Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How do you know a computer is not compromised when you first get it? How do you know that manufacturers have not intentionally built vulnerabilities into the system?

share|improve this question
    
Apart from manufacturers, a system may have been in use and therefore compromised for a period ranging from brief (some testing was done) to quite long (I got a bargain on a shop display model once, on which the large number of pornographic pop-ups and attempts to dial out to various numbers made its being compromised quite obvious). –  Jon Hanna May 27 at 11:13

2 Answers 2

You don't. Some vendors do indeed ship backdoors with their products, and many computers come with "crapware" pre-installed as a source of revenue for the manufacturers. Even apps that don't contain a backdoor can cause other damage (e.g. Browser toolbars that track browsing).

Same concerns apply with hardware, especially in networking equipment.

What you can do:

  1. Re-install a "clean OS" onto any new computer. This probably means buying a new, vanilla copy of an OS that you have already paid for (the factory image that ships with the computer will also contain the original "crapware", unless you pay extra to not have the crapware).

  2. Re-install a more trusted OS onto a new computer (unless you write your own OS, you have to trust someone at some point). Ubuntu, Security-Enhanced Linux, whatever you trust.

  3. Use only hardware that you trust. This usually means avoiding hardware that is made in countries hostile to yours. Huawei (a Chinese networking equipment manufacturer) is finding it difficult to prove that it is trustworthy enough to supply some governments.

share|improve this answer
2  
In many cases, even if you don't have clean installation media, it's possible to use the CD-key from the computer with different installation media (at least with XP, you just need the right service-pack version as the CD key. I'm not sure if it's changed with W7/W8) –  Fake Name Jan 16 '13 at 6:07

You don't. Most of the alleged backdoors have been software problems (Google for _NSAKEY, or Digital Encryption Standard and NSA interference, or Huawei and back doors), but a hardware backdoor isn't out of the question. The issue of concealing "intellectual privacy" or other concerns in proprietary software or hardware make this problem worse.

If all hardware were open, and you could get schematics and trace them out, you could ferret out hardware compromises. Via Diverse Double-Compiling, you could detect software compromises, provided the software was open source.

It would be pretty costly to do hardware and software verification. Since "security" is an economic good, with a price and a value, we all decide what value trusting hardware or trusting software gives us, then see if the price is less than the value. For some, the value isn't so great. Microsoft has let the government of China look at Windows source code. Presumably, it was worth it to the People's Republic to pay Microsoft for that privilege, and to pay their security experts to go through the code.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.