# How would you know if spyware was on your computer if installed by an expert? **URL:** \ **Category:** Factual Questions\ **Created:** [January 12, 2017, 3:20pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961 "2017-01-12T15:20:05Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Urbanredneck](https://avatars.discourse-cdn.com/v4/letter/u/ea5d25/32.png) [@Urbanredneck](https://boards.straightdope.com/u/Urbanredneck)\ **Post date:** [January 12, 2017, 3:20pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/1 "2017-01-12T15:20:05Z")
The recent discussion of the FBI working with the tech people at Best Buy got me wondering. Lets say you take your computer in for service. You have to give them your passwords. They then have several days to do anything they would want to your computer. Could an expert install some sort of spyware then that ordinary antivirus and antispyware software would not see? ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [January 12, 2017, 3:33pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/2 "2017-01-12T15:33:11Z")
[Rootkit](https://en.wikipedia.org/wiki/Rootkit) > [@](#): > > A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or areas of its software that would not otherwise be allowed (for example, to an unauthorized user) and often masks its existence or the existence of other software. And just for fun: [Sony BMG copy protection rootkit scandal](https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal) > [@](#): > > A scandal erupted in 2005 regarding Sony BMG’s implementation of deceptive, illegal, and potentially harmful copy protection measures on about 22 million CDs. When inserted into a computer, the CDs installed one of two pieces of software which provided a form of digital rights management (DRM) by modifying the operating system to interfere with CD copying. Neither program could easily be uninstalled, and they created vulnerabilities that were exploited by unrelated malware. Sony claims this was unintentional. One of the programs installed, even if the user refused its EULA, would still “phone home” with reports on the user’s private listening habits; the other was not mentioned in the EULA at all, contained code from several pieces of open-source software in an apparent infringement of copyright, and configured the operating system to hide the software’s existence, leading to both programs being classified as rootkits. ---
**Author:** ![Francis\_Vaughan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/francis_vaughan/32/3093_2.png) [@Francis\_Vaughan](https://boards.straightdope.com/u/Francis_Vaughan)\ **Post date:** [January 12, 2017, 3:35pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/3 "2017-01-12T15:35:51Z")
Trivially. (Where trivially means the installation is easy.) There are so many holes where malware can lurk that there is no chance that unless you knew exactly what to look for you would never find it. Once someone has physical access to your machine they can plant stuff where you might not even guess it could live. My current favourite is to install the persistent component onto the disk’s internal controller. Various other devices have internal persistent state as well. Perhaps the thing most overlooked by people thinking about malware protection is that even the most basic of personal computers nowadays contain a good half dozen or more processors. The one running the main software and operating system is not always the one that gets subverted. Most anti-malware has no clue about looking in these other areas. Indeed, it mostly can’t even look to see. ---
**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\ **Post date:** [January 12, 2017, 3:36pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/4 "2017-01-12T15:36:38Z")
Well, definitely. I’d be appalled if they couldn’t and I’d want new intelligence service people hired immediately. If you give a technically adept developer a computer running an OS of more than marginal sophistication (i.e., not just an adding machine) and let them hang onto it for awhile, they should be able to modify its behavior up to and including covering the tracks and traces of what they’ve done. It’s a specific application of Gödelian principles. Any expression system of sufficient complexity can be used to express a true statement that the syntax of the system cannot verify. Or, to put it another way, any sophisticated operating system by its very nature is going to make it possible to modify all of the information-displaying routines in such a way that they won’t display the specific information that that very modification did indeed take place. ---
**Author:** ![markn\_1](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@markn\_1](https://boards.straightdope.com/u/markn_1)\ **Post date:** [January 12, 2017, 4:41pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/5 "2017-01-12T16:41:50Z")
Yes, sophisticated malware can hide from antivirus software. To take an extreme example, suppose the bad guy has the resources to write a complete operating system that looks and acts just like Windows, but internally is doing all sorts of nefarious stuff. All the system files are untouched Microsoft files, so antivirus software doesn’t see anything wrong, but these files aren’t actually being run; they’re just for show. The real OS files are hidden by the (compromised) file system software and you can’t ever see them. This is just an extreme example of a root kit. But what if the investigator is more