Attackers can also take a more hard

Attackers can also take a more hardware-focused approach to thefirmware, and this strategy can take many forms. Compromising a devicein the supply chain provides one of the most direct paths to a device’shardware and its firmware. Malicious or intentionally vulnerable firmwarecan be introduced into a product if a vendor or one of its suppliers iscompromised. This is actually quite a large attack surface given themany components and extensive underlying supply chain that goes intoa modern device. Likewise, as shown in the recent ShadowHammerattacks, the supply chain can be attacked even after a device is deliveredby compromising the official updates delivered by a vendor. In either case,an attacker is able to compromise a system that an organization typicallyassumes to be safe.