber theft, much like that between the United States and China.
