Can Linux protect the user from a backdoor in BIOS firmware and device drivers?

From some sources, I read that some laptop hardware components can contain backdoors. The claim is that the backdoor resides in BIOS firmware, in hardware components/drivers, and possibly even in chips/processors. It’s also claimed there can be telemetry/“spy” behavior in some GPU ecosystems (e.g., NVIDIA GeForce).

If the backdoor really exists in BIOS, chip, or the graphics card, does that mean it can bypass all OS security layers and directly observe everything happening on the machine - including sensitive things typed on the keyboard, even while using isolated environments on Linux?

If so, then maybe using an on-screen keyboard (or other software isolation) is also more dangerous than people think, because the monitoring could happen below the operating system.

My questions are:

  • Are there ways for Linux (and general Linux hardening) to protect against such a threat without installing a “secure BIOS” (like coreboot/libreboot/skulls)?
  • Can we capture/block the “firmware telemetry” network traffic and block the IP addresses? Would that block the underlying backdoor, or only reduce telemetry?
  • How can I see which graphics driver is being used on Linux (e.g., nouveau vs nvidia), ideally from dom0-like concepts—but for Linux (where it’s not split into domains)?
  • How can I list/verify which driver is loaded for each hardware component on Linux?

Below are some statements from several references I came across:

  • “a hacker could trigger a feature of the chip that gives them full access to the operating system.”
  • “microscopic hardware backdoor wouldn’t be caught by practically any modern method of hardware security analysis.”
  • “microscopic hardware backdoor could be planted by a single employee of a chip factory.”
  • “backdoor is hidden in hardware rather than software.”
  • “Absolute’s Computrace agent resides in the firmware (ROM BIOS) of millions of laptops and desktops…”

Some references also mention telemetry/spy claims related to NVIDIA drivers.

Background story:

Before Linux, I was using Windows, and I felt like I was being targeted. I assumed it was a RAT (remote access trojan) or keylogger because the targeter could see everything I do in my system including activity related to offline software (like a local text editor / word processor). I ran anti-virus scans; they came back clean. I tried strengthening security on Windows; it didn’t seem to help.

After spending months with no findings, I thought maybe Windows itself had a backdoor, so I switched to Linux.

On Linux, I have tried to reduce what I attach/install and limit exposure (for example: avoiding untrusted binaries, limiting access to sensitive data, and using isolation/sandboxing tools). I haven’t intentionally enabled anything that would obviously give third parties deep access to the system. So I don’t see how the OS itself would be compromised in an obvious way.

But I still feel like I’m being targeted: the targeter seems to know things I wrote myself, like text I typed manually into a local note/document (not copied from the internet) and the same text appears later in their own social media/chat messages, sometimes with the same punctuation (comma/dot). It has also happened with some other documents and sometimes seems related to my browsing activity.

So now I’m trying to assess the remaining possibility: firmware/BIOS, firmware-level management engines, GPU/driver telemetry, or driver-level vectors.

What can be done to overcome or reduce this threat on Linux?

If the backdoor really exists in BIOS, chip, or the graphics card, does that mean it can bypass all OS security layers and directly observe everything happening on the machine - including sensitive things typed on the keyboard, even while using isolated environments on Linux?

I’m not an expert here, but such a thing is hypothetically possible. Being able to do it as an individual is another question.

In general, modifying the boot process requires either root / sudo privileges or physical access to the device. If someone already has remote root access to your linux system, it’s unlikely they need to modify the boot process.

If someone has physical access, some means like secure boot can help protect against it. There may still be vulnerabilities, so you will want to avoid giving someone extended access. Android and ios are better here and macos tends to be decent. Still, it’s not going to be easy for the average person to get past secureboot. If someone more skilled than that is likely to come for the device (eg, a dictatorship going after a political dissident), desktop linux may be a bad choice.

Edit: “But I still feel like I’m being targeted: the targeter seems to know things I wrote myself, like text I typed manually into a local note/document (not copied from the internet) and the same text appears later in their own social media/chat messages, sometimes with the same punctuation (comma/dot). It has also happened with some other documents and sometimes seems related to my browsing activity.”

This does sound particularly concerning though. If they don’t have physical access, I would assume some type of access is happening. If anything is being synced, I would start with looking at that.

Second edit: Something really common is that someone’s browing history is being synced without the person realizing. Then someone else seems to know every website they are visiting and when they visit it. Then they get freaked out, assuming deep access to the device by a hacker, when it’s really just one account with a leaked password or left logged in some place. I’d double check every piece of leaked information for this.

Which sources?

What do you mean by that?

What?

Sources?

How do you know that?

In the sense that Microsoft shipped a backdoor? No. If it was, such a thing would very valuable and kept secret. It would not be used to harass some individual and risk uncovering it.

While it might be possible that you got some malware or hacked, the fear of backdoors installed by hardware/firmware/OS manufacturers seems unreasonable.

1 Like