Skip to content
0:00 / 0:00

#supplychainsecurity#hardwarebackdoor#bunniehuang

BlueHat IL 2019 - Andrew "bunnie" Huang - Supply Chain Security: "If I were a Nation State...”

Microsoft Israel R&D Center

3.7K subscribers • 2 videos on Hallway

YouTube
  • Recommended by 7 people: 6 on Hacker News and 1 on Lobsters.
  • A classic. People kept recommending it from 2019 to 2024.
  • Presented by Andrew 'bunnie' Huang

Intermediate. Assumes working knowledge.

20K views7 years ago7 recommendations

SecurityHardwareWeb and application securityExploits and vulnerabilitiesElectronics

Andrew 'bunnie' Huang analyzes the feasibility of hardware supply chain attacks and explains how undocumented components can be hidden on boards.

Where did your computer come from? How many hands could have touched your machine before you powered it on for the first time? They say it takes a village to raise a child; it takes several countries to build a cutting-edge computer. Last October, a report released by Bloomberg Business Week dramatized the security risks incurred by our increasingly global supply chains. Although many details of the report have failed to hold up under scrutiny, the basic scenario is realistic. In this talk, we will calibrate expectations about how difficult (or easy) it may be for actors ranging from rogue individuals to Nation-States to infiltrate various points of our global supply chain.

Why it's here

7 people recommend this

What people say. Recommended as an eye-opening and highly credible explanation of hardware supply chain security risks and detection difficulties.

crimsontechon Hacker News • Recommends

On “Paragon Graphite is a Pegasus spyware clone used in the US”

It would really need to go further than that. Supply chain attacks at the hardware level are very difficult to spot, especially at scale. This is an eye opening talk in the subject: link to this video

segmondyon Hacker News • Recommends

On “Recruit Is Japan’s Top Contender for Global Internet Domination”

Hey, folks thought Echelon was a joke in the 90's until Snowden showed that Echelon is child's play. The Big Hack might be true or not, but it's not far fetched. There might be more at play here. Watch this link to this video

brudgerson Hacker News • Recommends

On “Elon Musk Tried to Destroy a Tesla Whistleblower”

I found Bunnie Huang's talk on supply chain security a reasonable picture of the issues underlying the Bloomberg story. link to this video With the caveat that I find Bunnie Huang credible. link

pdkl95on Hacker News • Recommends

On “Intel x86 Root of Trust: Loss of Trust”

Bribing Intel employees is probably expensive and might have legal risks. Instead, just hire one of the many skilled technicians in Shenzhen. For a good discussion of this topic, I recommend Andrew "bunnie" Huang's talk about supply chain security: link to this video

bskrobiszon Hacker News • Recommends

On “Juniper breach mystery starts to clear with new details on hackers and U.S. role”

>when one would simply need a microscope to find them in devices This isn't a true statement, if strictly read--there are many techniques to hide undocumented components on boards, and covering all of them requires more than just a pass under a SEM. There's a fun talk that goes over a lot of them here: link to this video

andutuon Hacker News • Recommends

On “Verifying Hardware Security with RTL Simulation”

Somewhat related, but there is a great talk by Andrew "bunnie" Huang on hardware supply chain security: link to this video

latteraon Lobsters • Recommends

Supply Chain Security: "If I were a Nation State..."