What's Really in the Box? The Case for Hardware Provenance and HBOMs

Explore the critical need for hardware transparency in this DEF CON 33 conference talk that examines why the semiconductor supply chain has become a national security flashpoint. Learn how traditional Bills of Materials (BOMs) fall short in capturing hardware origin, integrity, and risk context, leaving IoT devices and other hardware as "black boxes" despite software supply chains embracing transparency through Software Bills of Materials (SBOMs). Discover the challenges posed by cloned components, opaque fabrication facilities, and inter-organizational dependencies that current procurement-focused BOMs fail to detect. Understand why government responses like bans and onshoring are proving slow, costly, and impractical solutions to supply chain manipulation risks. Examine the emerging HBOM Initiative and its mission to develop Hardware Bills of Materials (HBOMs) that bring visibility, traceability, and accountability to the hardware supply chain. Gain insights into how HBOMs can expose hidden risks, trace chip provenance, and enable sectors to make informed, risk-based decisions while maintaining adaptability and innovation. Delve into the technical and practical challenges that make HBOMs difficult to implement and learn how the hacker and security community can contribute to shaping the future of hardware trust and supply chain security.