Yes it is a brand-new laptop. Hence my surprise at the stripped screws.
Edit: crap it was actually a v3, without TPM. I forgot that all i7’s are v3.
Curious. I didn’t know you could buy a v2 brand new anymore. Did you get it directly from Purism?
Not all i7s are v3. I recently ordered the i7 13 and the customs info from Purism (hasn’t arrived yet) states Librem 13v2.
I think if you have TPM module it is a v3. If you don’t it is a v2.
All L13v3 have a TPM, so if it says L13v3 on the bottom cover then it has TPM. If you ordered the one from clearance which is supposed to not have TPM, then either :
- It was out of stock so they simply upgraded you to l13v3
- Someone in the warehouse ‘screwed up’ and shipped you a l13v3 instead of the non-tpm l13v2 you were supposed to get
- Someone in the warehouse ‘screwed up’ and after installing SSD/RAM, swapped the cover from a l13v3 with yours, so you have a l13v2 but it says l13v3 stenciled in the bottom cover.
Also note, all l13v3 are i7, but the l13v2 were both sold with i5 and i7 processors.
To answer the actual problem : The inside box being ripped is weird, and I doubt the NSA would do a mistake like that if they were trying to tamper. I’d guess someone (again) ‘screwed up’ and damaged it during packaging/shipping/whatever. As for the screws being slightly stripped, that’s weird but not entirely unexpected. Don’t forget that the machines don’t come pre-assembled by a robot in a factory, when you make your order, someone takes a ‘virgin’ machine, unscrews it, installs the SSD/RAM of your choice, the wifi card, then boots it, installs coreboot, installs the PureOS OEM installer on it, then goes through QA, then screws the cover back. It’s quite possible that that’s what caused the screws to get slightly stripped.
And finally, to answer the actual question: Yes, if you update coreboot, it would overwrite any firmware-level backdoors that might be inserted. There wouldn’t be any other firmwares that I know of anywhere on the machine, and even less one that would allow remote access.
If you are truly paranoid or worried, I would suggest opening the machine and flashing coreboot using a hardware flasher (because, if the machine is compromised, how can you be sure that you’re not running inside a virtual machine and the SPI controller simply ignores any write commands?). I don’t think that’s really possible to hijack the SPI controller, but it’s safer to say “the only way to know for certain is to use an external hardware flasher”.
But yes, if you’re worried, just update coreboot to make sure you have the latest version of coreboot and you have the one that you built yourself and known not to have been tampered with.
P.S: if you press ESC during SeaBIOS, if your machine has a TPM, then seabios should show you a “t. TPM Configuration” menu option. Easy way to check for it…
1 Like
My thoughts exactly. Typically if a high power heavily funded organization is trying to monitor you or infiltrate your hardware, they wouldn’t make it blatantly obvious. 
Thanks for the informative response kakaroto!
Isn’t there a cbmem command which will tell me if my most recent write was successful, and what the currently-installed version number is?
For example, if I update coreboot with a new version, I should be able to use cbmem to read whether the installed version of coreboot changed successfully, right? I realize that if the attacker was sophisticated enough then this too could be fake, but I think automatically updating the backdoored coreboot version based on previous flash attempts is probably too sophisticated an attack for me to worry about it being likely.
I appreciate your help!
Also, BTW:
According to other people at Purism, all i7-based 13-inch Librems are 13v3. So now I’m getting conflicting information on whether mine is 13v2 or 13v3 lol… But I was previously assured that mine was 13v3 because it uses a core i7, regardless of TPM.
I really hope my changelog suggestion can be considered so we don’t have this confusion with future librems. 
Not all i7s are v3. I recently ordered the i7 13 and the customs info from Purism (hasn’t arrived yet) states Librem 13v2.
I think if you have TPM module it is a v3. If you don’t it is a v2.
See here for the answer I received when I asked about this.
Thanks for that! Appreciate helping figure it out for me 
1 Like
cbmem is the coreboot log when it boots, so it wouldn’t tell you if the write was successful, but when you reboot, you can see the new log and see whether it shows the new version or not.
To see current version use dmidecode -t 0
I’ll need @mladen to confirm but I’m pretty much 110% sure that ALL L13v3 are with TPM, and that we had a bunch of L13v2 that had i7 and TPM or i7 without TPM.
