hardware implant
termnetworking
Something added to a device during manufacture or transit that the buyer cannot see and the vendor may not know about.
Most of this catalogue's supply chain cases carry an information payload: a beacon in a router, a backdoor in a library, a rootkit in a controller. The mechanism does not require that. On 17 and 18 September 2024 thousands of pagers and hundreds of radios carried by members of Hezbollah detonated across Lebanon and Syria; 42 people were reported dead by 22 September, at least 12 of them civilians, with thousands injured across 150 hospitals. UN human rights experts condemned the attacks as potential war crimes, holding that the indiscriminate nature of simultaneous detonations breached international law; Israel's president denied involvement. The commercial detail is the transferable one. The brand on the pagers was licensed: a Taiwanese firm said the model was designed, made and sold by a Budapest company under a trademark agreement, and that the devices used a chip it does not use. The name on a product and the maker of a product are routinely different entities, entirely lawfully, and a buyer inspecting the label learns nothing about either. An implant can also lie dormant for years and wake on a message, which is a property it shares with software - the difference is only in what the payload does.
Also known as: implant, supply chain implant, physical supply chain attack
Sources
- Reporting on 17 and 18 September 2024: thousands of pagers and hundreds of walkie-talkies carried by members of Hezbollah detonated across Lebanon and Syria; by 22 September 42 people had died, including at least 12 civilians, with thousands injured and victims received at 150 hospitals. UN human rights experts condemned the attacks as potential war crimes, stating that while some victims may not have been civilians, the indiscriminate nature of the simultaneous explosions violated international law and the right to life; Israeli President Isaac Herzog denied Israeli involvement on 22 September
- Gold Apollo, the Taiwanese company whose brand appeared on the AR-924 pagers, stated that the model was produced and sold by BAC Consulting of Budapest under a trademark licence and that it had no involvement in the design or manufacture; its chairman said the devices were entirely different from Gold Apollo's own designs and used a chip the company does not use. Hungary's civilian domestic intelligence agency stated that the pagers never entered Hungarian territory and that no Hungarian company or specialist was involved in producing or modifying them
- Deepa Kundur, professor of electrical and computer engineering at the University of Toronto, described the method as a supply chain deployment in which a perpetrator infiltrates the upstream supply chain to manufacture a critical component with a built-in explosive charge without the final vendor knowing; the component can sit in a device for months or years before detonating on receipt of a message