It's rather easy for someone to mislead a BP reporter who understands little about the technical details but is very eager to publish something shocking.
The reporter may have emailed a few dozen security researchers to verify the story, but those who don't believe in the story are less likely to reply (and the reporter is more likely to ignore them), leading to a sampling bias.
And/or the people who did reply gave a response of something along the lines of “Its technically possibly but...” and the author ignored everything after the but.
I see how this could have happened yes. Especially if the reporter was not clear on the angle of the questions.
It's easy to see how security researchers could go off on a tangent about the insecurities of IMPI and other out of band management systems. Which'd sound like an endorsement to the reporter.
TBH if you’re talking to a reporter, thats a bad way to answer a question. “It’s technically possible” is the sort of sound bite someone will grab while ignoring the 5 minute spiel on IPMI and bus interfaces etc. that follows. Be very careful about giving short quotable statements in plain English that you don’t want to see in print.
That's fair, I think it's also fair to point out that the people with the technical know-how about these things aren't often talked to by the press. I mean how many stories do you see about hardware tampering like this? They might not be very well versed in how to communicate with them. Also I know that I have a tendency to enjoy talking through possibilities and scenarios and so could see myself (I'm not a hardware or security expert at all but the points stands) discussing at length how such a thing COULD work and just being excited to talk about a field I am well versed in. A reporter could then take that as my signing off on that it DID happen.
It’s definitely a skill. I’ve caught myself saying something juicy that was off on a tangent or a bit misleading. Usually I’ll realize it and ask the reporter not to use it and they’ll honor that.
But, yes, even reporters that you know want to write a story that will be interesting to readers. As a source, feel free to provide educational background but be really careful about speculating about things if you don’t want that speculation in print.
An on the record conversation isn’t the same as an informal background chat with the same person over drinks. And I’m a bit careful even then.
The reporter may have emailed a few dozen security researchers to verify the story, but those who don't believe in the story are less likely to reply (and the reporter is more likely to ignore them), leading to a sampling bias.