[Cryptography] "Planting tiny spy chips in hardware can cost as little as $200"

[Jerry Leichter]

About a year after the widely-criticized Bloomberg reports of chip attacks on Supermicro motherboards ... two different proof-of-concept demonstrations that such attacks are feasible and don't even require huge amounts of money.

"Elkins and Hudson both emphasize that their work isn't meant to validate Bloomberg's tale of widespread hardware supply chain attacks with tiny chips planted in devices. They don't even argue that it's likely to be a common attack in the wild; both researchers point out that traditional software attacks can often give hackers just as much access, albeit not necessarily with the same stealth.

But both Elkins and Hudson argue that hardware-based espionage via supply-chain hijacking is nonetheless a technical reality, and one that may be easier to accomplish than many of the world's security administrators realize. "What I want people to recognize is that chipping implants are not imaginary. They’re relatively straightforward," says Elkins. "If I can do this, someone with hundreds of millions in their budget has been doing this for a while.""

https://arstechnica.com/information-technology/2019/10/planting-tiny-spy-chips-in-hardware-can-cost-as-little-as-200/

                                                        -- Jerry