Loading story…
Andrew "Bunnie" Huang introduced Baochip-1x, an open-source silicon chip designed to make hardware trust and verification practical for high-assurance and embedded systems. Unlike conventional proprietary chips that are difficult to inspect and effectively operate as black boxes, Baochip-1x publishes its register-transfer level design and a reference image so users can compare the manufactured device against known-good specifications. The chip was fabricated by TSMC on a 22-nanometer process and is intended to reduce supply-chain and tampering risks that can affect secure devices.
Baochip-1x supports visual hardware attestation through infrared in situ inspection of silicon (IRIS), allowing non-destructive examination of the physical chip to confirm it matches the published design. Huang said the platform is aimed at more trustworthy IoT devices, security tokens, and other embedded products, and it also incorporates security-focused features including memory protection and an open-source, attestable Rust-based boot chain. The project is intended to encourage broader community adoption of transparent, verifiable hardware as a defense against both state-level and mid-tier adversaries.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Baochip-1x was fabricated by TSMC on a 22-nanometer process and designed to support infrared in situ inspection of silicon (IRIS) for non-destructive visual hardware attestation. Huang said the chip is intended to help reduce supply-chain tampering risks and support secure IoT devices, tokens, and other embedded systems.
Andrew "Bunnie" Huang introduced Baochip-1x, an open-source silicon chip for high-assurance and embedded applications aimed at improving hardware trust and verification. The design publishes its register-transfer level code and reference imagery to make the chip more transparent and auditable.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have demonstrated new hardware-based techniques to extract sensitive data from devices previously considered secure, including smartwatches and confidential computing servers. In one case, analysts revived the 'Blinkenlights' technique, adapting it to modern TFT screens to extract firmware from a budget smartwatch by exploiting a dial parser vulnerability. This allowed arbitrary memory content to be displayed on the device's screen, which was then captured using a high-speed Raspberry Pi Pico setup. The smartwatch, which contained fake health sensors and used a JieLi AC6958C6 system-on-chip, was found to have weak authentication and a flawed firmware parser, enabling the out-of-bounds read attack. Separately, researchers from KU Leuven University presented a low-cost hardware attack called 'Battering RAM' at Black Hat Europe 2025, which targets secure CPU enclaves such as Intel SGX and AMD SEV. By using a $50 DDR4 interposer, the researchers manipulated memory address mapping at runtime, bypassing firmware mitigations and gaining unauthorized access to encrypted memory. This allowed them to extract platform provisioning keys, forge attestation reports, and implant persistent backdoors on protected virtual machines, raising concerns about the security of cloud infrastructures relying on these technologies.
Jun 29, 2026
A technical write-up published by 0x434b argues that **Secure Boot can be bypassed without breaking cryptography** when trust is lost elsewhere in the boot chain. The article frames Secure Boot as an end-to-end authorization system rather than a simple signature check and groups failures into four categories: verification that never ran or was not enforced, signatures that covered the wrong bytes, trust placed in the wrong signing authority, and cases where verified code differed from what ultimately executed. It cites public examples including `CVE-2019-2278`, `CVE-2023-48425`, `CVE-2023-50810`, `CVE-2021-1931`, and Android Verified Boot test keys left in production firmware to show how locked devices can still load unauthorized code. The research also says **measured boot and remote attestation only help if they independently measure the state that actually ran**, warning that back-end trust decisions can fail when evidence does not reflect real execution. The post was amplified on r/netsec as an offensive-security-oriented walkthrough of hardware roots of trust, Qualcomm and Android boot stages, UEFI, and attestation, while a separate oss-security thread on a proposed `fallback.efi`/SBAT/GRUB memdisk bypass showed how disputed Secure Boot bypass claims can hinge on trust-model assumptions. In that discussion, maintainers from Red Hat and Oracle argued the reported chain required privileges that already undermine the platform's security guarantees, underscoring the article's broader point that boot integrity depends on enforcement, authority, coverage, and continuity across the full chain.
Aug 20, 2026
Researchers disclosed two separate boot-chain security issues that undermine trusted startup protections on major platforms. CERT/CC warned that outdated Microsoft-signed UEFI **shim** bootloaders—especially `shim` version `0.9` and earlier, including forked or unpatched builds used by vendors such as Red Hat Enterprise Linux, CentOS, Oracle, OpenSUSE, and WhiteCanyon—can be abused to bypass **Secure Boot** and run arbitrary code before the operating system loads. Because the attack executes in the early boot phase, it can evade EDR visibility and establish persistent compromise; Microsoft is responding by expanding the UEFI Forbidden Signature Database (**DBX**) to revoke vulnerable bootloaders, while administrators have been urged to update signature databases first and test carefully to avoid leaving systems unbootable. Paradigm Shift also disclosed an **unpatchable BootROM flaw** in Apple `A12` and `A13` chips and released a proof-of-concept exploit, `usbliter8`, showing that affected devices from the iPhone XS through the iPhone 11 line can be compromised during startup. The bug stems from USB controller behavior in SecureROM that allows unauthorized memory writes via crafted packets, enabling temporary reduction of security settings, booting of unsigned software, and the familiar `PWND` USB serial marker after exploitation. Apple was notified before publication, but because the weakness is embedded in silicon, software updates cannot fully eliminate the risk for affected devices over their operational lifetime.
Jun 29, 2026