3

My company own some PCs and laptops. The firmware and hardware may have been modified. It is a waste to dispose of that many PCs and laptops.

  1. Are there any scans or anything I could do to determine what PCs or laptops have been compromised?

  2. If there is nothing I could do to determine that, are there parts that could be reused because they cannot be modified?

The adversary is a hacker who works for a mid sized company. It is not a three letter agency or the government.

| improve this question | |
  • 2
    This looks like a hypothetical situation. Why do you suspect an intrusion now? – guntbert Oct 22 '18 at 18:12
  • "Mid-sized company" can mean anything. It could be anything from a small indie game developer to a sophisticated exploit broker with capabilities far exceeding most TLAs, while remaining mid-sized. – forest Dec 22 '18 at 3:03
  • "The firmware and hardware may have been modified" To what extent might this have happened? Do you, for example, have evidence that someone gained access to your company's office and potentially spent all night going from computer to computer installing some modifications, or is it simply a laptop was accidentally left behind at another company's offices where they theoretically had the opportunity to modify it (but you've no evidence, or even real suspicion, that they did do so)? – TripeHound Sep 18 '19 at 8:55
1

Could re-flash the firmware, that should overwrite whatever's there.

I'm not sure what you're looking for in the "modified hardware" department, any extra devices added should be visible from looking, unless you think a chip or device has been de-soldered and replaced with an identical looking "bad" one... practically anything with accessible hardware is vulnerable to that.

There are virus & malware scanners that might detect known samples (like rootkits), but maybe not custom (zero-day) samples

| improve this answer | |
  • 3
    You'd have to reflash from an SPI programmer, otherwise a malicious BIOS could intercept attempts to reflash. – forest Oct 22 '18 at 5:26
1

It is possible but too expensive.

In the case of labtop or PC, root of trust like TPM is required, then you can refer to the below links:

https://crypto.stackexchange.com/questions/59965/tpm-and-remote-attestation

https://seclab.stanford.edu/pcl/cs259/projects/cs259_final_lavina_jayesh/CS259_report_lavina_jayesh.pdf

| improve this answer | |
  • Welcome! It would be better if you would some excerpts of the remote documents. – peterh - Reinstate Monica Aug 19 '19 at 5:37
0

If the firmware is not original there are some paid applications that will compare and check if the firmware that is showing is original - if this is a custom firmware it will not help.

For Hardware, you should easily check if something has been compromised - good point is to install a Traffic Management Tool (free or paid). You can scan what is going within your company network.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.