The ASUS motherboard in an older PC I own failed. I purchased a replacement from a vendor on eBay, shipped from China (Shenzhen). Only after receiving the motherboard did it occur to me to wonder about the security of the motherboard, and in particular the BIOS installed.
Am I being unnecessarily paranoid?
My main concern is that while I can use the motherboard's built-in utility to re-flash the BIOS before I ever boot the replacement motherboard to any OS, the BIOS always will have oversight of the flashing process. If the BIOS is compromised, all bets are off. I have no way to force it to accept a known-good version of the BIOS.
This concern seems to be reinforced by the Information Security Q&As Malware that can survive BIOS re-flashing and Could once infected machine be ever trusted again?. Though, I had to chuckle at the IMHO-plausible statement in the latter that:
"A possible answer is that if the attacker managed to plant some malware which resisted a complete machine reinstall, then he probably deserves to stay there. At least, this piece of malware has been written by someone who is technically competent".
I feel that there are points of consideration that should allay my fears:
- I am not a target of interest. A vendor installing malware on a used motherboard I purchased would be doing so only speculatively.
- There are dozens of different BIOS vendors, and countless versions of BIOS firmware, taking into account all the different motherboard manufacturers and the various models they produce. It's probably impractical to design malware for all these different configurations, so the possibility of malware existing for this particular motherboard seems relatively low (though of course not impossible).
- If "used motherboards with malware in the BIOS" were a thing at all, it seems like I would've read something in the various computing-related news about even one example of this. But I haven't. Even the originally reported "BadBIOS" that prompted the first cited question above has not been verified, and I'm not aware of any other reports of BIOS malware in the wild that resists overwriting during re-flashing, never mind this being a concern with respect to motherboards purchased as used/salvage.
And of course, there's the suggestion in that other Information Security answer that even if the motherboard is in fact infected with such a virus, that I can at least take comfort in the fact that achieving that level of infection requires enough technical competence that it's likely it at least works as intended, even if maliciously. :)
Are these points valid reasons to go ahead and trust the used motherboard? If not, is there some means by which I could reliably verify that the known-good BIOS I attempt to install does in fact get flashed to the firmware correctly?