-1

The ASUS motherboard in an older PC I own failed. I purchased a replacement from a vendor on eBay, shipped from China (Shenzhen). Only after receiving the motherboard did it occur to me to wonder about the security of the motherboard, and in particular the BIOS installed.

Am I being unnecessarily paranoid?

My main concern is that while I can use the motherboard's built-in utility to re-flash the BIOS before I ever boot the replacement motherboard to any OS, the BIOS always will have oversight of the flashing process. If the BIOS is compromised, all bets are off. I have no way to force it to accept a known-good version of the BIOS.

This concern seems to be reinforced by the Information Security Q&As Malware that can survive BIOS re-flashing and Could once infected machine be ever trusted again?. Though, I had to chuckle at the IMHO-plausible statement in the latter that:

"A possible answer is that if the attacker managed to plant some malware which resisted a complete machine reinstall, then he probably deserves to stay there. At least, this piece of malware has been written by someone who is technically competent".

I feel that there are points of consideration that should allay my fears:

  • I am not a target of interest. A vendor installing malware on a used motherboard I purchased would be doing so only speculatively.
  • There are dozens of different BIOS vendors, and countless versions of BIOS firmware, taking into account all the different motherboard manufacturers and the various models they produce. It's probably impractical to design malware for all these different configurations, so the possibility of malware existing for this particular motherboard seems relatively low (though of course not impossible).
  • If "used motherboards with malware in the BIOS" were a thing at all, it seems like I would've read something in the various computing-related news about even one example of this. But I haven't. Even the originally reported "BadBIOS" that prompted the first cited question above has not been verified, and I'm not aware of any other reports of BIOS malware in the wild that resists overwriting during re-flashing, never mind this being a concern with respect to motherboards purchased as used/salvage.

And of course, there's the suggestion in that other Information Security answer that even if the motherboard is in fact infected with such a virus, that I can at least take comfort in the fact that achieving that level of infection requires enough technical competence that it's likely it at least works as intended, even if maliciously. :)

Are these points valid reasons to go ahead and trust the used motherboard? If not, is there some means by which I could reliably verify that the known-good BIOS I attempt to install does in fact get flashed to the firmware correctly?

17
  • 5
    If your only indicator of potential malfeasance is that you bought the product from China, you should probably have a think about your personal biases. – Polynomial Aug 31 '20 at 0:39
  • 1
    While all your concerns are certainly possible, unless you are a high enough profile to be a Nation State Target, the most likely risk is receiving a defective product and not being able to get your money back. A little monitoring of the network traffic from another machine should catch rogue connections. There are numerous BIOS checking programs that may make you feel better. – user10216038 Aug 31 '20 at 0:40
  • @user10216038: "There are numerous BIOS checking programs that may make you feel better" -- it would help if you would elaborate on that, given that that would directly address a key element of my question. – Peter Duniho Aug 31 '20 at 0:46
  • 1
    @Polynomial: "If your only indicator of potential malfeasance is that you bought the product from China" -- only indicator? Hardly. Pre-installed malware would be a concern regardless of who was selling the used board. But there is plenty of evidence that there are nation-sponsored malware attacks. I'd have the same concern if I lived in Iran and had purchased a motherboard from a seller in the US. Your accusation of bias is irrelevant and unconstructive. – Peter Duniho Aug 31 '20 at 0:52
  • 4
    @PeterDuniho then, if this specific locale is not a factor, why is it mentioned? Why is the locale a factor at all? Your title and your intro are all about your unease about the locale, which makes your bias absolutely relevant. And since you have already found the posts here that talk about the technical risks, issues and mitigations, and you still want to ask the question, with specific mention about the locale, then it does, indeed, appear that your trust is not about the technology, but the nationality of those who sold it to you. – schroeder Aug 31 '20 at 8:28
1

Trust is scalable. If you flash the BIOS, you could probably trust it to within whatever tolerances you like - perhaps you would personally trust it completely at that point. Only you can do your risk assessment. You said you're not a target. Maybe you're still a little uncomfortable, so maybe you trust it with credit card payments but not log into your bank or any true PII (personally identifiable information like ssn, etc)

Please take into account that vulnerabilities deliberately left behind by a manufacturer are open to potential exploitation by other actors; a corrupt action by a factory employee on multiple systems could be sold to a cybercrime gang for botnet purposes, so "target" might become irrelevant.

Maybe initially set it up on a little isolated private network with a packet sniffer going, and see if it tries to "call home" before using it anywhere open.

1
  • Flashing the BIOS is a function of the BIOS. It could easily fake an update process. – schroeder Aug 31 '20 at 8:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.