If you are buying used device, laptop or game console, or a smartphone - what are the best practices for checking it’s security? How to check if device’s HW wasn’t modified or it is not coming with malware preinstalled by previous user?

  • You can't determine hardware changes. A factory reset or a format and reinstall is your best option. – schroeder Jul 26 '20 at 8:07
  • 1
    Writing best practices for this might not be easy, because it depends on the risk analysis. I'd buy a used NES and play with it anytime: it doesn't contain any sensitive data nor is it even connected to networks. On the other end there might be a smartphone containing all the TOTP keys for every MFA. Most of the devices are somewhere in between. – Esa Jokinen Jul 26 '20 at 9:15
  • @EsaJokinen but still there are a tons of devices, capable of connecting to the internet, thus I’m really concern, how to check if it is safe to use them in my home network. Of course, really ancient devices like NES or Game Boy are pretty safe by definition, but newer ones, like PSP, or used PS3 can potentially carry security risks. – MrSnowMan Jul 26 '20 at 9:56
  • 1
    That's one more thing that makes your question even more broad: is the goal to secure the data used on the device, or secure your network from possibly harmful traffic from the device? If you decide not to trust a device, you can control which data you handle with it. Securing the network is another subject, and can be achieved using network segmentation, although it's not (yet) so popular on home networks. Personally I do have separate, isolated networks e.g. for all game consoles, whether they are new or secondhand. – Esa Jokinen Jul 26 '20 at 10:12
  • @EsaJokinen I more looking for a simple checklist, which describes steps I should take after I bought an old device. – MrSnowMan Jul 26 '20 at 11:01

Browse other questions tagged or ask your own question.