5 ms·

Ask HN: My laptop has a bios level keylogger my security is at threat help

4 points by dudeofjude 13y ago

I have the following laptop - http://www8.hp.com/in/en/ad/ultrabooks/intel.html I have been encountering suspicious activities and private data getting out. It has been informed to me that,its either a bios level keylogger or a virus that catches your camera is creating trouble for me. I searched the net, could not help myself. I formatted the laptop, scanned bios still things are not safe. Please help!

vertr07 13y ago
Maybe reflash your bios? Have you considered that it might be your network?
- dudeofjude 13y ago
  Does reflashing it guarantees removal of keyloggers or laptop camera mismanagement?
  - vertr07 13y ago
    No, but it's better than being paranoid and not doing anything about it.
dylanhassinger 13y ago
get a mac
- dudeofjude 13y ago
  no money!
  - S4M 13y ago
    install linux then.
    - dudeofjude 13y ago
      BIOS is still there, right?
      - fit2rule 13y ago
        Reflash the BIOS from a different machine, install linux.
        dudeofjude 13y ago
        any pointers how to go about?
doubt_me 13y ago
Tech here: What did you scan your bios with? How did you format your laptop? What system are you running? Windows 8 or 7? How did you activate your windows OS? What is the exact model number of your laptop? answer as much as possible so I can help
- dudeofjude 13y ago
  avast antivirus. and http://www.malwarebytes.org/ http://www.malwarebytes.org/ usb device. win 8, i had a genuine iso file and keys. Model - 41113TU Product - C7D86PA#ACJ
  - doubt_me 13y ago
    If you already formatted your laptop those viruses should be gone but if you think you have a rootkit Scan with this tool called kaspersky anti rootkit TDSSKiller http://support.kaspersky.com/us/5350#block1 http://support.kaspersky.com/us/5350#block1 If you find something delete it. But just to be extra safe re flash your bios/ update it and then scan afterwards to see if anything pops up.
    - dudeofjude 13y ago
      Do you have pointers on flashing the bios. Had tried that TDSSKiller earlier.
      - doubt_me 13y ago
        Yea you can download it from this link and then follow the instructions http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?softwareitem=ob-115172-1&cc=us&dlc=en&lc=en&os=4132&product=5375658&sw_lang= http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?sof...
        dudeofjude 13y ago
        thanks, worked like a charm. So having flashed the BIOS and upgrading it, should I be secure that there is no rootkit inside the machine?
psycho-geek 13y ago
Get rid of Windows 8 and the TPM2 crap. Your machine is no longer yours. It is spied upon and owned by Microsoft. They have FULL control over your machine. I have caught Windows 8.1 uploading my data to Microsoft. They encrypt the communications, but I was monitoring Windows and what files it was accessing and what communications it was performing over the Internet. When I blocked the ip addresses, it evaded my blocks by using a different set. All ip addresses were owned by Microsoft.
- dudeofjude 13y ago
  How were you monitoring communications? Is it possible for me to monitor any communication that is going at BIOS level?
  - psycho-geek 13y ago
    I used Wireshark (http://www.wireshark.org/ http://www.wireshark.org/). I was actually diagnosing a different issue, until I noticed that my Win8 machine was especially chatty. When I looked more into it, I was horrified as to how much data was being uploaded to Microsoft. I used many different techniques, including Man in the Middle in order to see what info was actually being sent. It was especially creepy to see that the Win8 box took evasive actions as I tried to spy on its communications. I wonder exactly what Microsoft has to hide regarding this communication and has to encrypt it and be evasive. I am not aware of any easy way of monitoring BIOS level communications. If you are afraid that the BIOS has been compromised by a virus then I would suggest that you update the BIOS with an update from the vendor's web site. Even if it the same version that's installed. If you are worried that the machine's vendor has somehow added spying routines into the BIOS, then for safety's sake don't use the machine for work, or for any secure info. Use it only play.
SchizoDuckie 13y ago
Note: The title of this article is most likely misleading. Please post some detailed analyiys of what's going on here. What data gets out? What type of suspicious activities? - Have you tried package-capturing with wireshark on the internet connections your laptop makes? - Are you sure that there's no other attack point in your network that could be more easily infected than a BIOS? - Have you checked your phone for instance? - Have you checked the Master Boot Record of your harddrive? - Have you checked your router? - Have you tried unhackme (rootkit scanner) ? A BIOS is very device specific, which would mean that either somebody finds you very interesting on a level that's NSA-tech worthy, or China hackers just leveled up. I have a hard time just believing this, and there's a ton of attack angles that would be much more efficient to bug someone. Also. Since when was hacker news downgraded to a personal helpdesk?
- dudeofjude 13y ago
  Please post some detailed analyiys of what's going on here. What data gets out? What type of suspicious activities? They know my gmail passwords. - Have you tried package-capturing with wireshark on the internet connections your laptop makes? Yes. - Are you sure that there's no other attack point in your network that could be more easily infected than a BIOS? Can be. - Have you checked your phone for instance? Downgraded the phone. - Have you checked the Master Boot Record of your harddrive? Yes. - Have you checked your router? Don't have access. - Have you tried unhackme (rootkit scanner) ? Yes. A BIOS is very device specific, which would mean that either somebody finds you very interesting on a level that's NSA-tech worthy, or China hackers just leveled up. I have a hard time just believing this, and there's a ton of attack angles that would be much more efficient to bug someone. I am facing it. Also. Since when was hacker news downgraded to a personal helpdesk? Where else shall I go to resolve the crisis?

