I always wondered about how feasible the usb drive propagation bit always noted was. Was there ever any evidence that the hardware was already infected at a less scrupulous reseller? I’ve heard of another site in EU that had misbehaving s7. It could have been a reseller that played loose with licensing.

Given the 'pager attack' supply chain involvement, it can't be ruled out in any other state-sponsored hack / attack.

See also: https://www.schneier.com/blog/archives/2015/03/cisco_shippin...