For example I don’t know if a cheap mini PC like the GMKtec G5 would be more likely to have firmware/driver related security flaws over a more standard PC like an older Dell Optiplex from Staples.

Maybe there is something else entirely I am overlooking. I’m not sure. Most of the complaints I’ve heard are in regards to mini PCs containing bloat and potentially malicious things installed.

  • j4k3@lemmy.worldEnglish
    42·
    1 month ago

    While it is outside of the scope of most people’s abilities, the bios is on a flash chip that can be removed, read, and disassembled. I’m no expert here by any stretch. That said, my usual check with software is to simply check for http in strings. Even with a binary like a bios ROM, I can pass it through the $ strings command to look for any addresses. No matter what kind of malicious nonsense the software is doing, it has very low value unless it can dial out.

    My lack of a complete understanding in this area is why I use a whitelist firewall for most of my devices. It is also the ultimate ad and tracker blocker as I only visit the places I chose to access. I don’t conform to the lowest developer’s ethics and will simply stop using any site or service that fails to be direct and transparent.

    The thing is, even most whitelist firewalls are inadequate. They only filter incoming packets. That is really an inadequate model in most cases now, especially with local large language models where it is impossible to verify their capabilities. My reason for all thus bla bla bla is to say, a whitelist on a trusted 3rd party device is a PITA but an effective low barrier way to prevent any bad actor from communicating with the questionable device. It still leaves you open to a potential situation where the device could be sending a packet stream to the outside world over something like UDP.

    Otherwise, the main thing I would be concerned with, if it is a UEFI device, are the UEFI secure boot keys. Whomever holds these keys has a lower ring access than the operating system kernel. Anything happening in kernel or user space is effectively under their control.

    Anyways, the main way to monitor and check the device is a trusted 3rd party router that blocks any unauthorized connections. This can be challenging to setup with something like OpenWRT. There is a forked OpenWRT device running a version that makes a lot of this easier called PC WRT. That can make a whitelist fw a little easier than sorting out NF Tables and scripting a whitelist firewall.