2

For security reasons, I have this question in mind. I am not a security professional, so I want to ask:

Let's suppose my computer's firmware is hacked. If I disable the wifi driver on windows, can a kind of virus (hidden driver software does not appear in device manager), or the firmware (if infected) use the wireless device to connect to the internet without overriding the old driver? And can it hide itself from the device manager?

1
  • Does disabling the Wi-Fi driver on Windows put the NIC into D3 cold (no current through PCIe)? If not, then in theory it could still communicate with the network without involving your computer.
    – forest
    Jan 21, 2021 at 2:22

1 Answer 1

1

Can drivers?

Yes. Most Windows (and Linux and Mac) drivers run in kernel mode and have full access to the operating system, including the parts that store the list of drivers. They can erase themselves from that list (and similar lists) and still continue to operate. It would have to be done on purpose, maliciously.

Plus, Device Manager shows devices, not drivers.

Plus, the driver is the one that knows whether the device is enabled! It could pretend to Windows that the device is disabled, while actually it's enabled and transmitting spy data.

"forest" mentioned in a comment that some hardware can be turned off. Of course even a driver can't use the hardware if it's turned off. I strongly suspect the driver can turn it back on without Windows noticing.


Can firmware?

Yes. Except if the device with the firmware is turned off (as pointed out by "forest"). If your wi-fi card is turned off (no power) then it doesn't matter what firmware's on it. If it's turned on though, it can do evil stuff. If it's different firmware that's infected (like your BIOS/UEFI) then it can turn on the wi-fi card and then do evil wi-fi things.

Firmware doing evil wi-fi things and drivers doing normal wi-fi things would be likely to clash with each other and cause the wi-fi card to stop working properly, so it's not likely, but it's possible.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .