The story of hardware backdoors from China found in an electric transformer at a US utility is continuing to gain attention; but it doesn’t deserve to. There has only been 1 source of the claim who doesn’t even work at a utility and he has provided 0 evidence.
The story especially with its supply chain angle is sensational and touches on long held fears in DC and elsewhere. But their fears that have never manifested. So there’s folks who really want to believe this is true. But there’s no evidence of it now nor has there been.
Joe (the individual making the claim) is a really good engineer and has been very important to the development of the ICS security community, but he often has sensation claims that turn out to be very inaccurate, unsupported, or twisted non maliciously for other purposes.
Many in the ICS security community owe him gratitude along their careers for his advocacy, speaking against him always carries some level of taboo, I consider him a friend and important to me as well. But this claim doesn’t pass the smell test and is entirely unsupported
At a time with the new electric sector focused Executive Order I fear it’s going to drive bad policy and security decisions. Fears of China remotely activating said back doors for an “Aurora” effect on transmission equipment is even more ridiculous.
I do not tweet any of these lightly. Yes there are legitimate supply chain concerns. Yes counterfeit equipment has been found before for criminal purposes not malicious cyber purposes. Yes we can all think of tangential scenarios that bother us. But this specific claim is off
If Joe has evidence of a state level cyber attack that the NSA, White House, DOE, FERC, utility industry, etc. are all completely unaware of then I hope he comes forward with any evidence. Until then the burden of proof is on him and we should all go about our days.
There are very important security and policy efforts that have nothing to do with level 0 or hardware backdoors that need prioritized at a time the threats continue to get more aggressive while our industries are transforming enabling more risk. Focus on what works.
