LABScon 2025 Talk Examines Risks in Overseas-Made Networked Devices
Summary
Joe FitzPatrick’s talk argues that hidden connectivity, supply-chain workarounds and mandatory activation undermine safeguards for imported devices. He recommends right-to-repair, offline-use guarantees, hardware and firmware bills of materials, and privacy legislation.
Key points
- The talk says small businesses and infrastructure operators depend on affordable overseas-made networked devices, often with connectivity to foreign entities by default.
- FitzPatrick cites reports of undocumented cellular radios in solar inverters used in U.S. highway infrastructure.
- He says connectivity can be added to a device with an exposed serial port in minutes by a manufacturer, installer or later tamperer.
- The talk describes banned hardware re-entering supply chains through relabeling and FCC-certified modular components.
- It discusses mandatory activation in devices such as drones and 3D printers, which can make offline use difficult.
- FitzPatrick favors right-to-repair and offline-use guarantees, hardware and firmware bills of materials, and privacy legislation over import bans.
Article Details
- Topic
- Security risks from overseas-manufactured networked devices, including undocumented connectivity, hardware supply-chain workarounds, and mandatory product activation.
MITRE ATT&CK
People
Countries
Industries
consumer electronicsconnectivity of critical infrastructure, or the US’s deep dependence on foreign-manufactured consumer electronics.Critical infrastructurehow overseas-manufactured networked devices have become essential in small-business labs and critical infrastructure, while the safeguards meant to control their risks often fail in practice.