How do you know a computer is not compromised when you first get it? How do you know that manufacturers have not intentionally built vulnerabilities into the system?

  • 1
    Apart from manufacturers, a system may have been in use and therefore compromised for a period ranging from brief (some testing was done) to quite long (I got a bargain on a shop display model once, on which the large number of pornographic pop-ups and attempts to dial out to various numbers made its being compromised quite obvious).
    – Jon Hanna
    May 27, 2014 at 11:13

2 Answers 2


You don't. Some vendors do indeed ship backdoors with their products, and many computers come with "crapware" pre-installed as a source of revenue for the manufacturers. Even apps that don't contain a backdoor can cause other damage (e.g. Browser toolbars that track browsing).

Same concerns apply with hardware, especially in networking equipment.

What you can do:

  1. Re-install a "clean OS" onto any new computer. This probably means buying a new, vanilla copy of an OS that you have already paid for (the factory image that ships with the computer will also contain the original "crapware", unless you pay extra to not have the crapware).

  2. Re-install a more trusted OS onto a new computer (unless you write your own OS, you have to trust someone at some point). Ubuntu, Security-Enhanced Linux, whatever you trust.

  3. Use only hardware that you trust. This usually means avoiding hardware that is made in countries hostile to yours. Huawei (a Chinese networking equipment manufacturer) is finding it difficult to prove that it is trustworthy enough to supply some governments.

  • 3
    In many cases, even if you don't have clean installation media, it's possible to use the CD-key from the computer with different installation media (at least with XP, you just need the right service-pack version as the CD key. I'm not sure if it's changed with W7/W8)
    – Fake Name
    Jan 16, 2013 at 6:07

You don't. Most of the alleged backdoors have been software problems (Google for _NSAKEY, or Digital Encryption Standard and NSA interference, or Huawei and back doors), but a hardware backdoor isn't out of the question. The issue of concealing "intellectual property" or other concerns in proprietary software or hardware make this problem worse.

If all hardware were open, and you could get schematics and trace them out, you could ferret out hardware compromises. Via Diverse Double-Compiling, you could detect software compromises, provided the software was open source.

It would be pretty costly to do hardware and software verification. Since "security" is an economic good, with a price and a value, we all decide what value trusting hardware or trusting software gives us, then see if the price is less than the value. For some, the value isn't so great. Microsoft has let the government of China look at Windows source code. Presumably, it was worth it to the People's Republic to pay Microsoft for that privilege, and to pay their security experts to go through the code.

  • 2
    +1 here for diverse double compiling. I'm still surprised the world at large is not aware of how important this is. At least the GCC project is others are using it to confirm there are no hidden backdoors in the compilers themselves. So anybody using GCC should be ok.
    – mjuarez
    Aug 3, 2014 at 17:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .