1

I bought my computer in 2011. From 2011 to 2015 the computer was accessible to a cousin of mine who is a developer. He doesn't work with IT security, but has more than a decade of experience programming.

I have reasons to believe he might have installed some monitoring software on my computer, around 2011-2015, when he had physical access to the device. My cousin is very manipulative and always envied me. A friend of my parents strongly implied to me they at least one time searched my computer to see what I was doing. But if they installed something, I always thought it would be software only.

Since then, I have reinstalled the OS (Ubuntu) a few times and I also replaced my HDD. So, keyloggers or other malicious software are not a problem. What I am thinking is an infected BIOS or other hardware.

How easy is to an experienced developer to develop (or to acquire) a BIOS or hardware virus to target a single computer? Should I throw away my computer? Just flashing the bios again will be good enough?

I already read a lot of answers about BIOS virus and how it is not worth the trouble because every single manufacturer will have its own design etc. But I'm thinking about someone trying to access a specific computer, not a wide attack.

  • 1
    Developing a BIOS virus is very difficult. Getting one is easy. The person had 4 years to do something, so yes, it is feasilble. I'm not sure how that helps. If you feel that the threat and risk are too high, then do dispose of the hardware. – schroeder Jul 11 '18 at 14:14
  • Here are descriptions of samples: blog.virustotal.com/2016/01/… – schroeder Jul 11 '18 at 14:17
1

It is feasible. It is true that the BIOS requires a very "low level" or deep understanding of machine code and the actual hardware systems themselves. It's possible he could have written one... but much more likely he could have -found- one and installed it.

Wipe/reinstall the BIOS. This may or may not be possible based on your vendor. If you can fully re-install, do it. Also, most likely if you do have something, it calls files on the drive. Check out this article: https://www.theregister.co.uk/2011/09/14/bios_rootkit_discovered/

-Then do not turn it on- Take the hard drive out and put it in another computer and wipe it. Do not boot from it. Then reinstall ubuntu. It is possible that the virus will re-install to the bios from the hard drive.

But before all of that, if you think your computer is being "monitored" I would highly suggest reviewing your outbound connections. It will have a "shell" that calls out to some server on the internet to give the info to the monitoring computer. Monitor these outbound connections and if you can verify them all, you're probably fine. https://kb.iweb.com/hc/en-us/articles/230267788-Detecting-Malicious-Processes-in-Linux

Also that's an old computer; might be time for an upgrade anyway. Piece of mind is nice.

  • Don't many modern notebooks use BootGuard, though? – forest Jul 12 '18 at 2:39
  • @forest Great question. 2 things, 1: his comp is from 2010 doesn't have a haswell which is where bootguard was introduced. 2: Check out the article below; a lot of bootguard working is based on correct usages from the OEM builders. That said, we are moving towards firmware security across the space. Google's triton chips or some of the things xilinix is working on. medium.com/@matrosov/bypass-intel-boot-guard-cc05edfca3a9 – bashCypher Jul 12 '18 at 16:12
  • @KrisBlouch Thank you very much for your reply, I'll follow the instructions provided. I just discovered my BIOS supports a "Legacy Mode" and a "UEFI Mode". The latter has a Secure Boot feature. Since Ubuntu now apparently supports Secure Boot, I all also consider if it's worth activating it (apparently not haha) – Mr L Jul 13 '18 at 1:34
  • 1
    @MrL Secure Boot and BootGuard are different. The former will not protect you from compromised firmware. – forest Jul 13 '18 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.