I am looking for a driver and typed the hardware ID into google. I found information as well as sites that offer the driver.
I am hesitant to accept the offer since they are not the original source and I do not know their business model.
Is it secure to download drivers from such sites? Are there known secure and insecure sources?
While I don't know of any known good or known bad driver download sites such classification might change rapidly when known good sites get hacked or change their business model maybe after getting sold. This happened in other cases too, for example with trusted browser extensions.
Thus the safest choice is to get the drivers from the original source, i.e. the vendor. While there were hacks of vendor sites in the past it is still the safest choice because the vendor definitely has an interest in providing the user with the correct software while the business model of these 3rd party driver download sites is unclear. And of course use signed drivers only.
Recent Windows versions requires that all drivers be cryptographically signed. Assuming that you don't disable signature checking, and that you check that the driver is signed by the original company, you can be assured that the driver itself is probably unmodified from what is in the original company's website.
However, there's no guarantee that you're running the original installer. It's possible that a rogue driver site wraps the driver with rogue installer, that then installs some other malware in addition to the unmodified driver.
In short, it's probably unwise to install any software (including drivers) that is downloaded from untrusted third party sites.