sophisticated? Instead of booting the (compromised) OS, he boots a clean OS from a CD or USB stick and uses that OS to examine the system files. Can the bad guy prevent that from detecting the infection? This is trickier, and probably required the back guy to replace the machine’s BIOS, but this can certainly be done too. But I don’t think it’s possible to completely close this hole, since the BIOS is limited in size, and probably can’t be modified to be sophisticated enough to boot a compromised version of Linux, Windows, OS/9, or whatever else might be on the USB stick. However, a serious and sophisticated investigator would not do any of these things. She would remove the disk from the computer and examine it on a clean, air-gapped, uncompromised system. There’s probably nothing that the bad guy could do to hide his infection from that kind of probe. **Francis Vaughan** , I’d be interested to see a reference for your claim that malware can hide in a disk’s internal controller, but even if that were possible, it wouldn’t help this scenario, because the disk wouldn’t know whether it was being booted normally (so should return the compromised data) or was being probed investigatively (so should return the original Microsoft data). ---
**Author:** ![astro](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@astro](https://boards.straightdope.com/u/astro)\ **Post date:** [January 12, 2017, 5:01pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/6 "2017-01-12T17:01:18Z")
> [@Francis\_Vaughan](#): > > Trivially. (Where trivially means the installation is easy.) > > There are so many holes where malware can lurk that there is no chance that unless you knew exactly what to look for you would never find it. Once someone has physical access to your machine they can plant stuff where you might not even guess it could live. > > My current favourite is to install the persistent component onto the disk’s internal controller. Various other devices have internal persistent state as well. Perhaps the thing most overlooked by people thinking about malware protection is that even the most basic of personal computers nowadays contain a good half dozen or more processors. The one running the main software and operating system is not always the one that gets subverted. Most anti-malware has no clue about looking in these other areas. Indeed, it mostly can’t even look to see. Which makes for an interesting challenge when so much of the electronic hardware we use is produced in nations not all that friendly us. If China _wanted to_ they could practically monitor the earth with controller embedded spyware. The flip side is if they do that and get caught at it that market will probably dry up and they lose hundreds of billions in potential GNP. ---
**Author:** ![chorpler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chorpler/32/2888_2.png) [@chorpler](https://boards.straightdope.com/u/chorpler)\ **Post date:** [January 12, 2017, 5:40pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/7 "2017-01-12T17:40:48Z")
> [@astro](#): > > Which makes for an interesting challenge when so much of the electronic hardware we use is produced in nations not all that friendly us. If China _wanted to_ they could practically monitor the earth with controller embedded spyware. The flip side is if they do that and get caught at it that market will probably dry up and they lose hundreds of billions in potential GNP. [This Schlock Mercenary strip](https://www.schlockmercenary.com/2002-11-12) seems appropriate. ---
**Author:** ![Lemur866](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lemur866/32/434_2.png) [@Lemur866](https://boards.straightdope.com/u/Lemur866)\ **Post date:** [January 12, 2017, 5:51pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/8 "2017-01-12T17:51:22Z")
> [@markn\_1](#): > > Yes, sophisticated malware can hide from antivirus software. To take an extreme example, suppose the bad guy has the resources to write a complete operating system that looks and acts just like Windows, but internally is doing all sorts of nefarious stuff. All the system files are untouched Microsoft files, so antivirus software doesn’t see anything wrong, but these files aren’t actually being run; they’re just for show. The real OS files are hidden by the (compromised) file system software and you can’t ever see them. This is just an extreme example of a root kit. > > But what if the investigator is more sophisticated? Instead of booting the (compromised) OS, he boots a clean OS from a CD or USB stick and uses that OS to examine the system files. Can the bad guy prevent that from detecting the infection? This is trickier, and probably required the back guy to replace the machine’s BIOS, but this can certainly be done too. But I don’t think it’s possible to completely close this hole, since the BIOS is limited in size, and probably can’t be modified to be sophisticated enough to boot a compromised version of Linux, Windows, OS/9, or whatever else might be on the USB stick. > > However, a serious and sophisticated investigator would not do any of these things. She would remove the disk from the computer and examine it on a clean, air-gapped, uncompromised system. There’s probably nothing that the bad guy could do to hide his infection from that kind of probe. **Francis Vaughan** , I’d be interested to see a reference for your claim that malware can hide in a disk’s internal controller, but even if that were possible, it wouldn’t help this scenario, because