The BSI has published a study on the possibilities for manipulating hardware in distributed manufacturing processes. It concerns hidden chips on hardware boards, so-called hardware Trojans.
The Federal Office for Information Security (BSI) commissioned the study “Examination of manipulation possibilities of hardware in distributed manufacturing processes (PANDA)”. This study examines the influence of attackers within the production chain of complex IT systems.
Advertising
Trojan as a chip on circuit boards
🔎 X-ray image of a component on a circuit board under which an additional chip has been hidden (enlarged on the right). This chip is very difficult to detect even with modern X-ray technology (Image: BSI).
The publication describes the individual steps from the initial idea to the finished product. Based on this, possible weak points in the chain are identified and selected attack scenarios are outlined. An evaluation of prevention and detection options is carried out not only on the basis of literature research, but also on the basis of specially conducted experiments. The study results show that such manipulations are possible in every phase of production, sometimes with relatively little effort. Detection, on the other hand, can be very demanding.
Nowadays, the development and production of complex IT systems is often no longer carried out by a single manufacturer who implements and controls all design and production steps themselves. This division of labor has clear advantages, such as a shorter time to market for products, lower costs and the bundling of skills and tools in specific areas of responsibility. However, this division also carries the risk of unwanted changes to the original design, which in the case of security-relevant products can lead to the loss of confidential data, for example.
Advertising
Subscribe to our newsletter now
Read the best news from B2B CYBER SECURITY once a month
Expand for details on your consent
It goes without saying that we handle your personal data responsibly. If we collect personal data from you, we process it in compliance with the applicable data protection regulations. Detailed information can be found in our Privacy Policy. You can unsubscribe from the newsletter at any time. You will find a corresponding link in the newsletter. After you have unsubscribed, your data will be deleted as soon as possible. Recovery is not possible. If you would like to receive the newsletter again, simply order it again. Do the same if you want to use a different email address for your newsletter. If you would like to receive the newsletter offered on the website, we need an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter. Further data is not collected or only collected on a voluntary basis. We use newsletter service providers, which are described below, to process the newsletter.
CleverReach
This website uses CleverReach to send newsletters. The provider is CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany (hereinafter “CleverReach”). CleverReach is a service that can be used to organize and analyze the sending of newsletters. The data you enter for the purpose of subscribing to the newsletter (e.g. email address) will be stored on the CleverReach servers in Germany or Ireland. Our newsletters sent with CleverReach enable us to analyze the behavior of the newsletter recipients. This can include It is analyzed how many recipients have opened the newsletter message and how often which link in the newsletter was clicked. With the help of so-called conversion tracking, it can also be analyzed whether a previously defined action (e.g. purchase of a product on this website) took place after clicking on the link in the newsletter. Further information on data analysis by CleverReach newsletter is available at: https://www.cleverreach.com/de/funktionen/reporting-und-tracking/. The data processing takes place on the basis of your consent (Art. 6 Para. 1 lit. a DSGVO). You can revoke this consent at any time by unsubscribing from the newsletter. The legality of the data processing operations that have already taken place remains unaffected by the revocation. If you do not want an analysis by CleverReach, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message. The data you have stored with us for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and deleted from the newsletter distribution list after you have canceled the newsletter. Data stored by us for other purposes remain unaffected. After you have been removed from the newsletter distribution list, your e-mail address may be stored by us or the newsletter service provider in a blacklist if this is necessary to prevent future mailings. The data from the blacklist is only used for this purpose and is not merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 Para. 1 lit. f GDPR). Storage in the blacklist is not limited in time. You may object to the storage if your interests outweigh our legitimate interest.
For more information, see the privacy policy of CleverReach at: https://www.cleverreach.com/de/datenschutz/.
Data processing
We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.
The study shows that the risks of manipulation in hardware production are real and significant. Attackers could compromise the integrity and security of IT systems by deliberately interfering with the manufacturing process. It is emphasized that a holistic security approach is necessary that takes all steps in hardware production into account.
More security: Recommended are, among others,
Stronger controls and security measures throughout the supply chain.
Use of advanced hardware Trojan detection techniques.
Implementation of prevention strategies such as split manufacturing.
Raising awareness and training of all stakeholders regarding security risks.
These measures can significantly reduce the risk of hardware manipulation, which makes a decisive contribution to the security of modern IT systems. The PANDA study thus provides a comprehensive overview of the threats and possible countermeasures in distributed hardware production and offers valuable recommendations for manufacturers and security officers.
About the Federal Office for Information Security (BSI)
The Federal Office for Information Security (BSI) is the federal cyber security authority and the creator of secure digitization in Germany. The guiding principle: As the federal cyber security authority, the BSI designs information security in digitization through prevention, detection and reaction for the state, economy and society.
Pearson, a global leader in education, was the victim of a cyberattack in which customer data was compromised. According to various media outlets, ➡ Read more
A new expert analysis of the North Korean APT group Void Dokkaebi reveals how the group deliberately uses Russian internet infrastructure to commit crypto thefts. ➡ Read more
The pre-installed ASUS DriverHub software contains a critical security vulnerability that allows remote code execution of malware. Due to the faulty checking of ➡ Read more
According to Symantec, the Play ransomware group and allied groups are using an exploit that targets the zero-day vulnerability CVE-2025-29824. The vulnerability was ➡ Read more
The CVE program, funded by the US government, is considered a crucial component in the global detection of software flaws. Now, funding is to be temporarily suspended. ➡ Read more
The BSI has issued a warning about F5 products, as they contain several highly dangerous security vulnerabilities that should be closed. The BIG-IP ➡ Read more
