Korea on alert over China's 'spy microchip'

By Jun Ji-hye

Concerns are growing here over the possible leaking of the country's industrial technologies and other critical intellectual properties to China amid a controversy over a Chinese military unit's alleged installation of tiny microchips into computer servers of almost 30 U.S. companies, including Amazon and Apple.

The allegedly compromised hardware was sold by California-based Supermicro Computer, one of the world's biggest suppliers of server motherboards, according to Bloomberg Businessweek.

Servers from Supermicro, the Taiwanese-American founded IT firm, are also widely used in Korea by state-run research institutes, including the Electronics and Telecommunications Research Institute (ETRI) and the Korea Aerospace Research Institute (KARI), as well as financial institutions and large companies such as Samsung and LG.

The tiny chips, which were reportedly developed by a computer attack unit of the People's Liberation Army, were installed in the motherboards of servers on a production line in China.

The Bloomberg report said, “China's spies appear to have found a perfect conduit for what U.S. officials now describe as the most significant supply chain attack known to have been carried out against American companies.”

This raised the suspicion that the chips have been used to collect intellectual properties and trade secrets of American companies.

A number of Korean companies and institutions have been using Chinese IT products as they are believed to be cost effective.

Analysts said if high-level information on patents and other industrial technologies were extracted, the damage would be significant.

The news comes at a time when security concerns surrounding fifth-generation (5G) network equipment made by Chinese firm Huawei have become a hot potato here as Korean telecom companies are working to select 5G partners ahead of the launch of the world's first commercial service in March next year.

SK Telecom already excluded Huawei, naming Samsung Electronics, Ericsson and Nokia as the suppliers for its network equipment, while KT and LG Uplus have yet to announce their partners.

Lim Jong-in, a professor at the Graduate School of Information Security at Korea University, said the alleged link between the Chinese government and Supermicro is expected to have a huge impact globally.

He said even if companies have been compromised, there is a serious possibility for them not to have been aware of this.

“Korea has been largely depending on China in the IT area. It would be difficult to refuse to use Chinese products unconditionally without finding clear evidence,” he said. “But if Korea continues to use Chinese products, the nation would lose its credibility with the United States and other countries.”

Lim said the country needs to nurture its own capability to detect any kinds of cyberattack, adding that pan-governmental cooperation is necessary.

“Companies also need to consider consumer protection when choosing partners, rather than considering the price issue only,” he said.

Meanwhile, Supermicro strongly refuted the reports that the servers it sold to customers contained malicious microchips in their motherboards.

“Supermicro has never been contacted by any government agencies either domestic or foreign regarding the alleged claims,” it said in a statement. “Supermicro takes all security claims very seriously and makes continuous investments in the security capabilities of their products. The manufacturer of motherboards in China is not unique to Supermicro and is a standard industry practice.”