-1

Suppose you need a laptop repair, so you bring it to

  1. A big box store where you have some sort of coverage (who will have the computer for 2-3 weeks)
  2. A small chain of repair shops
  3. a small independent repair shop

All in the United States. Now, we are going to assume you cant practically perform the repair yourself without damaging the machine (perhaps anti-tampering mechanisms are built into it)

Now normal attempts at avoiding the evil maid usually involve some tamper-proofing or taking physical measures to be able to check if the computer has been tampered with, or even doing something like using radio waves bouncing around inside the case to check if something has changed (saw a paper/article on that somewhere) or using a wire where if the connection is interrupted takes some sort of an action (shutting down, notifying the owner somehow, etc.)

However, here, the laptop will be "tampered" with intentionally.

Particularly for the big box store, they typically don't do board-level repair; rather, they do a somewhat ham-fisted approach of replacing components like a laptop motherboard with CPU + GPU + TPM on it or replacing the entire machine.

There are some reasons to think that getting a computer repaired requires a security evaluation:

  1. Snooping/stealing your data 0 1
  2. (Tinfoil hat) Cooperate involvement with spooky government agencies for (possible):
  • Mass surveillance (primary concern)
  • Because the repair shop has contracts with government agencies/military/security contractors/etc.
  • (Fairly legit but should probably have your consent too/inform you) Law-enforcement reasons like in this article
  1. Set up a botnet or other malicious intents (probably by a rouge employee or malicious shop)

I shudder to think what malware/spyware they might install, what they use to search the computer, or even what new compromised hardware they might install. Goodness, I have heard of people saying you should not bring a laptop to China 1 2 3 4 or one can get a rootkit just from plugging a phone into an unknown USB device. I can't imagine if an "adversary" knowingly has full physical access for days or weeks!

The primary interest for doing this vs. a supply chain attack in the first place would be to exfiltrate data after the machine has been used. I am unsure if there is any additional intention for installing extra surveillance mechanisms/malware for mass surveillance beyond what already might be there through the supply chain (e.g., likely, Intel ME, AMD PSP, or Windows).

So suppose I use secure boot and can verify my OS is fine; the boot firmware/BIOS/UEFI could always be compromised, or new hardware could be installed that I don't know about (ignored by the Evil Maid firmware/bios/don't know exact terms/etc. intrigued by this answer, but iirc MBR is an old Windows/DOS "standard" before UEFI, and I don't know if this applies to types of ROM or firmware that might be installed in various chips on the board).

Also, the TPM may have been replaced (or compromised), so I may not even be able to verify my OS (or trust such verification).

In extreme cases, the CPU/GPU/TPM or other chips could be removed and hooked up to a JTAG device and compromised or replaced with identical-looking malicious counterparts (same with other chips on the MOBO or elsewhere in the computer, especially in hard-to-inspect regions)

Assuming I am within a standard deviation of "interesting" (no more interesting than anyone else), I'd like to know how to achieve a reasonable amount of relative security (by auditing, or taking steps before the computer goes out, or things I can do when it gets back); and by relative, I mean no worse than before (regardless of spyware, Intel ME, etc., was installed on the machine before). Basically, ensure that what I shipped out was what I got back (just possibly with some replaced parts, but those parts are not compromised).

Here is what I am thinking:

  1. Remove any disk (SSD/HDD) before sending it out
  2. Remove RAM (if it does not require a boot, post can be checked, and they will take it) if you can (some RAM might be soldered to the board)
  3. If you can't remove RAM, run some process that takes a lot of RAM to ensure that secrets are not still in there (like passwords) but have no secrets/important info itself (possibly overwrite memory).
  4. Document the device: copy codes, serial numbers, etc., on as many chips inside the device as possible, and take as many pictures of the boards as possible (though there may be some that are inaccessible, particularly in a laptop)
  5. (And this one I need help with) Dump all firmware, ROMs, BIOS/UEFI images that you can, and create checksums: The issue with this is that there could be a legitimate update, say to a new UEFI version, or you have a slightly different version of the board. You could try to diff the binary to see if substantial portions were changed, but if malware existed before, suppose, and a flag was flipped to switch it on, so you could not tell, you might not know. So you cant fully tell, but you can limit certain things. Here, I would like to ask how this can be done, especially with minimal hardware If possible, I would like to use the computer. If this is impossible, it is something like an RPi or simple-to-build circuit, but nothing too expensive.
  6. Social Engineering: Tell an employee to make a note that you will audit the computer after you get it back to make sure things are the same (perhaps specifying certain measures you will take). This could easily backfire, though, and make you more suspicious and make you more thoroughly investigated/a target for any spook that may (or may not) be going on.
  7. Make a specific request(s): i.e., "Please preserve the TPM" and "Please make sure the same BIOS version is used."

