1

I purchased a used laptop on eBay. I scrubbed the hard disk to make sure there were no lingering or unknown viruses left on the disk and then installed fresh Windows 10.

But, what about the firmware?

Does Windows Update make legitimate updates to the firmware?

Is there a way to detect that the firmware contains unauthorized modifications?

Is there a way to re-write the flash firmware with factory fresh content?

9
  • 6
    1) Don't worry about it. 2) No. 3) No. 4) Maybe (check with the manufacturer), except that modified firmware could pretend to flash the firmware while remaining unchanged Oct 30 '19 at 20:45
  • 3
    You can't prove a negative. As Conor implies, there's always something else to be worried about if you're paranoid enough. In practice, firmware compromises are stuff that you might worry about if you're an intelligence agency, or do Top Secret work. Oct 30 '19 at 21:20
  • 1
    @ConorMancone 2) yes, they do – windows update includes driver updates, and updated drivers sometimes also update firmware components. Oct 30 '19 at 22:26
  • 1
    Look into SRTM, which is able to verify, with some effort, firmware on a system with a TPM.
    – forest
    Oct 31 '19 at 8:51
  • 1
    @SGSK Secure boot alone has absolutely no protection against firmware-level malware. It can only protect from OS malware, and even then only to a limited extent. And SRTM with a TPM is secure as long as no one physically tampers with it. Malware tends to lack hands and other instruments required to modify hardware, so for a threat model involving malware persistence, it's enough to assume that hardware itself is not modified.
    – forest
    Nov 1 '19 at 21:32
0

"But, what about the firmware?"

Which one? BIOS/UEFI? HDDs and SSDS have firmware too. There is some public and certainly more non public data around on hacking those. Depending on the laptop there could be more devices with firmware or persistent storage like GPU, NICs ... A TPM can help you with BIOS and UEFI. afaik it is no solution for the rest as the firmware runs completely independent from the rest of the OS.

"Does Windows Update make legitimate updates to the firmware?"

No. Usually there some custom tools from the manufacturer of the devices.

"Is there a way to detect that the firmware contains unauthorized modifications?"

You need to get a legitimate copy for comparison.

"Is there a way to re-write the flash firmware with factory fresh content?"

Search around here.

1
  • Doesn’t the “legitimate copy” need to be signed, so you know it’s legitimate? Not every laptop manufacturer signs their firmware though, probably. The name-brand business ones probably do though.
    – ash
    Nov 1 '19 at 19:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.