4 points by dudeofjude 13y ago

vertr07 13y ago

Maybe reflash your bios? Have you considered that it might be your network?

dudeofjude 13y ago
Does reflashing it guarantees removal of keyloggers or laptop camera mismanagement?
- vertr07 13y ago
  No, but it's better than being paranoid and not doing anything about it.

dylanhassinger 13y ago

get a mac

dudeofjude 13y ago
no money!
- S4M 13y ago
  install linux then.
  - dudeofjude 13y ago
    BIOS is still there, right?
    - fit2rule 13y ago
      Reflash the BIOS from a different machine, install linux.
      - dudeofjude 13y ago
        any pointers how to go about?

doubt_me 13y ago

Tech here: What did you scan your bios with? How did you format your laptop? What system are you running? Windows 8 or 7? How did you activate your windows OS? What is the exact model number of your laptop? answer as much as possible so I can help

dudeofjude 13y ago
avast antivirus. and http://www.malwarebytes.org/ http://www.malwarebytes.org/ usb device. win 8, i had a genuine iso file and keys. Model - 41113TU Product - C7D86PA#ACJ
- doubt_me 13y ago
  If you already formatted your laptop those viruses should be gone but if you think you have a rootkit Scan with this tool called kaspersky anti rootkit TDSSKiller http://support.kaspersky.com/us/5350#block1 http://support.kaspersky.com/us/5350#block1 If you find something delete it. But just to be extra safe re flash your bios/ update it and then scan afterwards to see if anything pops up.
  - dudeofjude 13y ago
    Do you have pointers on flashing the bios. Had tried that TDSSKiller earlier.
    - doubt_me 13y ago
      Yea you can download it from this link and then follow the instructions http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?softwareitem=ob-115172-1&cc=us&dlc=en&lc=en&os=4132&product=5375658&sw_lang= http://h10025.www1.hp.com/ewfrf/wc/softwareDownloadIndex?sof...
      - dudeofjude 13y ago
        thanks, worked like a charm. So having flashed the BIOS and upgrading it, should I be secure that there is no rootkit inside the machine?

psycho-geek 13y ago

Get rid of Windows 8 and the TPM2 crap. Your machine is no longer yours. It is spied upon and owned by Microsoft. They have FULL control over your machine. I have caught Windows 8.1 uploading my data to Microsoft. They encrypt the communications, but I was monitoring Windows and what files it was accessing and what communications it was performing over the Internet. When I blocked the ip addresses, it evaded my blocks by using a different set. All ip addresses were owned by Microsoft.

dudeofjude 13y ago
How were you monitoring communications? Is it possible for me to monitor any communication that is going at BIOS level?
- psycho-geek 13y ago
  I used Wireshark (http://www.wireshark.org/ http://www.wireshark.org/). I was actually diagnosing a different issue, until I noticed that my Win8 machine was especially chatty. When I looked more into it, I was horrified as to how much data was being uploaded to Microsoft. I used many different techniques, including Man in the Middle in order to see what info was actually being sent. It was especially creepy to see that the Win8 box took evasive actions as I tried to spy on its communications. I wonder exactly what Microsoft has to hide regarding this communication and has to encrypt it and be evasive. I am not aware of any easy way of monitoring BIOS level communications. If you are afraid that the BIOS has been compromised by a virus then I would suggest that you update the BIOS with an update from the vendor's web site. Even if it the same version that's installed. If you are worried that the machine's vendor has somehow added spying routines into the BIOS, then for safety's sake don't use the machine for work, or for any secure info. Use it only play.

SchizoDuckie 13y ago

Note: The title of this article is most likely misleading. Please post some detailed analyiys of what's going on here. What data gets out? What type of suspicious activities? - Have you tried package-capturing with wireshark on the internet connections your laptop makes? - Are you sure that there's no other attack point in your network that could be more easily infected than a BIOS? - Have you checked your phone for instance? - Have you checked the Master Boot Record of your harddrive? - Have you checked your router? - Have you tried unhackme (rootkit scanner) ? A BIOS is very device specific, which would mean that either somebody finds you very interesting on a level that's NSA-tech worthy, or China hackers just leveled up. I have a hard time just believing this, and there's a ton of attack angles that would be much more efficient to bug someone. Also. Since when was hacker news downgraded to a personal helpdesk?

dudeofjude 13y ago
Please post some detailed analyiys of what's going on here. What data gets out? What type of suspicious activities? They know my gmail passwords. - Have you tried package-capturing with wireshark on the internet connections your laptop makes? Yes. - Are you sure that there's no other attack point in your network that could be more easily infected than a BIOS? Can be. - Have you checked your phone for instance? Downgraded the phone. - Have you checked the Master Boot Record of your harddrive? Yes. - Have you checked your router? Don't have access. - Have you tried unhackme (rootkit scanner) ? Yes. A BIOS is very device specific, which would mean that either somebody finds you very interesting on a level that's NSA-tech worthy, or China hackers just leveled up. I have a hard time just believing this, and there's a ton of attack angles that would be much more efficient to bug someone. I am facing it. Also. Since when was hacker news downgraded to a personal helpdesk? Where else shall I go to resolve the crisis?