How can I know if a pc has a backdoor in bios, and how to know if there is an hardware malicious impairment?

  • By reverse engineering everything in them. This is presumably not practically achievable, so in the end it is based on trust. – Esa Jokinen Aug 8 '20 at 18:51
  • ok. And if I reset bios, would it remove any existing backdoor or malicious impairment in bios? – john Aug 8 '20 at 18:52
  • No, if a BIOS is really affected then the malicious code is never stored in the SRAM that can be reset. – Robert Aug 8 '20 at 19:07

TL;DR you probably can't.

You need to compare the BIOS code with a known clean source. This can either be an original version of the exactly same BIOS, or a "clean" copy you get through reverse engineering. Or you can reflash the BIOS with the clean version; you'll never know whether there was a backdoor, but now it ought to be gone.

This latter technique (reverse engineering) is extremely expensive due to the time and knowledge requirements, and it might find both false positives (i.e. you find sequences of "dirty" code, but they are not backdoors), supernumerary positives (i.e. you find errors in the code that constitute a backdoor, but they were not intentional - they weren't the backdoor you're looking for), and false negatives (you do not find a subtle error in the code that, in the appropriate set of circumstances, allows a backdoor to fire. The error might again be unintentional, or not). The former technique requires that you do, indeed, trust the original supplier.

Mostly the same goes for the hardware, except that it is even more difficult to reverse engineer the hardware without also rendering it useless. This is something you might do in procurement, if you really needed to be sure of some device. So you disassemble the device and test every single component to verify it performs up to spec.

Trouble is, of course, that when some components have "intelligence" (in the form of a BIOS of their own), such tests are inconclusive. For example, I could engineer a chip to detect and survive voltage spikes. You subject it to said spikes and it survives. But what you can't know without disassembling its BIOS is that a train of seven spikes in a "shave-and-a-haircut" will trigger the disabling of the protection. So, if I can induce a train of eight crafted spikes in the power supply, the component will fail, all tests notwithstanding.

As an example I give you a modern SATA hard disk. It has a BIOS of its own, and computing power to burn. There is a guy that succeeded in running a whole Linux kernel off a SATA interface. How could you test such a disk without disassembling its onboard controller and reflashing its memory? Which you can't do without a good bit of soldering.

Not the answer you're looking for? Browse other questions tagged or ask your own question.