From some sources, I read that some laptop hardware components can contain backdoors. The claim is that the backdoor resides in BIOS firmware, in hardware components/drivers, and possibly even in chips/processors. It’s also claimed there can be telemetry/“spy” behavior in some GPU ecosystems (e.g., NVIDIA GeForce).
If the backdoor really exists in BIOS, chip, or the graphics card, does that mean it can bypass all OS security layers and directly observe everything happening on the machine - including sensitive things typed on the keyboard, even while using isolated environments on Linux?
If so, then maybe using an on-screen keyboard (or other software isolation) is also more dangerous than people think, because the monitoring could happen below the operating system.
My questions are:
- Are there ways for Linux (and general Linux hardening) to protect against such a threat without installing a “secure BIOS” (like coreboot/libreboot/skulls)?
- Can we capture/block the “firmware telemetry” network traffic and block the IP addresses? Would that block the underlying backdoor, or only reduce telemetry?
- How can I see which graphics driver is being used on Linux (e.g.,
nouveauvsnvidia), ideally from dom0-like concepts—but for Linux (where it’s not split into domains)? - How can I list/verify which driver is loaded for each hardware component on Linux?
Below are some statements from several references I came across:
- “a hacker could trigger a feature of the chip that gives them full access to the operating system.”
- “microscopic hardware backdoor wouldn’t be caught by practically any modern method of hardware security analysis.”
- “microscopic hardware backdoor could be planted by a single employee of a chip factory.”
- “backdoor is hidden in hardware rather than software.”
- “Absolute’s Computrace agent resides in the firmware (ROM BIOS) of millions of laptops and desktops…”
Some references also mention telemetry/spy claims related to NVIDIA drivers.
Background story:
Before Linux, I was using Windows, and I felt like I was being targeted. I assumed it was a RAT (remote access trojan) or keylogger because the targeter could see everything I do in my system including activity related to offline software (like a local text editor / word processor). I ran anti-virus scans; they came back clean. I tried strengthening security on Windows; it didn’t seem to help.
After spending months with no findings, I thought maybe Windows itself had a backdoor, so I switched to Linux.
On Linux, I have tried to reduce what I attach/install and limit exposure (for example: avoiding untrusted binaries, limiting access to sensitive data, and using isolation/sandboxing tools). I haven’t intentionally enabled anything that would obviously give third parties deep access to the system. So I don’t see how the OS itself would be compromised in an obvious way.
But I still feel like I’m being targeted: the targeter seems to know things I wrote myself, like text I typed manually into a local note/document (not copied from the internet) and the same text appears later in their own social media/chat messages, sometimes with the same punctuation (comma/dot). It has also happened with some other documents and sometimes seems related to my browsing activity.
So now I’m trying to assess the remaining possibility: firmware/BIOS, firmware-level management engines, GPU/driver telemetry, or driver-level vectors.
What can be done to overcome or reduce this threat on Linux?