Manufacturing and testing can be expensive.

Some “forgeries” may be the real deal. Sometimes people are able to dumpster dive or acquire the wafers surplus. A lot of cost is in the manufacturing and testing. If something moderately works its easier to move. This attack is however more limited in that its typically based on targets of opportunity rather than targeting a specific chip. Additionally, it requires access to bonding, packaging, and laser markers.

Its not uncommon for manufacturers to shred old wafers to prevent this sort of forgery.

Probably the easier route. The attacker either finds some surplus chips cheap or maybe something that doesn't work at all and then marks them up to a more expensive chip.

Simple testing can find blatant forgeries. Parts screening may be required to find quality differences and can be difficult to prove to your supplier.

Some clones are clearly marked, others aren't. Someone extremely knowledgeable can usually tell based on fine differences in package marking but most consumers won't have this level of knowledge. Some dies are copied verbatim and so may look identical even close up.

http://www.dmea.osd.mil/

United States DoD maintains the Defense Microelectronics Activity (DMEA).

http://www.erai.com/

“ERAI is a privately held global information services organization that monitors, investigates and reports issues that are affecting the global supply chain of electronics.”

http://idofea.org/

“The Independent Distributors of Electronics Association (IDEA) is a non-profit trade association representing quality and ethically oriented independent distributors of electronic components. The purpose of IDEA is to promote the independent distribution industry through a media advocacy campaign, to improve the quality of products and services through a quality certification program, educational seminars, and conferences, and to promote the study, development, and implementation of techniques and methods designed to improve the business of independent distributors.”

Sabotage

• DMEA: http://www.dmea.osd.mil/trustedic.html
• SparkFun Atmega328 slug: http://www.sparkfun.com/products/9831
• http://www.youtube.com/watch?v=5O4jslHi4pE
• http://counterfeitwatch.blogspot.com/
• National trying to scare you http://www.national.com/vcm/NSC_Content/Files/en_US/Milaero/TrustedFoundryOverview.pdf
• Preventing integrated circuit piracy using reconfigurable logic barriers: http://archives.ece.iastate.edu/archive/00000512/01/AlexBaumgarten_Thesis.pdf
• http://www.cpu-galaxy.at/article/fakes.htm