the disk wouldn’t know whether it was being booted normally (so should return the compromised data) or was being probed investigatively (so should return the original Microsoft data). Yes, if the KGB had physical access and installed spyware on your system, and the NSA investigated it to find out of it was compromised, the NSA is going to discover the problem. However, me just running Malwarebytes on the compromised system isn’t going to find the problem. The original question was whether, if you took your laptop to Best Buy, could the FBI install spyware on your system that a typical user–the kind who takes his laptop to Best Buy to get it fixed–could not find. And the answer is yes, they could easily put spyware on your system that would be impossible to discover unless you’re an expert on that sort of thing. But could they do it so that not even the NSA could discover the malware? No. ---
**Author:** ![DrCube](https://avatars.discourse-cdn.com/v4/letter/d/a3d4f5/32.png) [@DrCube](https://boards.straightdope.com/u/DrCube)\ **Post date:** [January 12, 2017, 5:55pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/9 "2017-01-12T17:55:12Z")
Physical security is the last line of cybersecurity protection. Anyone with physical access to your computing hardware can basically do whatever they want to it. All the antiviruses, malware protection and firewalls in the world won’t work if the bad guys can just pull the hard drive out of your computer and replace it with their own. Often the best defense against hackers is a sturdy door with a good lock. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [January 12, 2017, 6:03pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/10 "2017-01-12T18:03:36Z")
Never mind theoretical; let’s get practical. Unless you are engaged in sooper-seekret military work, the effort it would take to find out which porn you like best just isn’t worth the risk. ---
**Author:** ![watchwolf49](https://avatars.discourse-cdn.com/v4/letter/w/e9c0ed/32.png) [@watchwolf49](https://boards.straightdope.com/u/watchwolf49)\ **Post date:** [January 12, 2017, 6:12pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/11 "2017-01-12T18:12:16Z")
I wonder how the experts feel about the opposite approach … just not typing in sensitive personal information … for example, and as far as I know, my SSN isn’t anywhere in any data file in the all of my computer … is this false security? ---
**Author:** ![septimus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/septimus/32/410_2.png) [@septimus](https://boards.straightdope.com/u/septimus)\ **Post date:** [January 12, 2017, 6:22pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/12 "2017-01-12T18:22:49Z")
Presumably the spyware would want to send messages via Internet to its masters, communicating its discoveries. Those messages would show up with an Internet monitor like Fiddler, if you knew what to look for. (Install Fiddler _after_ getting the machine back.) I’m sure this could be defeated by sufficiently smart spyware, but should work in most cases, no? (Assuming you know what to look for in Fiddler’s output — I wouldn’t.) ---
**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\ **Post date:** [January 12, 2017, 8:22pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/13 "2017-01-12T20:22:14Z")
If malware were installed in the BIOS then software on the PC would not pick up the internet traffic. However, your router would. Of course, most people don’t have routers sufficiently capable of showing it. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [January 12, 2017, 9:20pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/14 "2017-01-12T21:20:33Z")
There have been several cases reported on Slashdot of some AV company coming across a sophisticated malware program installed on a machine. (These are usually targeted towards a specific group of people or industry.) After checking around they find out that this malware had been around for a few years and had not been detected by any malware company in that time! Given the number detected in this way, the number of _undetected_ such malware is no doubt troublingly high. One type of malware that really keeps the experts up at night is the kind that installs itself into the firmware of a computer’s HD. HD companies are reluctant to provide the information or tools to allow AV experts to build scanners to check for a HD infected this way. Even if you do a complete wipe and fresh install, it’s still there. ---
**Author:** ![dzeiger](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@dzeiger](https://boards.straightdope.com/u/dzeiger)\ **Post date:** [January 12, 2017, 10:00pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/15 "2017-01-12T22:00:40Z")
How paranoid is the user, and what is the spyware doing? If the spyware is collecting data of some sort and sending it to an external site on a daily/weekly/whatever basis, and I have a firewall or other external network device keeping a log of all outgoing connections, it could be caught that way. Now, is the type of person who would make periodic reviews of connection logs the type of person who would hand over a PC to Best Buy’s Geek Squad? Probably not. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [January 12, 2017, 10:21pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/16 "2017-01-12T22:21:58Z")
