2

I bought my computer in 2011. From 2011 to 2015 the computer was accessible to a cousin of mine who is a developer. He doesn't work with IT security, but has more than a decade of experience programming.

I have reasons to believe he might have installed some monitoring software on my computer, around 2011-2015, when he had physical access to the device. My cousin is very manipulative and always envied me. A friend of my parents strongly implied to me they at least one time searched my computer to see what I was doing. But if they installed something, I always thought it would be software only.

Since then, I have reinstalled the OS (Ubuntu) a few times and I also replaced my HDD. So, keyloggers or other malicious software are not a problem. What I am thinking is an infected BIOS or other hardware.

How easy is to an experienced developer to develop (or to acquire) a BIOS or hardware virus to target a single computer? Should I throw away my computer? Just flashing the bios again will be good enough?

I already read a lot of answers about BIOS virus and how it is not worth the trouble because every single manufacturer will have its own design etc. But I'm thinking about someone trying to access a specific computer, not a wide attack.

Improve this question
2
  • 1
    Developing a BIOS virus is very difficult. Getting one is easy. The person had 4 years to do something, so yes, it is feasilble. I'm not sure how that helps. If you feel that the threat and risk are too high, then do dispose of the hardware.
    – schroeder ♦
    Commented Jul 11, 2018 at 14:14
  • Here are descriptions of samples: blog.virustotal.com/2016/01/…
    – schroeder ♦
    Commented Jul 11, 2018 at 14:17

1 Answer 1

Reset to default
2

It is feasible. It is true that the BIOS requires a very "low level" or deep understanding of machine code and the actual hardware systems themselves. It's possible he could have written one... but much more likely he could have -found- one and installed it.

Wipe/reinstall the BIOS. This may or may not be possible based on your vendor. If you can fully re-install, do it. Also, most likely if you do have something, it calls files on the drive. Check out this article: https://www.theregister.co.uk/2011/09/14/bios_rootkit_discovered/

-Then do not turn it on- Take the hard drive out and put it in another computer and wipe it. Do not boot from it. Then reinstall ubuntu. It is possible that the virus will re-install to the bios from the hard drive.

But before all of that, if you think your computer is being "monitored" I would highly suggest reviewing your outbound connections. It will have a "shell" that calls out to some server on the internet to give the info to the monitoring computer. Monitor these outbound connections and if you can verify them all, you're probably fine. https://kb.iweb.com/hc/en-us/articles/230267788-Detecting-Malicious-Processes-in-Linux

Also that's an old computer; might be time for an upgrade anyway. Piece of mind is nice.

Improve this answer
4
  • Don't many modern notebooks use BootGuard, though?
    – forest
    Commented Jul 12, 2018 at 2:39
  • @forest Great question. 2 things, 1: his comp is from 2010 doesn't have a haswell which is where bootguard was introduced. 2: Check out the article below; a lot of bootguard working is based on correct usages from the OEM builders. That said, we are moving towards firmware security across the space. Google's triton chips or some of the things xilinix is working on. medium.com/@matrosov/bypass-intel-boot-guard-cc05edfca3a9
    – bashCypher
    Commented Jul 12, 2018 at 16:12
  • @KrisBlouch Thank you very much for your reply, I'll follow the instructions provided. I just discovered my BIOS supports a "Legacy Mode" and a "UEFI Mode". The latter has a Secure Boot feature. Since Ubuntu now apparently supports Secure Boot, I all also consider if it's worth activating it (apparently not haha)
    – user181910
    Commented Jul 13, 2018 at 1:34
  • 1
    @MrL Secure Boot and BootGuard are different. The former will not protect you from compromised firmware.
    – forest
    Commented Jul 13, 2018 at 10:51

You must log in to answer this question.