HackerTube

BlueHat IL 2019 - Andrew "bunnie" Huang - Supply Chain Security: "If I were a Nation State...”

Microsoft Israel R&D Center6 HN recommenders · 2019–2024
21K views · talk · evergreen · Uploaded 2019-02-14

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

HN people point to it as the sober, technically grounded picture of hardware supply chain security, and an eye-opening one.

Security & hackingElectronics & circuit design

Watch on YouTube

6 comments from Hacker News

@segmondy2019 · in “Recruit Is Japan’s Top Contender for Global Internet Domination”

Hey, folks thought Echelon was a joke in the 90's until Snowden showed that Echelon is child's play. The Big Hack might be true or not, but it's not far fetched. There might be more at play here. Watch this [VIDEO]

RecommendsView on HN
@brudgers2019 · in “Elon Musk Tried to Destroy a Tesla Whistleblower”

I found Bunnie Huang's talk on supply chain security a reasonable picture of the issues underlying the Bloomberg story. [VIDEO] With the caveat that I find Bunnie Huang credible. [LINK]

RecommendsView on HN
@pdkl952020 · in “Intel x86 Root of Trust: Loss of Trust”

Bribing Intel employees is probably expensive and might have legal risks. Instead, just hire one of the many skilled technicians in Shenzhen. For a good discussion of this topic, I recommend Andrew "bunnie" Huang's talk about supply chain security: [VIDEO]

RecommendsView on HN
@bskrobisz2021 · in “Juniper breach mystery starts to clear with new details on hackers and U.S. role”

>when one would simply need a microscope to find them in devices This isn't a true statement, if strictly read--there are many techniques to hide undocumented components on boards, and covering all of them requires more than just a pass under a SEM. There's a fun talk that goes over a lot of them here: [VIDEO]

RecommendsView on HN
@crimsontech2023 · in “Paragon Graphite is a Pegasus spyware clone used in the US”

It would really need to go further than that. Supply chain attacks at the hardware level are very difficult to spot, especially at scale. This is an eye opening talk in the subject: [VIDEO]

Strongly recommendsView on HN
@andutu2024 · in “Verifying Hardware Security with RTL Simulation”

Somewhat related, but there is a great talk by Andrew "bunnie" Huang on hardware supply chain security: [VIDEO]

RecommendsView on HN