4.3 Hardware trust and firmware

Most people think of a device as the screen and the operating system you log into. Underneath sit layers of code that start the machine, handle radio signals and talk to attached gadgets. They are usually invisible, yet they decide what your device will and will not do.

So "hardware trust" is not about whether a laptop feels sturdy. It is about whether the earliest code that runs can be relied on.

Firmware is small, specialised software stored on chips, sitting between the hardware and the operating system. When something goes wrong in firmware, it is often hard to detect and harder to fix.

That does not make every device a trap. It means the lower you go in the stack, the fewer tools you have to inspect it, and the more you rely on manufacturers, supply chains and careful maintenance.

BIOS and UEFI persistence

Press the power button and the machine runs code stored on the motherboard long before Windows, macOS or Linux appears. Historically that was the BIOS; now it is usually UEFI, a more capable replacement.

UEFI can load drivers, show a graphical setup screen and enforce Secure Boot, which checks the operating system has not been tampered with. That same power makes it a tempting target for persistence: malicious code that survives an operating system reinstall.

What that might look like: a work laptop has been reimaged but still behaves oddly. Network traffic spikes during boot, or a rogue browser extension reappears after every clean install. A compromised UEFI can reintroduce unwanted software every time the device starts, whatever the operating system image.

This is rare, but hard to diagnose when it happens, because normal antivirus tools only see the operating system, not the pre-boot environment.

Myth: firmware never changes. Reality: it does, and it should. Updates fix security flaws, improve stability and add support for new hardware. In the UK most people rely on vendor update tools or Windows Update for this. Staying on outdated firmware can leave known vulnerabilities unpatched.

Mitigations are about trust and visibility:

• Use devices that get firmware updates from a reputable source, and apply stable updates when they are released.
• In higher-risk settings, look for measured boot or TPM-backed logs that record what firmware actually ran at startup. They do not guarantee safety, but they make silent persistence harder.

The trade-off is complexity: more security features can mean more ways to lock yourself out if a key or configuration is lost.

For many people the balanced approach is: keep firmware updated, enable Secure Boot if you are not running a custom operating system, and avoid machines with unclear provenance.

Baseband processors

Your smartphone has a separate processor for mobile networks: the baseband. It talks to the nearest mast, negotiates encryption and manages calls and texts. The operating system usually has limited control over it.

That separation exists for performance and regulatory reasons, but it creates a blind spot. If the baseband firmware is vulnerable, the main operating system may never notice.

You mostly see baseband behaviour indirectly: battery drain when signal is poor, or the phone connecting to a network abroad before you can switch off roaming. Those are ordinary baseband functions.

The risk is that baseband firmware is complex and largely proprietary, so independent review is hard. Attacks on it are not everyday events for most people in the UK, but they are possible and security researchers have demonstrated them. In targeted cases, baseband flaws can be used to intercept or manipulate communications, or as a foothold for further attacks.

You cannot easily replace baseband firmware, so the mitigations are limited:

• Keep your phone's system updates current. Vendors sometimes bundle baseband updates with OS patches.
• Use end-to-end encrypted apps for sensitive conversations. Even if the radio layer is compromised, the content stays protected.

That does not stop metadata exposure (who you contacted and when), which is part of how mobile networks work. This is a risk to understand rather than eliminate, and what is acceptable depends on your circumstances.

Peripheral attacks

Modern devices trust whatever is plugged into them. USB and Thunderbolt connect keyboards, storage, cameras and chargers, but they can also expose deep access.

Some gadgets, such as external network adapters or "smart" docks, carry their own firmware. If that firmware is malicious or vulnerable, it can attack your machine without you ever opening a file.

Realistic scenarios:

• At a conference, you borrow a USB-C hub to connect your company laptop to a projector. A compromised hub could present itself as several devices, including a keyboard, and type commands.
• A cheap second-hand USB drive quietly reconfigures itself to appear as a keyboard and runs a script the moment it is plugged in.

These are not classic viruses. They exploit your machine's trust in hardware interfaces.

The simple fix: treat unknown peripherals like unknown software, and do not plug them in. Where you must use them:

• prefer reputable brands;
• keep their firmware updated if possible;
• avoid devices that do more than you need.

In higher-risk settings, you can disable unused ports in firmware settings or use port blockers. That costs convenience, can break legitimate workflows, and many people lack the support to manage it sensibly.

A measured approach: keep sensitive work on a device that only uses known, owned peripherals, and keep a separate, less sensitive machine for travel or public places.

Second-hand device risks

Buying used hardware is common and sensible, but a laptop wiped at the operating system level can still carry modified firmware or hardware implants. Most second-hand devices are simply old, not malicious. You just have no straightforward way to verify what happened before. A quiet risk, not a dramatic one.

Myth: a full disk wipe or factory reset returns the machine to a trusted state. Reality: these steps are valuable, but they do not touch all firmware.

• Phones: a factory reset usually removes user data, but does not always update or verify baseband firmware.
• Laptops: a clean install does not reinstall the UEFI firmware.

How far to go depends on the value of the device and the risk you are managing:

• Ordinary consumer use in the UK: buy from a reputable refurbisher and apply all firmware and OS updates soon after purchase.
• More sensitive use: consider vendors with verifiable firmware update mechanisms and supply chain documentation.
• High-risk roles: some organisations insist on new devices to reduce uncertainty. That is a cost-versus-assurance trade-off, not a universal requirement.

There are practical limits to what you can verify: independent firmware auditing is expensive and rare. So reduce unnecessary exposure:

• do not keep your most sensitive accounts on a device you cannot vouch for;
• enable full disk encryption;
• keep good backups.

If the device behaves oddly (persistent changes after a reinstall, unexplained network activity on boot, firmware update failures), take it seriously and consider professional inspection or replacement.

When a device leaves your control

Everything above assumes the device stays with you. The harder case is the moment it leaves your hands, even briefly, because physical access opens routes no software protection fully closes.

Researchers call the classic version an "evil maid" attack. Someone with brief physical access (a hotel cleaner, a repair technician, an official during a search) tampers with the firmware or hardware while you are away. The device comes back looking untouched and captures your passphrase next time you unlock it.

This is not an everyday risk for most people, but it is exactly the scenario where the firmware layers on this page matter most, because they are what such an attack targets.

For ordinary people, the most common real-world version is a device handed over at a border or during a stop, covered in its own right in Chapter 10. Once a phone or laptop has been out of your sight in someone else's control, you can no longer be sure the firmware and hardware are as you left them, and no factory reset reliably restores that certainty, for the reasons above.

The practical answer is to limit how much a tampered device could betray, and to treat trust as conditional on custody:

• Secure Boot and measured boot make silent tampering harder to achieve and easier to detect.
• Power the device fully off rather than leaving it asleep, so a returned device must be unlocked again under your observation.
• Keep genuinely sensitive material off any device that crosses a border at all, as discussed in Chapter 14. That removes the exposure rather than trying to manage it.

For higher-risk users, the sensible posture is to assume a device that has left your control may no longer be trustworthy:

• rotate any credentials that device could have captured;
• watch for the odd-behaviour signs described above;
• in serious cases, retire the device rather than keep trusting it.

For everyone else, the takeaway is more modest but still useful: physical control is part of security. Brief losses of custody are not nothing, and the cheapest protection is simply not letting devices out of your sight when it matters.