> We should all be paying attention to hardware suppliers and making sure that objects are "as-ordered", but today even a standard chip packaging can hide a ton of malicious logic.
For smartphones, laptops and PCs that is relatively easy to defend against if you think you might be a target for three-letter agencies - just walk into a computer store and buy what they have on the shelf with cash. Even the NSA doesn't have the resources to intercept and modify all the shipments to Apple, Best Buy, Costco and whatnot - and I'd guess at least Apple has pretty strict security in their supply chain given that Apple stuff has insane value even just for parts if someone were to intercept a delivery.
Network architecture however, that is more complex. Cables, Ubiquiti, HP and Dell stuff, you can buy that off the shelf, so same advantage. But servers? Good luck finding ones on the shelf anywhere.
> Even the NSA doesn't have the resources to intercept and modify all the shipments
Your words are close to truth, but not equal to it. I don't know exact resources of NSA, but I know businesses in exUSSR, who done exactly what you say with smartphones and audio/video.
This was grey scheme of import, with which imported more then 90% of tech in these countries, and this was reason, why Sony was condemned in Russia in 90s "for extremely low quality" (because local Sony representatives participated in scheme and central office closed eyes on this).
So, in Eastern Europe that time existed zero import taxes for electronics. They imported electronics, disassembled it to parts, and exported to exUSSR as garbage; then these parts reassembled in garages and sold in ordinary shops as new devices.
As I said, more then 90% reassembled, only less than 10% imported as ordinary contraband, or officially imported.
For scale, as I remember, US have about 300mln population, Russia have 140mln, approx half (sure, Russians have much less purchasing power, but it is hard to estimate now, if may help, Russia GDP is very close to Italy with about 59mln population).
> Apple has pretty strict security in their supply chain
Must admit, Apple have better security than other manufacturers, but grey iPhones still sold in Russia, so real hackers found ways.
For smartphones, laptops and PCs that is relatively easy to defend against if you think you might be a target for three-letter agencies - just walk into a computer store and buy what they have on the shelf with cash. Even the NSA doesn't have the resources to intercept and modify all the shipments to Apple, Best Buy, Costco and whatnot - and I'd guess at least Apple has pretty strict security in their supply chain given that Apple stuff has insane value even just for parts if someone were to intercept a delivery.
Network architecture however, that is more complex. Cables, Ubiquiti, HP and Dell stuff, you can buy that off the shelf, so same advantage. But servers? Good luck finding ones on the shelf anywhere.