1

Just out of curiosity (and because it sounds fascinating) . With all the Snowden revelations, it sounds like nsa has the ability to infect computers with some sort of spyware.

I'm asumming these guys are smart enough to build something that spyware scanners can't detect. Or is my assumption wrong on that?

Would simple factory reset of a windows laptop remove any malware, if they exist?

2
  • 2
    That ultimately depends on the spyware itself.
    – yeah_well
    Feb 27 '20 at 4:41
  • 1
    A large amount of malware is initially undetected, from criminal tools like Dridex to state sponsored tools. Anti-virus firms update their detection capability multiple times per day to stay on top of new threats. The hard part is staying undetected. Organisations like the NSA operate at much lower volume (in terms of infected systems) than criminal groups, which helps, and one has to assume they also have highly skilled engineers to build and test new capability.
    – David
    Feb 27 '20 at 23:22
2

I'm asumming these guys are smart enough to build something that spyware scanners can't detect. Or is my assumption wrong on that?

Pretty sure they will explicitly design the spyware so that the common scanners will not detect it at the time when the spyware is first released. But this is not only done by government agencies but by others which sell spyware - because obviously it is usually part of the expected product features that it is not easily detectable.

But once a spyware is known it is usually possible to write heuristics which can detect it so any protection against detection is only temporarily. That's why one usually limits a lot how many systems are compromised in the first place so that the chance of the spyware gets known stays low.

Would simple factory reset of a windows laptop remove any malware, if they exist?

Probably for most it would help. But it would not help in all cases or at least not for long. For example it might be possible that the target gets reinfected quickly since the router or other device in the network or some used data storage is compromised too. And if the attacker had physical access to the system the compromise might even be much deeper than what a simple factory reset would resolve.

2

You are basically asking if it is possible to create malware that cannot be detected and cannot be removed.

The answer is "yes", but for a time, until it is discovered.

  • Malware can infect hardware or firmware so that a reset won't help
  • Anyone can use the existing anti-virus to develop new malware to ensure it doesn't get detected
  • A highly-placed government agency can inject malware in the OS by the OS vendor, making the malware an integrated part of the OS - it's just "normal" and anti-virus will not even look at it because it's part of the OS
  • and so many other methods that are even being used by criminal gangs and less sophisticated attackers

But once it is discovered, people will work very hard to develop ways to detect it on a device and remove it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.