Intel Warned Chinese Companies of Chip Flaws Before U.S. Government

&gt; It is a “near certainty” Beijing was aware of the conversations between Intel and its Chinese tech partners, because authorities there routinely monitor all such communications, Mr. Williams said.<p>Doesn&#x27;t that mean that it is a “near certainty” that the U.S. Government was aware of it, because authorities (NSA, etc) routinely monitor all such communications?

The US government is not a PC maker. The goal of the disclosure was to help companies figure out how to patch systems. Why would anyone expect the government to be notified first?

&gt; An Intel spokesman declined to identify the companies it briefed before the scheduled Jan. 9 announcement. The company wasn’t able to tell everyone it had planned to, including the U.S. government, because the news was made public earlier than expected, he said.<p>That seems to imply that Intel had planned to tell the US government some time between Jan 3 and Jan 9. That seems rather late.<p>I think that the distros list was notified before that, and I&#x27;d be quite surprised if there aren&#x27;t a couple of government agencies monitoring it.<p>This article doesn&#x27;t seem to say <i>when</i> the Chinese vendors were notified.

It&#x27;s interesting how many folks in this thread claim the US government is a &quot;huge&quot; intel customer. I do not believe that to be true. Certainly, they buy computers with Intel chips in them, but in terms of chip purchases (IE who intel was probably notifying), they are probably nowhere in volume.<p>Intel has 8 customers accounting for 75% of revenue[1].<p>By numbers, America and Taiwan are tied for third in terms of volume per country. Singapore is #1, followed by China.<p>Even for just client computing, 3 customers account for 38% of their revenue.<p>None are the US government[2]<p>[1] <a href="https:&#x2F;&#x2F;www.investopedia.com&#x2F;articles&#x2F;markets&#x2F;100214&#x2F;inside-intel-look-mega-chipmaker.asp" rel="nofollow">https:&#x2F;&#x2F;www.investopedia.com&#x2F;articles&#x2F;markets&#x2F;100214&#x2F;inside-...</a> [2] <a href="https:&#x2F;&#x2F;www.sec.gov&#x2F;Archives&#x2F;edgar&#x2F;data&#x2F;50863&#x2F;000005086317000012&#x2F;a10kdocument12312016q4.htm" rel="nofollow">https:&#x2F;&#x2F;www.sec.gov&#x2F;Archives&#x2F;edgar&#x2F;data&#x2F;50863&#x2F;00000508631700...</a>

The timetable is a bit strewn throughout the article, but from what I can make out:<p>June: Google reports the problem to Intel.<p>Soon after: Intel&#x2F;Google (unclear) informs related businesses (Lenovo, Microsoft, Amazon, ARM Holdings, others?).<p>Jan 3: Vulnerability leaked ahead of planned Jan 9 reveal.<p>A <i>6 month</i> window where apparently <i>nobody</i> informed the US Gov. I&#x27;m legitimately kinda surprised - if it were a small window, meh, but clearly they (and every other government) would have wanted an earlier warning since they&#x27;d likely be vulnerable. That&#x27;s a <i>gigantic</i> window for the info to leak and an automated exploit to be built (just look how fast it happened when the news became public).

Lenovo was the #1 manufacturer of PCs worldwide in 2016.<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Market_share_of_personal_computer_vendors" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Market_share_of_personal_compu...</a><p>So... what’s the problem exactly?

This series of flaws surprised me, I now really see why you want to run government computing on their own cloud. I naively trusted that vm separation would be enough and you couldn&#x27;t leak things that way. I know there have already been flaws exposed where the memory wasn&#x27;t scrubbed between sessions but I thought that was all fixed :-)<p>And the same idea applies to businesses that are suspicious of cloud computing security issues. Of course, these are probably obvious to everyone here and it&#x27;s why these flaws are a big deal, cause a lot of cpus have been sold for cloud&#x2F;vm installations, now what.

I’m guessing that the Chinese govt is a lot more likely to drop intel than the us one.

