How do I ensure that my computer is 100% worm-free?

Question

Ok say I have a brand new laptop that was is brand new.

Is it true to say that as long as I keep the bluetooth turned off, and I am not connected to the internet, and only copy files that are 100% verified (we can here, assume that it is 100% verified) from a 100% verified hard disk,

And never plug anything into the USB ports,

There can be no way a virus/worm can ever enter my computer?

Basically I'm trying to understand what are all the ways in which a virus/worm can enter a computer?

Answer 1

We can analyze any answer to your question in the following way:

1. a computer is simply some hardware that does nothing unless instructed to do.

2. BIOS tells the computer to do something. So, BIOS can have malicious code. You bought a new computer, you don't expect it to be contaminated. You can protect it in modern computers, so that it isn't upgraded if you don't do some specific manual commands. Just upgrade bios from the manufacturer site after being very sure they haven't being hacked, and BIOS won't cause you problems. (In the past there were BIOS virus, like chernobyl).

3. Operating system tells your computer to do something. Again, you expect it to come clean from manufacturer. Don't update it except after being sure the manufacturer is clean, and you're good.

4. OS have some holes on it and on it's drivers. They have many programs running (like network drivers, sharings, etc) that can receive malicious commands from a network. Don't connect it to any network (wired or wirelles, including bluetooth) and you're ok.

5. These same holes can occur from drivers or programs that are runned from USB. Be sure to what you'll attach to your USB port and you won't have problems. (There's being reports of a malware that come inside a digital photo frame, so yes, you'll never know where the problem can come from).

6. Firewire ports can have direct access to your computer's memory, since it can access DMA. Take care with them.

7. The same applies to PCMCIA cards.

8. You'll install programs on your computer. Really check them with antivirus.

9. Documents can carry virus inside them, specially because programs that open them (office, pdf readers, etc) can have vulnerabilities. Double check them.

And them, this will warranty you protection?

No, you won't be 100% protected.

Because antivirus check for know virus. One virus specially designed to get you, probably will.

USB - Firewire - PCMCIA - any other port: can too be attacked somehow, with specially designed chips carrying special codes.

Softwares like the operating system and all the other programs can have vulnerabilities that are not know neither protected. Read about zero-day vulnerabilities and you'll know about it.

And, finally, read something about the Stuxnet virus. Let's say, Iran probably did take care with it's nuclear facilities, and even so got infected with the best (worst?) virus crated so far, probably by enemies intelligence army.

Answer 2

It depends a bit on what you mean by "100% verified". With virus scanners, it's always possible that there is a malware program that the virus scanner fails to pick up (false negative). Also, the code might contain vulnerabilities that are not yet public (0-day exploits).
It is mathematically impossible to determine in advance for every program how it will respond to input; this is known as the "halting problem". So automated verification is not enough, for any non-trivial program there will be the need for verification by a human expert - who, of course, may make mistakes, accidentally or deliberately.

You haven't mentioned Bluetooth; there might be buffer overrun vulnerabilities in the code for Bluetooth communication, so you should switch that off as well.

Apart from that, I think you should be safe... but you might as well leave the computer off.

And, of course, this assumes that your computer has no floppy drives through which malware may enter :-)

EDIT: I just realized that malicious code may also be present in data - macros in Office documents being the most likely example. So assuming you're getting data from outside the system somehow, that too is suspect.

Answer 3

Never turn it on. Better yet, never take it out of the box that it's packed inside.

Answer 4

Even if it is band new straight from -oh wait- China, there are still supply chain vulnerabilities to consider.

The point is, security exists on a spectrum, you can never be 100% sure a system is secure. You can only make it more difficult to breach. This is why so much money is spent on cyber defense by everyone.

Unless you have utter trade-secrets, the objective is to merely run faster than everyone else and let the bear (attackers) eat someone else.

If you are in the business of securing vital information, you still cannot guarantee success so what do you do? You go on the offense (in addition to having great defenses). This helps to ensure that the attackers cannot gain enough traction to effectively topple the entire system. There are so many examples of how this policy works (from building a sand castle to the US' OEF

All of the above being said Technically Speaking, there are some strong ways to secure a network.

• Perhaps the strongest is called Air Gaping and combined with effective physical security, this can be great. For instance, the US DOD implements an air gap measure of sorts by only allowing 7 global internet access points to their internal network (I find this fact ironic, personally). This method is essentially what you are describing in your question.

I caution that even this may not protect you fully. Apart from the aforementioned supply chain concerns, there are other possible threats (such as BadBios).