Tips for buying used computer?

Privacy and Security Get Advice
1

I’ve caught the bug for wanting to potentially buy an old Thinkpad. It’ll be just to have a new, slimmer laptop to use around the house instead of being tied down to the table where I parked my gaming laptop. From a tech perspective I know what specs and such I’m looking out for, but I wanted to get opinions on what to keep in mind from a security and privacy standpoint. I will be wiping whatever drive comes in the laptop so I can install Linux on it. Does that pretty much cover any risk I would have had of malware or spyware?

My threat model is basic, but I like to go further than I need to. I’m mainly worried about hackers and scammers when it comes to buying a used computer, nothing more advanced.

2

Sounds like you’re on top of it. Just three things:

  1. Lenovo doesn’t have the best reputation for Privacy/Security. They’ve previously installed BIOS level rootkits, on their devices. They’ve also backpeddled on working with privacy and Linux distros, like Fedora. For them, privacy is just lipservice. You might want to read THIS Wiki article on Superfish, and THIS one from ESET.
  2. Normally I’d advise you to update your BIOS, to help remove BIOS level malware, but read point 1.
  3. Doubly make sure the laptop you’re looking at has good Linux support. Not all of their range works well in Linux.
3 Likes
3

You are pretty much powerless against BIOS level malware and sophisticated rootkits, see @Blurb5778 points, so it’s my suggestion to buy a cheap new laptop if you can go with that. Also there are other issues that come with older laptops(hard drive failure, older tpms etc.). Chromebooks are generally compatible with most Linux distros.

If buying is absolutely not an option I suggest checking for rootkits with Kali(chrootkit, rkhunter), analysing with wireshark etc. Flashing may or may not help with sophisticated BIOS malware. You can do it regardless.

2 Likes
4

How does buying a t440p and installing coreboot on it sounds to you?

1 Like
5

It’s not something I’d feel comfortable suggesting for most folks. Last time I checked, installing something like Coreboot is not easy. If you have the know-how, and don’t mind taking a chance, go for it.