Can TPM (trusted platform module) be used to verify if a used laptop's bios, the bootloader and related components have not been tampered with in the past, i. e. whether those components are still in their factory setting state? Or can a TPM only detect whether there has been a change with those components after it has been activated (by me)?
1 Answer
A TPM can only tell if the BIOS and related components have been changed since the TPM was activated. If something has been changed, it can't tell what was changed or when it was changed, nor can it tell if the BIOS was tampered with before the TPM was first activated.
-
Is there any other way I can be sure a used laptop is safe as far as it's bios, bootloader etc goes? Or do I simply have to buy a new one?– ManuelCommented Dec 6, 2018 at 2:31
-
@Manuel You can use an SPI programmer to flash a known-good copy of the BIOS to the flash chip.– forestCommented Dec 6, 2018 at 2:40
-
Thanks! Such an SPI programmer tool seems to cost almost as much as the difference between a new and a used laptop (~ 250 USD). And I would have to invest time to learn it.– ManuelCommented Dec 6, 2018 at 5:23
-
@Manuel There are cheap SPI programmers out there, but you're right, you'd have to learn how to work it.– forestCommented Dec 6, 2018 at 6:45