Hardware Trojans and Chip Supply Chain Guide: Counterfeits, Trojans and Assurance Controls

A chip passes through dozens of organisations before it reaches your rack, and a counterfeit or maliciously modified part can defeat every software control built on top of it. Integrated circuits are designed with third-party tools and IP, fabricated by foundries, packaged and tested elsewhere, sold through distributors and repaired by service partners. Each hand-off is a point where a part can be substituted, remarked or altered. This guide explains hardware Trojans and counterfeit electronic parts, where in the life cycle the risks enter, the procurement rules and assurance programmes that address them (including DFARS, GIDEP reporting and CHIPS for America), and what an enterprise buyer or a product team can actually verify. It is written for supply chain risk, procurement, hardware engineering and security architecture teams. For the software side of the supply chain, see the Software Supply Chain Security Guide.

Key takeaways

• Counterfeits are the everyday risk, Trojans the rare one. Most organisations will meet remarked, recycled or substituted parts long before a malicious circuit; controls for the first also reduce the second.
• Buy from authorised sources. Traceability from the original manufacturer is the most effective single control, and US defence rules require risk-based tracking from manufacturer to acceptance.
• Testing alone cannot prove a chip is clean. Trojans are small, outside specified functionality and designed to stay dormant, so assurance depends on trusted design flows and suppliers as much as on inspection.
• Firmware is part of the hardware supply chain. Updatable firmware and microcode in CPUs, NICs and accelerators carry most of the practical risk an enterprise can review; programmes such as OCP S.A.F.E. publish independent findings.
• Report and quarantine. Suspect parts must be isolated, not returned to the seller, and reported so others can avoid them.

What hardware Trojans and counterfeits are

The CyBOK Hardware Security Knowledge Area describes hardware Trojans as extra logic or gates added to large integrated circuits. They are hard to find because they are not part of the specified functionality and are very small relative to the chip. CyBOK classifies them by three criteria.

CyBOK also notes concerns that Trojans could be included at board level, not only inside silicon. Counterfeits are defined in procurement law. DFARS 252.246-7007 defines a counterfeit electronic part as an unlawful or unauthorised reproduction, substitution or alteration knowingly mismarked, misidentified or otherwise misrepresented as authentic and from the original manufacturer or an authorised source. A suspect counterfeit part is one where credible evidence, such as visual inspection or testing, provides reasonable doubt that it is authentic.

Common counterfeit types

• Recycled: parts removed from scrapped boards, cleaned and sold as new, with reduced remaining life.
• Remarked: markings changed to claim a higher grade, speed or temperature range, or a different date code.
• Overproduced or out of specification: genuine designs made or sold outside the manufacturer's control, or rejects that failed test.
• Cloned: copies of a design produced without authorisation.
• Substituted components: a different part fitted on an assembly, a pattern MITRE CAPEC records as CAPEC-531 Hardware Component Substitution.

Where risk enters the life cycle

CyBOK points out that design relies on EDA tools, that foundries are mostly in Asia and that testing and packaging happen worldwide, which is why trust and verification across the full design cycle matter for critical infrastructure. Design teams can use the MITRE CWE Hardware Design view (CWE-1194), whose categories include Manufacturing and Life Cycle Management Concerns (CWE-1195), Security Flow Issues (CWE-1196) and Security Primitives and Cryptography Issues (CWE-1205). See the CWE Hardware Weaknesses Guide.

Procurement rules and reporting

US federal rules give the most detailed public model of a counterfeit avoidance programme, and many commercial buyers copy them.

DFARS 252.246-7007 system criteria

The clause (dated January 2023) requires covered defence contractors to operate a counterfeit electronic part detection and avoidance system that addresses twelve criteria:

1. Training of personnel.
2. Inspection and testing, including acceptance and rejection criteria.
3. Processes to abolish counterfeit parts proliferation.
4. Risk-based tracking of parts from the original manufacturer to government acceptance.
5. Use of suppliers that meet DFARS 252.246-7008.
6. Reporting and quarantining of counterfeit and suspect counterfeit parts.
7. Methods to identify suspect counterfeits and rapidly confirm them.
8. Design, operation and maintenance of the detection and avoidance system.
9. Flow-down of requirements to subcontractors.
10. Keeping informed of counterfeiting trends.
11. Screening GIDEP reports and other credible sources.
12. Control of obsolete electronic parts.

Reporting

Outside government contracting, the same discipline works: a quarantine area, a register of suspect parts, a rule that suspect stock is never sent back to the broker that sold it, and a route to share findings with industry. Aerospace and defence suppliers also use SAE standards such as AS5553 for counterfeit avoidance; obtain the current revision from SAE before relying on its detail.

Industrial policy: CHIPS for America

The CHIPS and Science Act of 2022 provided $50 billion, implemented through two Department of Commerce offices: the CHIPS Program Office, with $39 billion in manufacturing incentives, and the CHIPS Research and Development Office, with $11 billion for research and development. R&D programmes include the National Semiconductor Technology Center, the National Advanced Packaging Manufacturing Program, a CHIPS Manufacturing USA Institute and a metrology programme. Awards continue to be made and amended: in October 2026 NIST announced an agreement to amend GlobalFoundries' award and reallocate up to $955 million towards silicon photonics, silicon-germanium and advanced packaging. For security teams, the practical point is that more domestic and allied capacity widens the choice of known suppliers; it does not remove the need to verify parts. Check the CHIPS site for current programme status before citing figures in procurement policy.

What an enterprise buyer can verify

Few organisations can inspect silicon. Most can control where hardware comes from, what it contains and what firmware it runs.

