1

What steps can I take to detect if a brand new computer has been compromised?

Would it take an actor with significant resources to compromise a system and still have it appear to start the standard Windows set up wizard? Partly I ask this because I wonder if reinstalling the operating system would help or if anyone who could compromise the system in this way could also compromise it (through the BIOS) such that a reinstall would still not help.

I ask because I just received a brand new laptop in the mail that arrived in a box with the only seal compromised (i.e. I could open the box and remove the laptop without cutting any tape or breaking any seal). I tried to ask a question in the least subjective way I could but please comment if you can suggest a less subjective form of the question or can recommend a better forum asking about this than Stack Exchange.

1
  • 2
    I would send it back if the seal wasn't intact. Not only for security purposes, but because a new product I have bought was not new. Dec 8, 2014 at 14:11

2 Answers 2

1

I would suggest that you re-install the OS to reduce the probability of a compromised system. It is relatively trivial to modify the windows image to include malware and then install it on your machine. Software such as NTLite is frequently used by OEMs to install antivirus trial versions that come with the machine. The same software can be used to pre-load malware onto the machine.

Although very rare, there are instances of malware affecting the BIOS. You could download the latest BIOS firmware image from the manufacturer's website and flash it.

1
  • Thanks, I'm looking into how to do this. The computer has UEFI and secure boot. So is the concern that malware has been installed on Windows and not that Windows itself is compromised (secure would interfere with that)? I think will burn a Windows install DVD to avoid any chance of an install USB being modified when I plug it in. I only see a BIOS update program on the Lenovo website. Since you say that that is rare, perhaps I should avoid changing the BIOS since the risk of me bricking the machine might be high.
    – ws_e_c421
    Dec 12, 2014 at 11:45
1

For the argument's sake, there are few attack vectors in this case. I'm listing these just to cover the topic, not to suggest that these are very likely scenarios in your situation:

  1. The easiest one is altering the existing OS, installing malicious software. This is easy to fix by formatting the drive and using original installation media and something you really should do. I suggest that the formatting should be done with Linux live-cd to prevent any possibility of the malware being able to infect the installation media.

  2. Not very likely at all, but it is also possible to attach an additional device to the computer, such as USB or PCI-e device. This type of device could infect the machine even after reinstalling the operating system. There has been recordings of surveillance-bugs installed into JTAG-programming header located on the motherboard, used to gain full access to the whole system. Malicious devices can be detected by checking every port on the machine, also the ones under the service-flaps, for any suspicious objects that looks like it should not be there.

  3. Specific type of malware target the BIOS, also mentioned by @limbenjamin, making the malware able to hide from antivirus-software. BIOS malware is rare but effective, if it manages to infect the machine correctly. Sometimes this type of malware is not clever enough to infect the BIOS and keep it functional, preventing the machine to boot up at all. Reflashing BIOS is good measure for this type of malware, but keep in mind that flashing your BIOS with OS that is infected by the BIOS-malware may actually result into infecting the machine again. I suggest flashing the BIOS with Linux live-cd to prevent the malware re-infecting the machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .