Hardware/Firmware Security Question

[Yooper]

Do any of you computer aficionados out there in Forumland have any thoughts on hardware/firmware security wrt using off-brand IT?

I have always bought my computers (and other devices that can store/process my personal info) from reputable companies. I do this b/c I work from the assumption that the hardware/firmware is therefore "secure" (meaning, no backdoors in or baked-in routing instructions out that could compromise my PII). I hope that's a safe assumption....

But what if I wanted to toy around with any number of the mini PCs on offer these days at really reasonable prices from companies I've never heard of? (Take, for example, a Guzila mini PC I stumbled across on YouTube.*)

Is it safe to do so? Can I have the same assurances that what the hardware is advertised to be is? That it has not been modified? Are there off-the-shelf ways to check for misbehaving hardware instructions that are available to the non-specialist?

Or is all of this irrelevant b/c ports and instruction sets are ultimately OS driven? Or no, it's not irrelevant, so just stick to the known name brands...?

I ask not because I want to use one of these for my personal computing; rather, I was trying to figure out if it would be safe to add one to my local network for streaming/as a media server/etc. So the device would have some log-in info (let's say, to Netflix or CBS All-Access), as well as access to other devices on the local network that do have PII on them.

This is more a theoretical question than an actual one at this point because I can buy a known-brand mini PC for not too much more than one of these no name mini PCs is going for. But what if I came across a really good deal (like those that always seem on offer during the holiday season) allowing me to buy a "rig" to test out some stuff and wouldn't feel bad if I bricked it? Is there risk? Am I trading actual security for a pittance?

Sorry if this is a dumb question in any regard. But given what I used to do in a previous life on behalf of Uncle Sam and that I have been the victim several times in several ways as a result of the OPM hack several years ago (as well as from some follow-on hacks of our government's computer systems) I have tended toward being hyper(?) vigilant with things like this.

Thanks, in advance, for any input any of you might have.

* Here's the Amazon product page of the one I ran across on YouTube:
Amazon product

--- End of line (MCP)

 

[Grumpy]

Good question, I'm curious also.

 

[GURPS]

Or is all of this irrelevant b/c ports and instruction sets are ultimately OS driven?

From what I have heard the NSA uses some board level hacks to back door access - like having Computrace on your laptop it operates at the BIOOS or hardware level to phone home and reports its location if flagged as stolen

The story never went beyond the Bloomberg article

The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

Sorry if this is a dumb question in any regard. But given what I used to do in a previous life on behalf of Uncle Sam and that I have been the victim several times in several ways as a result of the OPM hack several years ago (as well as from some follow-on hacks of our government's computer systems) I have tended toward being hyper(?) vigilant with things like this.


Vigilance is great, if you are that worried you should probably pass ... personally I would have no issue building a Raspberry PI Router or other device

OPEN Source IMHO is always best - 1000's of eyes looking at the Code, not locked behind a company driven ONLY by dollar signs

 

[GURPS]

https://www.slant.co/topics/1629/~best-single-board-computers

 

[HypertensiveTiger]

Not a dumb question and you're right to be concerned. I don't know the brand you specifically mention, but ultimately the best approach IMHO is outbound filtering. Look at end-to-end connection points and service port numbers and understand the traffic that leaves your network and where it's going. Once you know what normal looks like it's easy to spot something anomalous. One thing I do on my personal network is have things like Netflix/Amazon/etc. on a separate network, air-gapped from devices where I do my banking/trading/etc. Nothing is fool-proof and there are no guarantees.

Zero-trust networks might be something to look into. You mention this media device you're considering will have access to other assets on your network with more sensitive data (PII). In a zero trust network design, that doesn't really matter because there is no way for an attacker to move sideways once in your network, as having "root" or "admin" on one device doesn't actually allow that fact to be leveraged and move to another machine.

Take the recent breach of SolarWinds for example. While many of the details of that aren't yet public, we do know the sophistication involved suggests state actors with deep pockets. We do know that Microsoft Active Directory "trusts" were leveraged. My fear is state actors loyal to countries other than the U.S. get hired on and figure out weaknesses and ways to get malware embedded into the build process that isn't detected automated means. There have been similar incidents with hardware (look up SuperMicro), for example.

There is a reason the 5G deployment is getting a lot of attention as it relates to the manufacture and supply chain.

Anyway, I'm rambling ... As gurps hinted at, I'm not sure it really matters all that much since orgs like the NSA are actively involved in developing these breaches, ostensibly to be able to use them against state actors not friendly to the U.S. But once these things are found out, they often can be used by anyone with access to the right tools.

I don't meant to suggest it's hopeless. I truly do think the best thing an organization can do is get familiar with what is "normal" traffic on their network and then by definition you know what's anomalous. Combine that with zero trust in key areas of the network. This is easy for an enterprise with deep pockets but it does scale down to home users who want to get a hold of this sort of thing.

Personally I am a name-brand guy, but recognize the security big brands provide is only veneer-thin. Mostly, it's more about having a "neck to choke" and hopefully fixed when problems are discovered updates are propagated quickly and transparently. I'm a fan of RaspberryPi as well. Amazing devices.

 

[GURPS]

Anyway, I'm rambling ... As gurps hinted at, I'm not sure it really Matters

the situation IMHO depends on who you think might be interested in your information

Is the Chinese or Russian Gov really going to be interested in your Plex Server

 

[HypertensiveTiger]

the situation IMHO depends on who you think might be interested in your information

Is the Chinese or Russian Gov really going to be interested in your Plex Server

To that end, I'm more concerned about my own government but point is made. You gotta frame your risks and mitigations against those risks properly.

 

[Yooper]

For me, this:

But once these things are found out, they often can be used by anyone with access to the right tools.

As I've been "hacked" (i.e., credit card fraud mostly) several times since the OPM breach I continue to do what I can to minimize future exposure. I think I've done pretty well, but there's still the hardware concern (hence, why I started the thread). So while I don't think the Chinese or Russian gov is interested (in my Plex server) (at least, anymore!), as HT noted (and I quoted above) it seems govts (to include my own) create a capability/get their hands on a capability and then it's only a matter of time before it gets out into the hands of the non-governmental actor.

And, of course, it could always be that the Russian/Chinese/NorK-ean/Iranian/etc. govts ARE interested in my Plex server; if only to sell that access to others for exploitation.

As for the recommendations:

(a) From what I have heard the NSA uses some board level hacks to back door access - like having Computrace on your laptop it operates at the BIOOS or hardware level to phone home and reports its location if flagged as stolen
...

(b) OPEN Source IMHO is always best - 1000's of eyes looking at the Code, not locked behind a company driven ONLY by dollar signs

(a) This is my exact concern. Not just from the NSA, though.

(b) I agree. However, I thought Open Source only applied to software. If so, doesn't solve my hardware concerns.

(a) ...the best approach IMHO is outbound filtering. Look at end-to-end connection points and service port numbers and understand the traffic that leaves your network and where it's going. Once you know what normal looks like it's easy to spot something anomalous. (b) One thing I do on my personal network is have things like Netflix/Amazon/etc. on a separate network, air-gapped from devices where I do my banking/trading/etc. Nothing is fool-proof and there are no guarantees.

(c) Zero-trust networks might be something to look into. You mention this media device you're considering will have access to other assets on your network with more sensitive data (PII). In a zero trust network design, that doesn't really matter because there is no way for an attacker to move sideways once in your network, as having "root" or "admin" on one device doesn't actually allow that fact to be leveraged and move to another machine.
...

(d) I'm a fan of RaspberryPi as well. Amazing devices.

(a) I'm generally familiar with this. For me, the amateur, the issue is understanding what I'm seeing. Especially with all the tracking that is done. Unless I'm mixing apples and oranges, what I'm trying to say is that this creates quite a bit of outbound noise to sort through making it difficult to figure out what's relatively "legit" and what's not.

(b) That was the next thing I was going to try. Thank you for confirming I wasn't heading in a dumb direction.

(c) Not familiar with this; so, again, thanks for the suggestion.

(d) I know what these are; not sure if I have the energy, time, or patience to figure it all out. But I'll give it another look. Probably will stick to (a), (b), and (c) for now.

Appreciate the feedback, Gurps and HT.

And "Merry Christmas," fellow forumites in ForumLand.

--- End of line (MCP)

 

[GURPS]

To that end, I'm more concerned about my own government but point is made.

Yeah True ... considering how much information is hoovered up on a regular basis just by moving about online .... you can only mitigate so much ...
I'm not going worry about specific hardware I add to my network.

(b) I agree. However, I thought Open Source only applied to software. If so, doesn't solve my hardware concerns.

Actually there is Open Source Hardware as well ..... but to circle back around, unless something is baked right into a microchip, you only need worry about the OS and BIOS or firmware