Google Project Zero researchers discovered this bug in May, 2017. They notified Intel, AMD, ARM and likely other chip-makers (Qualcomm, Broadcom, Marvel, Microtek, Huawei etc) directly. Intel is just the lead actor in this mega-production.<p>See this bug report by Jann Horn: <a href="https:&#x2F;&#x2F;bugs.chromium.org&#x2F;p&#x2F;project-zero&#x2F;issues&#x2F;detail?id=1272" rel="nofollow">https:&#x2F;&#x2F;bugs.chromium.org&#x2F;p&#x2F;project-zero&#x2F;issues&#x2F;detail?id=12...</a><p>Then each of these chip makers would have notified their direct customers who make original equipment (motherboards, SoCs, Add-on card etc). Then they would have to notify their firmware&#x2F;software partner&#x2F;vendors who have to fix the issue.<p>Since this was such a serious issue and at least 2 quarterly results were posted by all these publicly traded companies, I&#x27;m sure their lawyers, their external independent risk consultants, key members of the board and key investors were also told - especially as CYA when deciding to keep it a secret while giving market guidance (which had to be knowingly false?).<p>Each of these disclosures would have gone with boilerplate embargo legalese (bad things will happen to you if you speak about it). But all of them would have taken actions ranging for good to bad to evil (from insider stock trading to actively looking for ways to exploit the bug for competition spying).<p>While all this is going on, why would government not have known about this? Wouldn&#x27;t one of the government certification programs like NIST FEDRAMP mandatorily require them to be notified of any vulnerabilities monthly?<p>And of course, all govt spy agencies would have surely known about this vulnerability as early as July&#x2F;August given the amount of cross-continent communication that would have happened on this topic. And it&#x27;s a whole another matter if they used the exploit for any operational&#x2F;tactical advantage for any ongoing operations or as a backdoor installation for future operations, it&#x27;s anyone&#x27;s guess. If they did do that, we cannot be surprised because that is definitely their job. Thinking any other way is not part of the security mindset. It&#x27;s not the trust everyone kind of thinking that lead to discovery of this vulnerability in the first place.

Intel wanted to protect their customers before the US attacked them.

Didn&#x27;t a Google researcher identify the flaw in the first case? If Alphabet (aka, public-NSA) didn&#x27;t clue in the gov, I&#x27;d be incredibly surprised.

I would be very surprised if the NSA did not already know about these vulnerabilities. It&#x27;s unfortunate that we can&#x27;t count on the NSA doing the responsible thing for national security (which would be to notify Intel). But if these bugs were found by several independent researchers this year, it&#x27;s hard for me to believe that the NSA didn&#x27;t already find them. If they didn&#x27;t, they are falling down on the job.

With China being a much larger consumer than the U.S.[0], it is a logical decision to warn those first who would have a larger loss than others. Ultimately, by preventing China from gaining vulnerabilities, we in turn will help the U.S. in a greater sense by hopefully achieving a &gt;95% protection rate on chips.<p>&quot;In 2012, China consumed 33% of the world’s integrated circuits (i.e. microchips) while the US consumed only 13.5%&quot;<p>[0]<a href="https:&#x2F;&#x2F;qz.com&#x2F;72542&#x2F;china-just-surpassed-the-us-in-semiconductor-manufacturing-and-the-trend-is-likely-to-accelerate&#x2F;" rel="nofollow">https:&#x2F;&#x2F;qz.com&#x2F;72542&#x2F;china-just-surpassed-the-us-in-semicond...</a>

The HN policy of allowing paywalls with a bypass should really be changed to allowing links to the bypass: <a href="https:&#x2F;&#x2F;l.facebook.com&#x2F;l.php?u=https:&#x2F;&#x2F;www.wsj.com&#x2F;articles&#x2F;intel-warned-chinese-companies-of-chip-flaws-before-u-s-government-1517157430" rel="nofollow">https:&#x2F;&#x2F;l.facebook.com&#x2F;l.php?u=https:&#x2F;&#x2F;www.wsj.com&#x2F;articles&#x2F;...</a>

Paywall-free archived copy:<p><a href="https:&#x2F;&#x2F;archive.is&#x2F;stHQc" rel="nofollow">https:&#x2F;&#x2F;archive.is&#x2F;stHQc</a>

Surely no vulnerabilities should be disclosed to the US government earlier than the public because it does abuse them to hack people&#x27;s computers, and it doesn&#x27;t make its own systems that would need protecting any more than private companies do. It&#x27;s like giving a hacker group advanced notification.<p>Imagine the roles being reversed. Would we care if a Chinese chip maker notified Google before the Chinese government? I&#x27;m sure nobody on HN would be complaining. That makes it look like naive American-centrism.

So Intel knowingly ships faulty chips which smells of fraud and reveals a weakness in all of USA computers to another country which is known to employ cybercriminals ... how on earth do they get away scot free? No criminal charges?