> [@watchwolf49](#): > > I wonder how the experts feel about the opposite approach … just not typing in sensitive personal information … for example, and as far as I know, my SSN isn’t anywhere in any data file in the all of my computer … is this false security? IMO it’s partial security. If you never use your computer to perform any e-commerce or e-finance, and never write a word processing doc or email to anyone containing your name, address, email address, ssn, driver’s license#, passport#, credit card numbers, etc., then yes, there’s not much potentially harmful info someone could glean by monitoring your every keystroke and screenview. Which means pretty much using your PC like an old-fashioned TV, but with more pr0n channels. That’s a pretty extreme limitation to place on your use of a computer in this day and age. Even assuming you were willing to go that hard over, consider this: Let’s say you bank at Bank of America and have your investments at Charles Schwab. They have websites. Your account is connected to their website whether you’ve ever signed up for online access or not. Somebody could notice a BofA or Schwab envelope in your incoming snail-mail or outgoing trash. And with some e-skullduggery connect to their websites as you, activating the online access. Then transferring the money to their account in Bulgaria. So computers are involved in the theft, but not \*your \*computer. ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [January 12, 2017, 10:25pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/17 "2017-01-12T22:25:04Z")
I’ve actually experienced this situation in real life. At a previous job our mail server kept getting blacklisted (DNSBL, ORBS, etc.) because we were being labeled as a spammer. I got us removed from the list, because false positives happen. But we just ended up back on it. Eventually we checked our firewall and confirmed an unusual amount of mail traffic coming from a specific internal IP address. We then went to the location, found the PC, and ran a whole suite of detection programs. Malwarebytes, Kaspersky, Combofix, even an emergency AV that ran off a bootable flash drive. Nothing found anything. We then ran a port monitor and it found crazy amounts of SMTP traffic. And I was able to isolate the source. Some genius installed a free video game on his work computer that was actually a Trojan and made that PC part of a botnet. He got disciplined, we wiped that system, and I eventually got us off the blacklist. Took a few days total to track it down though. There is some really evil stuff out there and sometimes even a thorough search won’t find it unless your search is very targeted. Luckily that was the first and last time I ever had to deal with something like that. ---
**Author:** ![aldiboronti](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@aldiboronti](https://boards.straightdope.com/u/aldiboronti)\ **Post date:** [January 12, 2017, 10:27pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/18 "2017-01-12T22:27:17Z")
One of the clues that might inform you there was malware present is speed, either the speed of the PC or your internet connection. If either prove significantly slower after the repair that could alert you to the problem. But otherwise, no, you’d have to be an expert or use some sophisticated software to see if anything is afoot. ---
**Author:** ![Francis\_Vaughan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/francis_vaughan/32/3093_2.png) [@Francis\_Vaughan](https://boards.straightdope.com/u/Francis_Vaughan)\ **Post date:** [January 12, 2017, 10:42pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/19 "2017-01-12T22:42:10Z")
> [@markn\_1](#): > > **Francis Vaughan** , I’d be interested to see a reference for your claim that malware can hide in a disk’s internal controller, but even if that were possible, it wouldn’t help this scenario, because the disk wouldn’t know whether it was being booted normally (so should return the compromised data) or was being probed investigatively (so should return the original Microsoft data). [This was my initial reference to the idea](http://spritesmods.com/?art=hddhack)- although there has been a lot more since. The critical point is that disc controllers are quite complex and powerful devices. The one on the cited article had three ARM processors in it. (The fun project for another day is to try to rework the disc controller so it boots Linux 🙂 ) With the amount of power available it is possible to make the controller only enable the malware component in specific circumstances. It can watch the order of disc accesses and decide if it is being booted into a live OS, or is just being scanned for instance. It might only ever deliver the malware after a series of access patterns indicative of a login of the target user. (Shades of VW’s diesel performance testing hack.) ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [January 12, 2017, 10:43pm UTC](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961/20 "2017-01-12T22:43:10Z")
> [@watchwolf49](#): > > as far as I know, my SSN isn’t anywhere in any data file in the all of my computer … is this false security? Yes, because your SSN is available online without much trouble. Plus it’s in lots of other people’s computers: your income tax preparer, your bank & all financial companies, your employer (and all past employers), probably your insurance companies, credit card companies, etc. SSN is not very secure at all. (But that doesn’t matter as much as people think.) [Next page](https://boards.straightdope.com/t/how-would-you-know-if-spyware-was-on-your-computer-if-installed-by-an-expert/776961.md?page=2)