To be more precise, the L13v2 was the main skylake machine, and we had a batch with i5 processors, then we made another batch with i7 processors (because i7 was promised to some people). Then we stuck with i7, but this was still L13v2. After that, we introduced TPM as an addon. Users requesting/choosing TPM received a L13v2 which had a small TPM module manually soldered on the motherboard in the factory.
After that, we redesigned the motherboard, the TPM module was integrated in the motherboard instead of being a manually soldered TPM module, and the hardware killswitches were moved from the screen hinge to instead be on the left side of the machine. Since this was a new motherboard design, the version number was bumped to v3.
So, yes, L13v3 all have TPM in them. They are also all i7 machine, but L13v2 came both with i5 and i7 and came both with TPM and without TPM.
What you need to know to figure out if you have a l13v2 or l13v3 is to look at what is written in the bottom cover of the machine, and just to confirm, if your hardware killswitches are on the side of the body instead of being in the screen hinge, then you have a l13v3.
Like this? https://wiki.puri.sm/hw
I replied in the other as well.
Like this? https://wiki.puri.sm/hw 2
I replied in the other as well.
Well, there’s no specs or changelog on the 13v3 page, and there’s literally zero information whatsoever on the 13v2 page as of today…
So although the wiki looks like a great place to put a changelog/specification list, it doesn’t currently have that information.
Yeah, it’s very much a ‘work in progress’/incomplete page, but that’s where the information should reside.
Hey all,
I cannot help much with the tempering issue but it seems to me that updating/reflahsing all that you can is a solid starting point.
I am writing to chip in on the V2/V3 debate, my 13 is a V2 with an i7 and TPM. Switches are on the hinge and the cover says V2. I placed my order with the i7 but no TPM, as it wasn’t available yet, over a year ago. The manufacturing process took many months and through the course of my email exchanges with Purism I learned that TPMs had become available, so I had one added.
I think I am not alone in this because that batch of Non-TPM machines that were recently on sale must have included my original machine and everybody else’s who made the switch once that became available.
Good luck with your issue.
1 Like
Just FYI to the OP, and others: they have recently found exploits in the wild (more than just talks) of writing to special persistent memory in the BIOS that remains even after a BIOS flash.
I recently posted a topic to Purism to see if these machines are open to the same attack.
3 Likes
I didn’t see anything in the article you linked that implied the malware would remain after a BIOS flash… Though that is an example of the type of malware I’m trying to protect against
Your right. After re-reading it, they are exploiting Secure Boot UEFI firmware modules that are not protected by Secure Boot signatures. E g. If u have secure boot disabled it gives the attacker an opening. In addition, the system needs to allow writing to UEFI from within the OS. They also uses various bypasses to get around poorly implemented safe guards.
So yes, re-flashing rhe bios (aka UEFI firmware) looks to remove it - if the firmware doesnt precent you from re-flashing. There was anothrr article I can’t find at the moment that suggested it could prevent future writes by invaliding pre-flash checks.
I recall the old AMI legady bios flashing tools had a way to force a flash without checking, without a whole bunch of warnings. Not typically something an end user would agree to.
My box was not even sealed. I think Purism should definitely implement some sort of tamper protection.
1 Like
I don’t know. I think this is sort of a slippery slope. On the one hand, yeah it makes sense. On the other why don’t they go even farther? It becomes a rabbit hole that is very deep, and in many cases highly subjective.
I think given that the laptops are coming from Purism themselves, and then given to a carrier (UPS, USPS, FedEx), the integrity of your box is subject to the carrier. You can assume there are no security problems coming from Purism (otherwise, why did you order from them?).
Depending on where you live, there are many possible vectors of problems that are completely outside of Purism’s control. So if you are truly paranoid about all of this, then you have all the tools to ensure you are secure.
I purchased my librem last year and had the same concerns re safe and secure shipping. I have no computer software knowledge or even linux training, however, i have found some interesting research by quinn michaels, a computer programer documenting research you can find at his youtube channel and at crowdsource the truth interviews. i’ll enclose a link to just one of his many disclosures concerning the regarding the current state of technology and another link discussing the work, research of mathematician, mit, norbert wiener. amazing and vital information that i can even understand… you customers and programs at purism will be shocked and mystified without a doubt… this goes to the deepest levels of ai and where we are today, right or wrong, good or bad, your point of view will be challenged… please support the work of quinn michaels, like, share with others. https://youtu.be/F4ihlWZYMlE entitled artificial intelligence psyops tyler and q anon. BEST to everyone