Are there any other possible threat modeling/countermeasures people can think of (extreme or reasonable)?

3
  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer.
    – Community Bot
    Jan 31 at 9:11
  • The assumption that there is a person that cannot repair a simple problem with a device on a mom-and-pop shop level, but can check and remove expert tampering, is a little far fetched.
    – nvoigt
    Jan 31 at 18:44
  • @nvoigt Your likely correct about that
    – SurferTaco
    Jan 31 at 23:08

2 Answers 2

2

When you think about security you must always think about what kind of threat you are trying to protect against. What works against a script kiddie on the internet might not work against a more advanced threat. The tone of your question implies that you are trying to protect against something similar to a highly motivated nation state with full physical access to your machine.

There is no protection against that.

You could just trash the machine and get a new one instead. But how do you know that the new one has not been tampered with? Or how do you know that the old one wasn't already tampered with when you bought it? It's turtles all the way down.

Some precautions - like removing the SDD - may be sensible against a less motivated or capable threat. But imagine an advanced enough threat, and all defences becomes pointless.

4
  • If you buy new - and don't assume the vendor is in on it, buying in a random store in cash may be a viable strategy. Walk in, pick the box yourself, pay and walk out.
    – vidarlo
    Jan 31 at 16:23
  • @Anders your right about that, based on your feedback I edited the question to have the parameter that I'm not that interesting to a state actor (I don't think I am). So motivation I would imagine would likely be within a standard deviation or two of the average/median (not super "highly motivated", and accounting for the variance of those with technical knowledge). I also edited the question to more strongly emphasize that I am looking for relative security (as defined in the question). i.e the machine I sent out is roughly the machine I got back, and its not much more or less comprised.
    – SurferTaco
    Jan 31 at 23:06
  • And by "same" I account for replaced parts so long as they are similar enough and are not sufficiently more compromised than before (e.g they don't include a new evil maid... at least to the degree that I could detect one in the first place).
    – SurferTaco
    Jan 31 at 23:08
  • It's somewhat unlikely that an attacker which is not highly motivated would bother with such an extensive and expensive attack... Just learning the fact that your laptop is in for repair requires rather invasive surveillance.
    – vidarlo
    Feb 1 at 8:35
0

How might one audit a machine upon return from a repair shop of any of (or all of) the types listed above, or fix a compromised device, prevent the device from being compromised, and what needs to be done before the device is sent out?

You can't.

It's impossible for you to know if the CPU silently copies memory and ships it off to some remote server. The functionality required is built into modern CPU's, and you can't know what firmware that subsystem runs.

If you can't trust your hardware supplier, you can't trust your hardware, and trusting anything that runs on that hardware is meaningless, as the hardware can lye to the operating system. The TPM can tell you that a measured boot was fine, if it wants.

So, if you assume that the repair shop is an active attacker you can't trust the device after getting it back.

Additionally, given the lengths you're willing to go to, e.g. remove drives, RAM, note serial numbers and so forth, my conclusion is to not repair the laptop, but destroy it and buy a new one (in cash, in a random store not in your neighbourhood, where you can pick the box yourself etc). The attack is only ever likely if you're a very high profile target, and in such a case repairs doesn't make sense.

2
  • Thank you for the reply, I removed the part of the question you quoted as it is too vague and unnecessary. I tried to clarify a bit. Yes your right, if you cant trust the hardware suppliers you cant trust the computer, even if you dont trust the hardware supplier, there is only so much you can do. I am interested in a relative level of security, e.g the laptop I sent out is basically the laptop I got back (the components, firmware, etc. are basically the same).
    – SurferTaco
    Jan 31 at 23:01
  • I wouldn't even bother. Unless you have data that is worth significantly more than the laptop to someone, such attacks won't happen. If you have such data, don't hand the laptop in for repair.
    – vidarlo
    Feb 1 at 7:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .