{"id":246,"date":"2025-09-30T13:27:45","date_gmt":"2025-09-30T13:27:45","guid":{"rendered":"https:\/\/haco.club\/?p=246"},"modified":"2025-09-30T13:27:45","modified_gmt":"2025-09-30T13:27:45","slug":"keynote-perspectives-on-trust-in-hardware-supply-chains","status":"publish","type":"post","link":"https:\/\/haco.club\/?p=246","title":{"rendered":"Keynote: Perspectives on Trust in Hardware Supply Chains"},"content":{"rendered":"\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Keynote: Perspectives on Trust in Hardware Supply Chains\" width=\"640\" height=\"360\" src=\"https:\/\/www.youtube.com\/embed\/Nv92TuocnwA?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p>This talk, titled &#8220;Keynote: Perspectives on Trust in Hardware Supply Chains&#8221; [<a target=\"_blank\" rel=\"noreferrer noopener\" href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=0\">00:00<\/a>] by Bunny Huang, discusses the complexities and vulnerabilities within hardware supply chains.<\/p>\n\n\n\n<p><strong>Key points from the talk include:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Diversification and Simplification:<\/strong> In chaotic times, it&#8217;s beneficial to diversify by having multiple, hyper-efficient locations rather than centralized single points of failure. Simplifying business processes and legal contracts can reduce complexity and improve understanding for everyone involved [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=144\" target=\"_blank\" rel=\"noreferrer noopener\">02:24<\/a>].<\/li>\n\n\n\n<li><strong>Trust in Hardware:<\/strong> The speaker suggests moving the &#8220;root of trust&#8221; or &#8220;source of truth&#8221; into hardware, such as using a USB Hardware Security Module (HSM) for DNSSEC keys. This increases integrity and simplifies recovery in case of a compromise [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=193\" target=\"_blank\" rel=\"noreferrer noopener\">03:13<\/a>].<\/li>\n\n\n\n<li><strong>Economic Incentives in Supply Chain Attacks:<\/strong>\n<ul class=\"wp-block-list\">\n<li><strong>Software vs. Hardware Profitability:<\/strong> Software typically has a negative profitability curve initially, requiring volume and network effects to become profitable, while hardware is most profitable from the first unit sold [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=530\" target=\"_blank\" rel=\"noreferrer noopener\">08:50<\/a>].<\/li>\n\n\n\n<li><strong>Malware as a Scale Play:<\/strong> Software malware aims for &#8220;break once, run everywhere&#8221; exploits, impacting millions of devices [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=615\" target=\"_blank\" rel=\"noreferrer noopener\">10:15<\/a>].<\/li>\n\n\n\n<li><strong>Hardware Attacks as Simpler Fraud:<\/strong> The majority of hardware threat actors are focused on simpler, more profitable attacks like warranty fraud, rather than high-end exploits [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=694\" target=\"_blank\" rel=\"noreferrer noopener\">11:34<\/a>].<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Warranty Fraud Example (iPhone 6 Error 53):<\/strong> A detailed example of warranty fraud involved exploiting a manufacturing defect (Error 53) in iPhone 6 devices. Attackers would trigger the error, assemble &#8220;Franken-phones&#8221; from scrap parts, and return them for new ones, leading to billions of dollars in losses for Apple [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=1186\" target=\"_blank\" rel=\"noreferrer noopener\">19:46<\/a>].<\/li>\n\n\n\n<li><strong>E-waste Mining:<\/strong> People actively &#8220;mine&#8221; e-waste for spare parts, turning discarded electronics into valuable inventory. This demonstrates the &#8220;nothing goes to waste&#8221; ethos in the ecosystem [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=892\" target=\"_blank\" rel=\"noreferrer noopener\">14:52<\/a>].<\/li>\n\n\n\n<li><strong>Re-labeled Production Parts:<\/strong> The speaker experienced an issue where 3% of FPGAs they purchased were engineering samples (free, not production-rated) that had been re-labeled and blended into the supply chain, increasing distributor profits by 60% [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=1886\" target=\"_blank\" rel=\"noreferrer noopener\">31:26<\/a>]. This highlights that hardware threats are dynamic and localized.<\/li>\n\n\n\n<li><strong>Spectrum of Fakes:<\/strong> Hardware authenticity exists on a spectrum, from total fakes to re-labeled genuine parts and &#8220;ghost shifting&#8221; (workers manufacturing extra parts after hours on official lines) [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=2004\" target=\"_blank\" rel=\"noreferrer noopener\">33:24<\/a>].<\/li>\n\n\n\n<li><strong>Challenges in Detection:<\/strong> Current methods for detecting hardware attacks are generally undeveloped. Most companies only perform label checks, and those who do more advanced checks often don&#8217;t admit to it due to competitive pressures [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=2923\" target=\"_blank\" rel=\"noreferrer noopener\">48:43<\/a>].<\/li>\n\n\n\n<li><strong>Advanced Chip-Level Threats:<\/strong>\n<ul class=\"wp-block-list\">\n<li><strong>Level 1 (Modified Network Interface Chip):<\/strong> Detectable with $1,000-$10,000 tools, involves adding a small Trojan to a chip to exfiltrate data. This can be done relatively cheaply using open-source IP blocks [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=2357\" target=\"_blank\" rel=\"noreferrer noopener\">39:17<\/a>].<\/li>\n\n\n\n<li><strong>Level 2 (Modified CPU Pipeline):<\/strong> Requires $10,000-$100,000 tools, involving small logic changes (10-100 logic cells) within a CPU to bypass memory protection [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=2494\" target=\"_blank\" rel=\"noreferrer noopener\">41:34<\/a>].<\/li>\n\n\n\n<li><strong>Level 3 (Reduced Round Cryptography):<\/strong> Extremely difficult to detect, involving a single via edit in a chip to reduce the rounds in a cryptographic algorithm (e.g., AES), effectively weakening it without changing timing or power side channels [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=2652\" target=\"_blank\" rel=\"noreferrer noopener\">44:12<\/a>]. There are no known mass-deployable non-destructive methods for detecting this.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Future Concerns:<\/strong> The speaker warns that as counter-measures improve and economic landscapes change (e.g., a bust in the chip industry), sophisticated supply chain attacks on chips may become more prevalent [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=3124\" target=\"_blank\" rel=\"noreferrer noopener\">52:04<\/a>].<\/li>\n\n\n\n<li><strong>Possible Defenses:<\/strong> While currently undeveloped, defenses are possible. The speaker is researching infrared in-situ verification of silicon [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=2989\" target=\"_blank\" rel=\"noreferrer noopener\">49:49<\/a>], which could allow inspection of chips after they are attached to a circuit board without damage. He advocates for open-source hardware and a &#8220;full stack collaboration&#8221; to enable inspectability [<a href=\"http:\/\/www.youtube.com\/watch?v=Nv92TuocnwA&amp;t=3225\" target=\"_blank\" rel=\"noreferrer noopener\">53:45<\/a>].<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>This talk, titled &#8220;Keynote: Perspectives on Trust in Hardware Supply [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[4,5,33],"class_list":["post-246","post","type-post","status-publish","format-standard","hentry","category-black-hat","tag-hardware","tag-security","tag-supplychain"],"_links":{"self":[{"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/posts\/246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/haco.club\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=246"}],"version-history":[{"count":1,"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/posts\/246\/revisions"}],"predecessor-version":[{"id":247,"href":"https:\/\/haco.club\/index.php?rest_route=\/wp\/v2\/posts\/246\/revisions\/247"}],"wp:attachment":[{"href":"https:\/\/haco.club\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/haco.club\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/haco.club\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}