PC Isolation on network

Question

I believe I have my answer but I just want to be sure. Basically I repair computers, most of unknown origins. Of course some could have viruses and such so I was wondering what the most efficient way of achieving some sort of isolation would be. I seen someone recommend having a second router. This interested me because I do actually have 2 routers one running on 192.168.1.x (the main router) then a private router in the back of my house which I use running on 192.168.2.x I have noticed that I can't talk to the devices on router 1 and vice versa. Will setting up a 3rd router on 192.168.3.x provide sufficient isolation (of course I would only connect the test machines to this). Currently I try to avoid any sort of network access on most machines however in some cases (repairing others PCs) this may not be an option. If this isn't a sufficient solution then can you please provide me with one and preferably one that won't kill me (cost wise) assuming the recommendation includes purchasing hardware firewalls for a DMZ or something alike.

On a side note, I'm aware of some viruses which like to stick around even after a simple formatting. Will a zero fill tool like autoclave get rid of those? Is there another method to ensure that an HDD is clean of all viruses?

Answer 1

Firstly; the devices connected to multiple routers not being able to communicate; is most probably due to a configuration problem. It could also be due to the router being too limited in capability that it was not able to perform as you need it to.

However, be it as it is, what you need is traffic limitation for malware on one computer too.

What the malware could do in theory is that it takes over one of the routers too, automatically, then reconfigure it to get connections to the other routers/computers... as router firmware is not exactly the pinnacle of secure software, and the average home user makes next to no software updates ever for a router, it might be very easy.

This is all dependent upon "if" the malware is programmed to do that, and knows vulnerabilities for your router models of course.

What is "sufficient" for you is something we can't know - are you willing to take the risk of getting router-hacking malware, or would you invest time and money to get a more secure router? Only you can decide that.

Regarding the more secure options, there are several business-class device vendors that actually fix security bugs and make updates available regularly, and there also are open systems like OpnSense which can be installed on your own (capable) device (and also are maintained well).

If you're looking for an "if you do this, then you're fine", then I have to disappoint you - even with the best possible security, there is always some risk.

---

Finally, about autoclave (which normally should be in a separate question): Stop right now. The developer ended work on it about 15 years ago, but the world moved on with newer technologies.

If you want something that is doing the same work (which is not sufficient to completely wipe a hard disk!), install some Linux on an Usb drive, plug it in in the computer you want to wipe, and use dd with /dev/zero on all hard disks.

The problems with this: There are SSDs with wear levelling etc., A solution you would like is to use ATAs SecureErase feature. Depending on Bios etc. not entirely straightforward. Then each modern hard disk has areas that can only be accessed with some vendor-specific commands, normally used for storing various metadata and/or being reserve space. Malware data can be there too. And finally, malware doesn't need to be on the hard disk at all.

Making 100% sure that there is no malware, without eg. melting the computer, is just impossible.