Through the use of smart devices, both machine and personal data are being collected, stored, and analyzed more extensively than ever before. The resulting range of functions is convenient and enables innovative products and services.

However, alongside illicit software, tampered electronic assemblies continue to be discovered in security-critical systems. For example, in 2015, semiconductor chips were found on server mainboards that allowed them to be illegally remote-controlled [1]. At one point, digital communication systems were even suspected of potentially failing in critical situations. Currently, inverters for PV systems and energy storage units used in critical infrastructure are raising concerns due to undefined communication components [2].

Initially, compromised manufacturing facilities inserted small, unauthorized, and difficult-to-detect semiconductor chips onto printed circuit boards (PCBs) during assembly [1]. Today, these can include silicon chips embedded directly into the PCB beneath solder pads. Detecting such compromised boards often requires elaborate X-ray inspections. Another potential entry point for hardware manipulation lies in System-in-Package (SiP) technologies, which can conceal additional functionalities that are nearly impossible to detect [3].

To prevent the leakage of trade secrets during development, prototyping, and series production, the German Federal Office for Information Security (BSI) recommends placing manufacturing and production data with trustworthy and security-conscious producers and suppliers such as P&R Gerätetechnik [3, 4]. With the power of big data and large language models, malicious actors can reverse-engineer layouts and component placements with high accuracy, quickly and inexpensively.

When it comes to smart, connected devices, the manufacturing of PCBs and electronic assemblies is particularly security-sensitive. Additional inspections using AOI or X-ray can help mitigate risks posed by changing PCB suppliers. For life-critical, connected devices used in medical, defense, or emergency response technologies—as well as in critical, remote-controlled infrastructure such as water, transport, energy, and communication systems—reliable suppliers are essential to minimize procurement and manufacturing risks.

Sources:

[1] Robertson, Jordan; Riley, Michael: The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies.Bloomberg Businessweek, 2018.

[2] Mcfarlane, Sarah: Rogue communication devices found in Chinese solar power inverters. Reuters, 2025.

[3] PANDA Study: Investigation of Hardware Manipulation in Distributed Manufacturing Processes. Federal Office for Information Security (BSI), 2021.

[4] Harrison, Jacob et al.: On Malicious Implants in PCBs throughout the Supply Chain. Integration (Elsevier), 2021.