Bottom line: It is going to be time consuming and expensive for Super Micro to run its own investigation looking for tiny spy chips allegedly implanted on boards through a sophisticated supply chain compromise. If the investigation is successful, the only key takeaway will be finding nothing malicious.
As the speculation continues over Bloomberg's report of small malicious chips found by Apple and Amazon, Super Micro has sent out letters to its customers informing them of an ongoing internal investigation. Although the company still denies any compromise has been made, it will still perform due diligence in confirming that no such hardware modifications have been made.
Up until now, all parties accused of being involved have vehemently denied that any evidence has been found. Apple CEO Tim Cook even said, "They need to do that right thing and retract it." US intelligence officials have also not found any evidence to corroborate the story.
Despite the complete lack of evidence found so far, Bloomberg is sticking to its story. Super Micro did not say how long its own investigation would take nor when it will reveal its findings.
In addition to sending a letter to customers, Super Micro also sent letters to Senators Marco Rubio and Richard Blumenthal. The letter to Congress states that Super Micro "has seen no evidence of any unauthorized components," and that "a more detailed response," will be issued later this week.
One of the issues with this accusation is that it is inherently difficult to disprove the existence of a bug. It is reasonably easy to verify that all components on a board match a schematic that has been approved by a design engineer, but when the issue is with the design itself nearly any component can be a suspect.
Short of going through every product piece by piece, Super Micro is going to have a lot of work cut out that is not intended to find anything at all.