• Source: buy from the manufacturer or its authorised distributors and resellers; require proof of authorisation and certificates of conformance for brokered parts.
• Bill of materials: ask for a hardware bill of materials. CISA's HBOM Framework for Supply Chain Risk Management gives a consistent naming taxonomy for component attributes, a format for recording component types and guidance on which data fits which use case. See the Hardware and Firmware SBOM Guide.
• Firmware review evidence: OCP S.A.F.E. uses accredited independent Security Review Providers to assess updatable firmware and microcode in CPUs, GPUs, FPGAs, network controllers, accelerators and storage devices, covering boot code integrity, secure boot, recovery, secure updates, provisioning and change of ownership; Security Findings Reports are published on GitHub. Ask whether a device has been reviewed and read the findings.
• Cryptographic identity: devices with a hardware root of trust can prove they are genuine and report measured firmware. Attestation does not detect a Trojan in the root of trust itself, but it does detect substituted boards and unauthorised firmware. See the Hardware Root of Trust Guide.
• Delivery and receipt: tamper-evident packaging, serial number checks against the vendor record, and incoming inspection for high-value or high-risk shipments.

What product and hardware teams can do

• Control IP: keep an inventory of third-party IP blocks with versions and provenance, and review their security documentation.
• Protect the design environment: treat netlists, layouts and EDA tool licences as sensitive assets with access control, change review and logging.
• Verify security properties: use the CWE hardware categories as review checklists, including debug and test access and life cycle states. See the Debug Interfaces Security Guide.
• Use device-unique secrets: CyBOK describes physically unclonable functions (PUFs) that derive device-unique keys from manufacturing variation; weak PUFs such as SRAM PUFs suit key generation with error correction, while some strong PUFs have been broken by machine learning attacks.
• Plan for detection limits: functional tests rarely trigger a dormant Trojan. Research techniques such as comparing side-channel behaviour with trusted reference chips and physical imaging exist but are costly; reserve them for high-assurance programmes.

Where identity fits

Many chips leave the factory with a cryptographic identity: a key pair generated or injected during manufacturing and a certificate signed by the vendor's provisioning CA. That makes the factory provisioning system a high-value machine identity issuer. If an attacker can submit their own certificate request to it, or steal its signing key, they can mint "genuine" identities for cloned or modified parts. When you rely on device certificates for onboarding, ask suppliers how provisioning keys are held (for example in HSMs), how certificate requests from the production line are authenticated and how compromised batches would be revoked. See the Device and IoT Identity Guide.

Decision guidance

Implementation roadmap

1. Classify: identify hardware categories where compromise would be critical (identity infrastructure, network core, OT controllers).
2. Set sourcing policy: authorised sources by default, a documented exception process for brokers with mandatory inspection.
3. Contract: add traceability, HBOM, notification of counterfeits and firmware review evidence to supplier agreements, and flow them down.
4. Inspect: start with serial and documentation checks on all critical deliveries; add physical or electrical testing for brokered parts.
5. Quarantine and report: define the suspect parts process before you need it, including who decides authenticity.
6. Review: track trends and supplier performance each quarter and adjust inspection levels.

Detection and measurement

• Authorised source share: percentage of critical hardware spend through manufacturer or authorised channels.
• Traceability coverage: percentage of critical deliveries with documentation back to the original manufacturer.
• HBOM coverage: percentage of critical hardware models with an HBOM on file.
• Suspect part rate: suspect counterfeits found per thousand parts inspected, by supplier.
• Reporting timeliness: days from suspicion to report, against the 60-day FAR 52.246-26 limit where it applies.
• Firmware review evidence: percentage of critical device models with an independent firmware security review.

Framework mapping

See the NIST SP 800-161 Cyber Supply Chain Risk Management Guide for the programme view.

Common failure patterns

• Buying on price from brokers: shortages push teams to grey-market parts with no traceability, often with no extra inspection.
• Returning suspect parts: sending suspect stock back to the seller for a refund puts it back into circulation; DFARS forbids this for covered contracts.
• Treating firmware as someone else's problem: hardware is accepted on brand alone while its firmware signing keys sit with the OEM; the MSI signing keys leak showed that a breach at one manufacturer can undermine the boot trust of many products.
• Unmanaged repair: field service swaps boards or chips with no record, so the installed configuration no longer matches the HBOM.
• Expecting testing to find Trojans: functional acceptance tests are designed to show the part works, not that it does nothing else.
• Uncontrolled disposal: scrapped equipment is sold intact, and its parts re-enter the market as recycled counterfeits.

Practitioner checklist

• Identify critical hardware categories and their suppliers.
• Make authorised sources the default and inspect any brokered part.
• Put traceability, HBOM and counterfeit notification clauses in supplier contracts and flow them down.
• Ask for independent firmware review evidence for servers, NICs and accelerators.
• Verify device identity and firmware by attestation at onboarding where the hardware supports it.
• Run a quarantine and reporting process for suspect parts, including GIDEP where you are a federal contractor.
• Control repair, return and disposal so parts cannot re-enter the supply chain.
• Train buyers and receiving staff to recognise counterfeit warning signs.

Standards and references

• Acquisition.gov: DFARS 252.246-7007 Contractor Counterfeit Electronic Part Detection and Avoidance System
• Acquisition.gov: FAR 52.246-26 Reporting Nonconforming Items
• NIST: SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices
• CyBOK: Hardware Security Knowledge Area
• MITRE CWE: CWE-1194 Hardware Design view
• CISA: Hardware Bill of Materials Framework for Supply Chain Risk Management
• Open Compute Project: OCP S.A.F.E. Program
• NIST: CHIPS for America

Related NHI Mgmt Group resources: Software Supply Chain Security Guide · Hardware and Firmware SBOM Guide · Hardware Root of Trust Guide · NIST SP 800-161 Cyber Supply Chain Risk Management Guide