2

After buying a used computer from a stranger, what steps should be taken to ensure it is safe to use for connecting to a network that handles sensitive information? (I am defining "sensitive" broadly: notes to a loved one, corporate trade secrets, and the location of several of Russia's submarines.)

I am imagining that the system's components should be passively inspected and dealt with in a more active way. By "active" I mean, for instance, repeatedly erasing a mechanical storage device with the assumption that it contains some form of malware.

I am assuming that any used computer may have reparable security problems. The seller may not be aware of those problems. In more extreme cases, he or she may intentionally provide a compromised system.

A common, but of course not universal, situation arises when buying a system on eBay which previously ran Windows but will now be used for Linux.

In the event that a system's issues are actually too severe to repair, it would be nice to know that so that it can be avoided.

1
  • After posting, I noticed a related question. Much of the content there deals with issues introduced when systems are brand new.
    – dark_pixel
    Commented Aug 3, 2014 at 16:29

1 Answer 1

3

For a “normal” computer (eg. may be infected but has no extra malice), booting from CD/usb, wiping the disk and performing a complete reinstall should be enough.

Now, if the CIA is (knowingly) selling you the hardware where you will be storing the location of Russian submarines, you better throw that hardware away. It could do anything from sinply giving you an infected BIOS to modified hardware that sends every single computation performed by your cpu to the team that is performing a TEMPEST attack behind your window.

This reminds me the (probably wrong) information reporting that Russia gave infected usbs to G20 leaders. You can't really be sure you completely cleaned an infected hardware. http://www.telegraph.co.uk/news/worldnews/europe/russia/10411473/Russia-spied-on-G20-leaders-with-USB-sticks.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .