0

The majority of virus/malware is stored and persists on the hard drive, Therefore by formatting the hard drive or re-installing the operating system, the virus is removed.

However, the average laptop also provides other means of infection persistence, possibly via the CPU(cache), Graphics card, RAM, and Motherboard.

How can we check and confirm with certainty that the Firmware of the Graphics card has not been compromised, Or the BIOS, or that the hard hard drive itself has not been infected in a way that reformatting will not remove the infection.

Lastly, How many other angles of infection-persistence exist on the average machine?

1
  • Welcome to the community. I personally asked a very similar question - it's basically any firmware component, but usually it resides in the BIOS, SSDs firmware etc Dec 27, 2023 at 13:13

1 Answer 1

0

That depends on the age of your laptop and its OEM.

For new laptops almost all/most hardware components only allow signed firmware which means wiping your drives is enough to get rid of low level malware.

For older laptops malware may exist in:

  • BIOS/EFI firmware
  • Disk drive firmware (Ars Technica has published information on that)
  • Theoretically (I've never seen it confirmed): GPU firmware, NIC firmware, Sound Card firmware

If your laptop has been in possession of people who are extremely interested in you (e.g. triple letter agencies) they could simply have planted a HW keyboard sniffer or any other HW component to get access to your system (e.g. a PCI-E/DMA device which is capable of reading your RAM directly which is enough to know everything about you regardless of encryption used).

AFAIK new ARM based Apple laptops/touchpads/smartphones have most if not all of their peripherals using signed communication channels, so planting a HW bug on your device is near impossible but I'm pretty sure this could have been already circumvented.

and how to confirm they are not compromised?

For a layman there's simply no way of knowing that. This is extremely high tech/level stuff.

If your HW bug is using normal communication channels (e.g. LAN/Wi-Fi card) having a network sniffer between your laptop and the WAN would be enough to see any unusual activity and signs of compromise.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .