How would a hardware vulnerability on router equipment handling traffic compromise data flowing over that router which has already been encrypted properly at the source/destination?
Did you mean to do this? Because if not, it's what's called a bailey-and-motte fallacy. You've stated a very controversial, hard-to-defend position (what difference does compromised hardware make to a user's security?), mentioned it in a context where it would make a huge difference (smartphones), and now you've brought up a very specific scenario and context that is more reasonable (although still not as much as you appear to think).
Again, your original question was "What unusual attack do they get access to by owning or manufacturing the equipment?". Your original post made no reference to routers or switches.
To answer that original question explicitly, having a many types of hardware exploits on end-user equipment is game over - full access to all your data and communications on that device.
Edit: And regarding compromised routers, from https://www.welivesecurity.com/2019/01/17/new-years-resoluti..., here's a list of things that a hacked router could do to you, many of which would be of interest to nation-state attacker targeting a person or organization:
- redirect you to a web page that phishes for your credentials,
- dupe you into installing malware-laced versions of legit software,
- be hijacked to conduct man-in-the-middle attacks (MitM) on what you would believe are secure and encrypted connections,
- be corralled into a botnet in order to launch DDoS attacks against websites or even against aspects of the internet’s infrastructure,
- be co-opted as an on-ramp to attacks at other devices within your network,
- be used to spy on you via Internet-of-Things (IoT) devices,
- be compromised with malware such as VPNFilter, or, as another threat du jour, be misused for covert cryptocurrency mining.
Edit 2: And unless a website is only available via HTTPS, the end user is using an extension like HTTPS Everywhere, or the user carefully types in `https` as the URL protocol, then the end user is still vulnerable to SSL strip from a compromised router.
Edit: Would you agree to let me (or anyone) hook up a compromised router inside your home network?
Chances are, the US government is pushing for china-free networks to ensure it has a monopoly on hacking American systems.
If we as a whole drop the assumption that the network is safe, we can build things where I would trust you to hook up a compromised router to my home network.
The solution to all of this is to work together and increase the security of the overall system and ditch security through obscurity and security through NDA, go open-source and full inspectability for all critical infrastructure, be it comms, industrial controls, medical infrastructure, transport etc. And E2E encrypt all communications. Everything else is just screwing around with the symptoms instead of addressing the root causes.
I think the China-hawk paranoia is going too far but for national security paranoia it's relatively well grounded. It's hard to justify being able to certify that a thing is secure when the hardware could just be lying to you about the firmware checksum for example.
Now I'm wondering whether I'm mistaken? If my connection to a website/device is properly encrypted (SSL/TLS), can a mitm attack (eg by an embedded hw bug) strip that encryption away? If so, that would be bad and would invalidate large parts of my argument above. If it doesn't however, then it wouldn't really matter that much I think. Unless... the device somehow saves a copy of the traffic for later decryption with better hardware down the line. That seems doable but not really feasible at scale. (Then again, maybe a few bugs in the routers installed at a few critical facilities or locations like downtown DC are enough to gobble up enough juicy traffic?)
I think on the whole it was a bad idea to offshore virtually all production capabilities for chips and computer hardware. (This is especially true for Europe which lost its hw production to Asia and its software production to the US.) Now we have to cope with this situation as it is though, and it seems to me that the best way to do that is to improve transparency by doing what I wrote above, radically reducing complexity of protocols and the tech stack (eg openssl vs wireguard) and forcing companies to clean up their act wrt IT practices. Not easy at all, I know.