Concern About Counterfeit Hardware Grows
Take a walk down Canal St. in New York City and you won't get a few feet before being offered Gucci, Prada and Channel handbags or DVDs with just released to theaters hit movies. Of course these are rip off copies and if you didn't know it before then the fact that the vendor keeps his goods in a large suitcase and constantly scans the street for police should give it away. It's not always so easy to spot counterfeit hardware and if you could, it's harder to know if is harboring malware or a backdoor.
The New York Times is reporting today on a FBI investigation into counterfeit network hardware:
The new law enforcement and national security concerns were prompted by Operation Cisco Raider, which has led to 15 criminal cases involving counterfeit products bought in part by military agencies, military contractors and electric power companies in the United States. Over the two-year operation, 36 search warrants have been executed, resulting in the discovery of 3,500 counterfeit Cisco network components with an estimated retail value of more than $3.5 million, the F.B.I. said in a statement.
No malicious code or changes to hardware were found but the Pentagon is concerned enough to conduct a test by planting their own Trojans in hardware distributed to military contractors working on the Trusted Integrated Circuits program to see how well the tampering can be detected.
A real concern is that the hardware supply chain becomes compromised and that even Trusted Computing Platform (TCP) devices can be corrupted before they reach the end user. We've recognized over the past several years that distributed applications have punched so many holes in network perimeters that the blocking functions the perimeter once served can no longer be taken for granted. Counterfeit hardware could become such a problem that the idea of starting with a secure, new device can no longer be taken for granted either. We're not there yet but this is just one more topic to watch.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
