How to check 2nd hand hardware does not contain malware?

archuser38013 · 2024-05-13 09:13:26

I do like the idea of picking up bargains 2nd hand and bringing them back to life.

I don't like the idea that none store bought hardware is more likely to be compromised.

Are there ways to check to a reasonable level of confidence that devices you buy are clean?

If so how?

Also must it be done on an airgapped, none internet connected, machine or would booting into a vm/livecd suffice?

jl2 · 2024-05-13 10:24:10

most likely it would be in the hard drive, then booting from usb to check wouldn't be a problem (just don't mount the drive/check it first and don't execute anything from it)
And since you would either way dump it's contents and install Arch on it, not a really big problem.

If it's been nested into firmware (very unlikely, but still), I don't even know how to detect it.

Are there ways to check to a reasonable level of confidence that devices you buy are clean?

no, you simply check the dude you buy it from (for example don't buy stuff from your local russian hacker)

archuser38013 · 2024-05-13 12:47:30

jl2 wrote:

most likely it would be in the hard drive, then booting from usb to check wouldn't be a problem (just don't mount the drive/check it first and don't execute anything from it)
And since you would either way dump it's contents and install Arch on it, not a really big problem.
If it's been nested into firmware (very unlikely, but still), I don't even know how to detect it.
Are there ways to check to a reasonable level of confidence that devices you buy are clean?
no, you simply check the dude you buy it from (for example don't buy stuff from your local russian hacker)

Thanks.

Hmm well what I want right now I can only seem to get 2nd hand anyway. An old style 4g dongle of which the firmware would be the issue.

I did read up about exploits for these things, which returned quite a few hits from the time they were popular, but I don't see how to get it now other than 2nd hand as I have to buy the older models which are discontinued in order to get access to the GSM suite of tools in ModemManager. Much prefer one of these little usb thumb modems than the bulky mifis that are popular these days for mobile internet.

seth · 2024-05-13 17:10:59

An old style 4g dongle of which the firmware would be the issue.

So this is just yet another repost of
https://bbs.archlinux.org/viewtopic.php?id=295542
https://bbs.archlinux.org/viewtopic.php?id=295673
https://bbs.archlinux.org/viewtopic.php?id=295657

All because of
https://bbs.archlinux.org/viewtopic.php?id=295631 which is probably also https://bbs.archlinux.org/viewtopic.php?id=295593

Arch Linux

#1 2024-05-13 09:13:26

How to check 2nd hand hardware does not contain malware?

#2 2024-05-13 10:24:10

Re: How to check 2nd hand hardware does not contain malware?

#3 2024-05-13 12:47:30

Re: How to check 2nd hand hardware does not contain malware?

#4 2024-05-13 17:10:59

Re: How to check 2nd hand hardware does not contain malware?

Board footer