Going to take it a few steps further. Now we're targeting a specific person.
1. CCP needs to hack shipping label system to track a specific person (DHL/CCP shipper/Fedex) which method? We need to interject against them all.
2. CCP was waiting for this person to buy a Macbook Pro?!
3. CCP was lucky enough that the exact model was back ordered via China shipping routes. We were lucky because normally they could just walk into any Apple Store and buy it and walk out. No ability to target a specific person.
4. What if the target "returns the laptop?!" Our years of hacking setup didn't work.
There are insane amounts of difficulty for this target vector which make it effectively impossible to go after a specific person via supply chain, specific order.
So we're back at mass surveillance. That doesn't work because given enough people, someone pen/security check the laptops coming out. Apple will recall.
Actually it’s much easier than that, and what the TAO group [https://en.wikipedia.org/wiki/Tailored_Access_Operations] here does on a smaller scale. There is undoubtably easier and better scale in China since so much tech is manufactured there. They can get the firmware source (or require things be included), and chip masks pretty easily, even easier than the CIA or NSA getting them here. And I doubt any TLA has much problems with that here if they care.
The way you do this, is you have ‘partnerships’ with the major shippers where they match against known person of interest on your list. When someone has an interesting shipment to one of your targets, it gets flagged and set aside in a known location.
Since all new style equipment needs a basic plan to add targeted hardware/firmware attacks anyway, since if you need the capability to compromise any given target at will (which they do) you need the capability to compromise pretty much all common equipment readily available, at a minimum. All available equipment being a realistic requirement too.
Some bored tech will then take the already developed playbook for that specific piece of equipment, write the firmware or glue on the specific special chip to the board, pack it up, and hand it back to the shipper.
Definitely agreed on the TAO and surveillance, upvoted in fact for that.
But, again, I'll "buy that bridge" when it comes to an Apple product-supply-chain being hacked by a state actor to target an individual.
CCP can't bank on a specific Apple product being purchased by a specific person routed through their side/controlled supply chain.
As before, most apple products are not routed directly from China to a consumer. This is a pretty rare circumstance given the supply chain bottlenecks.
I agree both sides have the ability to "hold product" in the shipping lane to do all sorts of nefarious things, but that only works if you can predict that movement (i.e. destination being on "your side" of control). The specific circumstances matter here and they don't make it an attack vector against a specific person.
FYI - Every Apple product I've bought in the last year or two was routed directly from China to me. From multiple iPads, an iphone, and a macbook pro. With the pandemic shutting down a lot of Apple store traffic, it's probably become more pronounced if anything.
Definitely not the case for everyone, especially an enterprise, but I bought it via the apple store app and the tracking showed it from China -> Chinese Customs -> To me, and through fedex.
So they had all the information they would need in one place to do what I am describing in at least this scenario.
Someone somewhere puts the persons name and address into a To address for a shipping company. If the origination is in China and it's sold direct, that final address and name will be on that label, and in the tracking database.
It doesn't have to be perfect to catch a decent number of targets. If even 25% of the purchased products get intercepted this way for a target it will likely be effective.
The 2nd half seems absurd on too many levels, conspiracy level thinking.
Changing software? Super easy to detect. Changing hardware? insanely expensive to do it en masse, esp outside of the factory.
There's no target, but mass surveillance? This checks so few logic boxes.