Why it is basically impossible to secure supply chains from attacks like the alleged Chinese embedded chip hack, and how we can mitigate the consequences
Brian Krebs / Krebs on Security :
Context & Ripple Effects
Brian Krebs' argument lands in the middle of an escalating arc: after reports of an alleged Chinese operation implanting malicious chips in server hardware, he concludes that fully securing a supply chain is essentially impossible and pivots to mitigation instead. The claim gains weight from Snowden documents showing that hardware supply chain compromise is standard state practice — undertaken by the US, France, Germany and China alike — meaning this is not one country's trick but a standing capability of intelligence services generally.
First-order effects
- Buyers of servers and networking gear are left with trust they cannot verify: inspection cannot practically rule out a compromised component, so procurement decisions shift from 'is it secure?' to 'how much damage can a compromise do?'
- Hardware vendors serving cloud and enterprise customers face heightened scrutiny of their manufacturing and assembly chains, with allegations alone — regardless of proof — capable of moving purchasing decisions.
Second-order effects
- Attackers rationally migrate toward cheaper, more repeatable surfaces than silicon: researchers soon tied backdoors planted in software update channels including CCleaner and Asus' update tool to a likely Chinese-speaking group, showing the same supply chain logic executed through code distribution rather than chips.
- Vendors of update infrastructure and firmware become de facto security perimeters for everyone downstream, forcing them to treat their own build and distribution pipelines as attack surface worth defending at national-security grade.
Third-order effects
- If hardware-level assurance stays out of reach, the durable response is architectural mitigation — segmentation, monitoring, blast-radius limits — rather than prevention, a doctrine later confirmed when experts judged the SolarWinds intrusion evidence that the US still has no good answer to supply chain attacks.
- As connected devices proliferate, the gap between unverifiable hardware and real-world consequences widens: the Internet of Things multiplies the number of physical systems whose integrity depends on supply chains nobody can fully audit.
The trend: Supply chain compromise is maturing from rare hardware implants into routine exploitation of software distribution, pushing defenders from a prevention posture toward containment and mitigation.