My company own some PCs and laptops. The firmware and hardware may have been modified.

The adversary is a hacker who works for a mid sized company. It is not a three letter agency or the government.

My question is if there is any scans or anything I could do to determine what Pcs or laptops have been compromised.

It is a waste to dispose of that many PCs and laptops.

If there is nothing I could do to determine that, are there parts that could be re used because they are unable to be modified?

  • 2
    This looks like a hypothetical situation. Why do you suspect an intrusion now? – guntbert Oct 22 '18 at 18:12
  • "Mid-sized company" can mean anything. It could be anything from a small indie game developer to a sophisticated exploit broker with capabilities far exceeding most TLAs, while remaining mid-sized. – forest Dec 22 '18 at 3:03

Could re-flash the firmware, that should overwrite whatever's there.

I'm not sure what you're looking for in the "modified hardware" department, any extra devices added should be visible from looking, unless you think a chip or device has been de-soldered and replaced with an identical looking "bad" one... practically anything with accessible hardware is vulnerable to that.

There are virus & malware scanners that might detect known samples (like rootkits), but maybe not custom (zero-day) samples

  • 2
    You'd have to reflash from an SPI programmer, otherwise a malicious BIOS could intercept attempts to reflash. – forest Oct 22 '18 at 5:26

If the firmware is not original there are some paid applications that will compare and check if the firmware that is showing is original - if this is a custom firmware it will not help.

For Hardware, you should easily check if something has been compromised - good point is to install a Traffic Management Tool (free or paid). You can scan what is going within your company network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.