  Additive Manufacturing (AM) systems such as 3D printers use inexpensive
microcontrollers that rarely feature cybersecurity defenses. This is a risk,
especially given the rising threat landscape within the larger digital
manufacturing domain. In this work we demonstrate this risk by presenting the
design and study of a malicious Trojan (the FLAW3D bootloader) for AVR-based
Marlin-compatible 3D printers (>100 commercial models). We show that the Trojan
can hide from programming tools, and even within tight design constraints (less
than 1.7 kilobytes in size), it can compromise the quality of additively
manufactured prints and reduce tensile strengths by up to 50%.
