Simon Springall (he/him). #FBPENov 29, 2023
Jake Williams
This should be getting a lot more attention. NXP chips are in a lot of products. It's likely the TA knows of specific flaws reported to NXP that can be leveraged to exploit devices the chips are embedded in, and that's assuming they didn't implement backdoors themselves. Over 2.5 years (at least), that's not unrealistic.
https://www.tomshardware.com/news/chinese-hackers-steal-chip-designs-from-major-dutch-semiconductor-company
Chinese hackers steal chip designs from major Dutch semiconductor company — perps lurked for over two years to steal NXP's chipmaking IP: Report

The full extent of the security breach is unknown.

Tom's Hardware
Nov 26, 2023 at 3:40pmWeb
Show threadAlun JonesNov 26, 2023
@malwarejake Something about a modern version of the Capacitor Plague. https://en.wikipedia.org/wiki/Capacitor_plague
Capacitor plague - Wikipedia

Show threadUnprecedented 2023Nov 26, 2023
@malwarejake Thieves. Don’t have to invent anything. Just steal.
Show threadDan GoodinNov 28, 2023

@malwarejake @catsalad

https://arstechnica.com/security/2023/11/hackers-spent-2-years-looting-secrets-of-chipmaker-nxp-before-being-detected/

Hackers spent 2+ years looting secrets of chipmaker NXP before being detected

Chipmaker claims breach had no "material adverse effect."

Ars Technica
Show threadhrabbeyDec 20, 2023
"NXP chips are in a lot of products" including phones, access cards, and cars.
This is more evidence that security by obscurity provides limited value, and security implementations that can handle the searchlight of openness is worth something.