BlueHat IL 2019 - Andrew "bunnie" Huang - Supply Chain Security: "If I were a Nation State...”
Microsoft Israel R&D Center6 HN recommenders · recommended in 6 months, 2019–2024
talk · intermediate · evergreen · 2019–2024 on HN
Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to…
HN people point to it as the sober, technically grounded picture of hardware supply chain security, and an eye-opening one.
Up next
3 mo on HNScientific Studies: Last Week Tonight with John Oliver (HBO)
LastWeekTonight
3 HN recommender · 2016–2019
3 mo on HNThe Fall of The Simpsons: How it Happened
Super Eyepatch Wolf
9 HN recommender · 2017–2026
14 mo on HNLEADERSHIP LAB: The Craft of Writing Effectively
UChicago Social Sciences
15 HN recommender · 2019–2026
6 mo on HNRailsConf 09: Robert Martin, "What Killed Smalltalk Could K
O'Reilly
5 HN recommender · 2012–2026
8 mo on HNDebt: The First 5,000 Years | David Graeber | Talks at Google
Talks at Google
8 HN recommender · 2013–2024
1 mo on HNThe Computer Programme (1): It's Happening Now (Introduction to Computing)
Jesús Zafra (Lobogris)
1 HN recommend · 2014–2025
9 mo on HNLiterate Devops with Emacs
Howard Abrams
8 HN recommender · 2015–2025
1 mo on HNMIX08 Microsoft Office 2007: The Story of the Ribbon (1 of 10)
creativecrewchannel
1 HN recommend · 2011–2020
11 mo on HNBehind the Scenes of iOS Security
Black Hat
9 HN recommender · 2016–2026
11 mo on HNWhy Electronic Voting Is Still A Bad Idea
Tom Scott
11 HN recommender · 2020–2026
10 mo on HNUSENIX Security '18-Q: Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible?
USENIX
10 HN recommender · 2018–2026
10 mo on HNDefcon 18 Changing threats to privacy Moxie Marlinspike Part
killab66661
6 HN recommender · 2012–2019
6 comments from Hacker News
It would really need to go further than that. Supply chain attacks at the hardware level are very difficult to spot, especially at scale. This is an eye opening talk in the subject: ▶ this video
Somewhat related, but there is a great talk by Andrew "bunnie" Huang on hardware supply chain security: ▶ this video
>when one would simply need a microscope to find them in devices This isn't a true statement, if strictly read--there are many techniques to hide undocumented components on boards, and covering all of them requires more than just a pass under a SEM. There's a fun talk that goes over a lot of them here: ▶ this video
Bribing Intel employees is probably expensive and might have legal risks. Instead, just hire one of the many skilled technicians in Shenzhen. For a good discussion of this topic, I recommend Andrew "bunnie" Huang's talk about supply chain security: ▶ this video
I found Bunnie Huang's talk on supply chain security a reasonable picture of the issues underlying the Bloomberg story. ▶ this video With the caveat that I find Bunnie Huang credible. link
Hey, folks thought Echelon was a joke in the 90's until Snowden showed that Echelon is child's play. The Big Hack might be true or not, but it's not far fetched. There might be more at play here. Watch this ▶ this video