>if you released a vulnerable piece of hardware, SOMEONE SOMEWHERE will notice But is that someone somewhere only part of the NSA or its Chinese equivalent? I

>if you released a vulnerable piece of hardware, SOMEONE SOMEWHERE will notice But is that someone somewhere only part of the NSA or its Chinese equivalent? It makes me think of the TriangleDB iPhone exploit. I don't think anyone could have realistically known that those MMIO opcodes were there, without being part of the actual CPU design team. https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/ https://securelist.com/operation-triangulation-the-last-hard... >The exploit targets Apple A12–A16 Bionic SoCs, targeting unknown MMIO blocks of registers that are located at the following addresses: 0x206040000, 0x206140000, and 0x206150000. >The prompted me to try something. I checked different device tree files for different devices and different firmware files: no luck. I checked publicly available source code: no luck. I checked the kernel images, kernel extensions, iboot, and coprocessor firmware in search of a direct reference to these addresses: nothing. >How could it be that that the exploit used MMIOs that were not used by the firmware? How did the attackers find out about them? What peripheral device(s) do these MMIO addresses belong to I believe it's very easy nowadays to release undetectably vulnerable devices.