Identifying Risky Counterfeit Intel Gigabit CT Network Adapters

Identifying Risky Counterfeit Intel Gigabit CT Network Adapters
servethehome.com

Even if it isn't a security risk from a data theft/malicious code standpoint, it could be substandard in quality and be exponentially more likely to fail.

A failure could just be an annoyance, taking Jim Bob's pornoputer off the home network and causing him to be unable to connect to the YouPorns until his nephew can come fix the boobie-box.

A failure however could take down a mission-critical computer in an emergency response center where even minutes could mean the difference in life or death for someone. Substandard components could also result in a fire, perhaps not in a NIC, but larger capacitors in something larger could overvolt and catch fire.

Worse, I've long had the thought that a hostile government could create ICs that effectively brick themselves when they receive a certain command. With a NIC, in theory, you could have the NIC radio home a small packet occasionally to report the IP. With the list of IPs you could very casually probe which of a handful of pre-determine ports are open, you could get tens of thousands, or even millions, of these chips in the wild looking perfectly normal just waiting for a command. Then say as a foreign government you want to launch an attack on the United States, you filter all the IPs in your database by location, which will remove the bulk of the machines in other countries from the list, and you have a bunch of servers in a bunch of countries get segments of the IP list and they start sending the kill signal at the same time (and if you get really crafty you make the compromised hardware actually start a timer before it bricks, so you can get the instruction out to as many as possible before the bricking causes widespread disruption of the internet). If you've waited long enough you'll have your trojan horse IC in businesses, homes, government offices of varying levels. If you manage to get even 100,000 taken offline, you've probably caused enough disruption to impact the NYSE as well as cause a good deal of disruption and mayhem. You may have even taken mission critical systems offline at power generation and transmission facilities. You've caused some economic damage at a minimum and based on how things go down you may have just made it much easier to launch a physical attack, especially if you have already trickled special forces soldiers into the country on tourists visas or via smuggling routes (United States special forces actually train to go into countries ahead of common forces to cause disruption and/or train local resistance) and can cause further disruption by causing mass panic with shootings/bombings/attacking first responders.

There is more to it than "oh someone can spy on my data now".