Also, some technical detail about what a chip with three pins can do. Was it working with another chip? Enabling intelME? There's just not a ton you can do with chip of that size.

Is the story that the board had an extra undocumented chip, or that the chip was used to exfiltrate data?

A 3 pin chip could talk over i2c:

1 pin for GND, 1 pin for CLK and 1 pin for data.

Where is VCC coming from? Via pull-up resistors connected to the data line and capacitance.

I’ve seen MCUs run without direct VCC connections under these circumstances.

Either that or the chip is connected to VCC and a PCB ground plane on the other side of the chip.

Edit: boards are often sandwiched between VCC and GND layers. One could have a functioning device with just a few obvious “pins”/“leads”.

I'm not saying they can't do anything with a three pin chip, just that this was pretty short on tech details. That's (probably) not the kind of chip you'd be using to parse network traffic on a 10G link and upload secrets. Maybe a key logger, but I don't imagine apple or amazon having a keyboard plugged into very many of their servers.

If they had come out and said, this is what this chip does, this is how it interacts with the rest of the board, or it phones home to x.y.z or something, I'd be a lot more convinced. As it is, the technical evidence is a little light as are the sources. So I think I'll hold on conclusions until we get some more info about what they think the chip was doing.

It is the kind of chip that could insert malicious bytes into an I2C or SPI line though, for example the line that the BMC loads its ROM over at boot.

wow, just a 3 pin chip? I agree, that is fairly limiting.

but we don't know what it was doing, maybe the back door is else where in the motherboard and this things job is to prop the back door open every now and then.

The pictures in the original article shows 6 pins