Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How do you know a computer is not compromised when you first get it? How do you know that manufacturers have not intentionally built vulnerabilities into the system?

share|improve this question
add comment

2 Answers

You don't. Some vendors do indeed ship backdoors with their products, and many computers come with "crapware" pre-installed as a source of revenue for the manufacturers. Even apps that don't contain a backdoor can cause other damage (e.g. Browser toolbars that track browsing).

Same concerns apply with hardware, especially in networking equipment.

What you can do:

  1. Re-install a "clean OS" onto any new computer. This probably means buying a new, vanilla copy of an OS that you have already paid for (the factory image that ships with the computer will also contain the original "crapware", unless you pay extra to not have the crapware).

  2. Re-install a more trusted OS onto a new computer (unless you write your own OS, you have to trust someone at some point). Ubuntu, Security-Enhanced Linux, whatever you trust.

  3. Use only hardware that you trust. This usually means avoiding hardware that is made in countries hostile to yours. Huawei (a Chinese networking equipment manufacturer) is finding it difficult to prove that it is trustworthy enough to supply some governments.

share|improve this answer
2  
In many cases, even if you don't have clean installation media, it's possible to use the CD-key from the computer with different installation media (at least with XP, you just need the right service-pack version as the CD key. I'm not sure if it's changed with W7/W8) –  Fake Name Jan 16 '13 at 6:07
add comment

You don't. Most of the alleged backdoors have been software problems (Google for _NSAKEY, or Digital Encryption Standard and NSA interference, or Huawei and back doors), but a hardware backdoor isn't out of the question. The issue of concealing "intellectual privacy" or other concerns in proprietary software or hardware make this problem worse.

If all hardware were open, and you could get schematics and trace them out, you could ferret out hardware compromises. Via Diverse Double-Compiling, you could detect software compromises, provided the software was open source.

It would be pretty costly to do hardware and software verification. Since "security" is an economic good, with a price and a value, we all decide what value trusting hardware or trusting software gives us, then see if the price is less than the value. For some, the value isn't so great. Microsoft has let the government of China look at Windows source code. Presumably, it was worth it to the People's Republic to pay Microsoft for that privilege, and to pay their security experts to go through the code.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.