1/ We can see flaws in the Bloomberg story even if can't verify the truth.
2/ Not only is Bloomberg overly relying upon anonymous sources, they aren't even first hand sources, or secondhand, but people vaguely "brief" on the subject. At this point, it's rumor in the intelligence community they are passing along. 
3/ What's important about this is that whenever you pass technical details through multiple layers of non-techies, they get garbled. There may be something true about this story that's still unrelated to translated version in the story.
4/ We can see that the story is sensationalizing it, sexing up the story by focusing on the size of the chips. Computer chips are typically small, even when contained in big packages for heat dissipation and pincount.
5/ The forceful responses from Apple and Amazon specifically contradict some of the claims made by Bloomberg.
apple.com/newsroom/2018/…
aws.amazon.com/blogs/security…
apple.com/newsroom/2018/…
aws.amazon.com/blogs/security…
6/ When the story attempts technical details, they are garbled beyond all recognition. I'm an expert in this area and I have no idea what this means. "Altering the order of instructions"???????
7/ Instead, we have to work backwards. Ah! It's just a different firmware for the BMC that downloads more code from the Internet. If that's the case, whatever they meant about "altering the order of instructions" is clearly false.
8/ This is what I mean by "layers of non-technical" people that garble such stories. Even if we don't know the ultimate truth of the claim "Chinese intelligence replaced chips", we know there are false things in the story.
9/ BTW, hacking the "BMC firmware" in servers isn't a new concept but one that goes back a decade. If you were to tell me a server had a chip replaced, the it's the first thing I'd guess as to which chip was replaced.
10/ I mention this because this story sounds like confirmation bias, starting with the theory of a hack first, then looking backwards for anything that might justify the theory.
11/ BTW, at some point I'm going to write "baseband management controller" and not "baseboard", because I'm bad at typing and my brain don't work. I mean "baseboard" for servers, but "baseband" is the other archetypal hack for phones, so I make this mistake.
