In working with a number of non-profit organizations, devices such as routers that may have been used by other businesses are often acquired. Equally, devices are often inherited through other channels e.g. donations
What are the methods if any in determining if devices such as routers have been tampered with both from a hardware and software perspective?
The threat model includes the following scenarios;
- Compromised operating system
- Modifications to firmware e.g. modding
- Malware infections e.g. VPNFilter
Does resetting the device overcome 1 and 3?
Can monitoring traffic on the device help identify malicious traffic that may be an indication of a tampered device?