[XorNot]

And you know, given the tens of thousands of people involved in chip design, are we to think that absolutely no one, anywhere, would've leaked that there was some anomalous circuitry in the chip designs which they were told not to worry about it?

[cyrus_]

It would probably be added pre-fabrication, not right in the chip design.

[nitrogen]

It could also be added in the firmware, either during manufacture, or via zero-day exploits in the firmware. The largest entries in /lib/firmware are all for network cards. Since the NIC has DMA access and can interrupt the CPU, the NIC firmware could be used to attack the OS.

There's still the question of packet sniffing by an intermediate device. The attacker would need to control (the network interfaces of) every device in the chain, use the ability very rarely to avoid detection, or hide data in packet metadata that is later decoded by interception equipment. This third option is probably fairly straightforward on any NIC with TCP checksum offloading.