supply chain attack

Andrew "bunnie" Huang examines how realistic hardware supply chain attacks are, from rogue insiders to nation states, in the wake of the Bloomberg Businessweek report. He explains how undocumented components could be hidden on boards and how hard they are to spot.

A 36C3 talk by Bunnie Huang arguing that open source is necessary but not sufficient for trustworthy hardware, because verifying hardware is destructive and so creates a time-of-check/time-of-use gap. It surveys supply chain security and classes of hardware attacks, and presents the Betrusted approach to narrowing that gap.

A two-minute clip of Andreas Antonopoulos explaining why a 51% attack on Bitcoin would not destroy it and what such an attack would cost. It is a succinct take on mining security.

James Mickens of Harvard gives a funny lecture at HBS's Future Assembly arguing that blockchains are a very bad idea. He covers their trust, legal and practical shortcomings for real-world problems.

Andreas Antonopoulos explains how to tell Bitcoin-style blockchains from corporate blockchain hype. He argues the goal should be de-banking everyone rather than banking the unbanked.

Anders Brownworth gives a basic visual introduction to blockchain using an interactive web demo, covering SHA256 hashes, blocks, chains, distribution, tokens and coinbase transactions.

The opening lecture of MIT's Blockchain and Money course taught by Gary Gensler, covering the course plan, the history of failed digital currencies, cryptography and what a blockchain is.

Wendover Productions explains the wave of supply shortages in 2021, arguing the causes go beyond COVID. It covers how just-in-time manufacturing was applied, container imbalances and the chip shortage.

A 35C3 talk presenting a proof-of-concept SPI bus hardware implant with capabilities like those alleged in the Bloomberg Supermicro story, plus countermeasures for detecting such modchips.

Veritasium tells the story of the XZ backdoor, how a patient attacker became maintainer and nearly compromised SSH on Linux systems. It also covers free software history and how encryption in SSH works.

Asianometry explains that the worst of the 2021-22 chip shortage sits in trailing-edge semiconductors, not the leading-edge chips usually covered. It covers why those older-node fabs are so hard to expand and fix.

A short Princeton CITP video describing cold boot attacks, where encryption keys remain in DRAM after power loss and can be recovered. It covers the attack against disk encryption such as BitLocker, FileVault and TrueCrypt.

Ian Miers' Devcon4 talk on failures in on-chain privacy for Bitcoin and Ethereum. It covers attacks on transparent and decoy-based schemes, including how Monero-style privacy can be eroded over repeated transactions.

Rory McCune's AppSec EU 2015 talk on security risks in modern software deployment. It covers weaknesses in package ecosystems like npm, RubyGems and PyPI, and repository compromise.

Peter Zeihan speaks at Iowa Swine Day 2022 on geopolitics, the end of globalization and agriculture. He argues that supply chains, energy and farm inputs are all about to be disrupted.

3Blue1Brown explains the math and mechanics behind Bitcoin visually: ledgers, digital signatures, proof of work and the blockchain, building up a decentralized payment system from first principles.

Microsoft's Tony Chen explains how the Xbox One was designed to resist physical attacks, including secure boot, encrypted memory, a security processor and a hypervisor. The goal was to make any hardware attack cost more than the price of many games.

Destin Sandlin of Smarter Every Day tries to manufacture a grill scrubber entirely in the United States. Along the way he runs into missing supply chains, tooling and institutional manufacturing knowledge.

A 38C3 talk on how advanced chips are made, centered on EUV lithography and the global supply chain behind it. It covers technical challenges from raw materials to finished chips and the geopolitical weight of semiconductors.

A short Harvard Online animated lesson on how the mitochondrial electron transport chain works. It shows proton pumping and the machinery that drives ATP synthesis.

Tony Chen of Microsoft explains at BlueHat Seattle 2019 how the Xbox One was designed to resist physical attacks. He covers the security design and hypervisor-based OS architecture that kept the console uncracked for years.

A 37C3 talk by Kaspersky researchers on Operation Triangulation, a zero-click iPhone attack that targeted their own colleagues. They describe capturing every stage of the chain, four zero-days and a previously unknown spyware active for years.

Designer Thomas Thwaites describes his attempt to build a toaster from scratch, from mining ore and deriving plastic from oil. It is a short TED talk on how much civilization a simple object depends on.

Big Clive takes apart an IKEA Koppla USB power supply to assess its safety, looking at isolation and transformer construction.

A two-minute clip in which Milton Friedman uses a humble pencil to show how thousands of strangers across many countries cooperate, without central direction, to make a simple product. It is a short visual version of the 'I, Pencil' essay's argument about free markets and dispersed knowledge.

A Veritasium video on how a feud between Russian mathematicians led to Markov chains and the modern prediction algorithms built on them. It covers the history and the math behind them.

Footage of the 2007 Aurora test, in which a cyberattack was used to destroy a large generator at a test facility in Idaho.

TheRasteri upgrades a single PC through every Windows version, from early releases through Windows 10, testing that old software keeps running. It is an updated version of the Chain of Fools experiment.

Microsoft engineers Chiara Mooney and Shiven Mian describe the journey and challenges of building and consuming React Native for Windows inside Microsoft. It was given at Chain React 2023.

Apple security head Ivan Krstic gives a Black Hat 2016 talk on iOS security, covering HomeKit, Auto Unlock and iCloud Keychain. He explains key hierarchies and how data can stay safe even in adversarial clouds.

Tom Scott explains why electronic voting is a bad idea. Elections must be trusted by everyone and attacks on software scale in ways attacks on paper do not, so open source or blockchain fixes do not solve it.

Wendover Productions explains how overnight shipping works, covering the hub-and-spoke logistics of companies like FedEx and UPS and the use of cargo aircraft. It touches on the economics that make next-day delivery possible.

A long Gamers Nexus investigation into how volatile US tariffs affect the computer hardware industry. It interviews manufacturers and sellers about costs, margins and why moving production to the US is hard.

FortNine explains the economics of the dealership model, arguing that dealers absorb inventory risk and help manufacturers' finances. It looks at whether cars and motorcycles could be sold more cheaply without them.

A short film from the Competitive Enterprise Institute adapting Leonard Read's 1958 essay I, Pencil, showing how no one person knows how to make a pencil and how many people cooperate without central planning.

A short BBC Earth clip from David Attenborough's Life of Birds showing a lyrebird imitating sounds, including a chainsaw and camera shutter, so accurately it is hard to tell from the real thing.

Electronics hobbyist bigclivedotcom tears down a cheap USB power supply with a manufacturing fault that carries full mains voltage to the USB ports, showing the risk of electric shock.

Wendover Productions explains how the US military moves people and materiel worldwide, including prepositioned equipment, sealift and airlift. It shows the scale of the logistics system behind US force projection.

Sabine Hossenfelder weighs the arguments for and against nuclear power, covering waste, fuel supply and newer reactor designs. She is skeptical that fast breeders and thorium solve the problems.

A 56-minute fake BBC nuclear attack news broadcast originally made by Ben Marking, re-uploaded in full resolution. It is a fictional breaking-news special depicting nuclear war, and the uploader states it is not real.