Lenovo crams unremovable crapware into laptops by hiding it in the BIOS (2015)

https://www.theregister.co.uk/2015/08/12/lenovo_firmware_nasty/

by beefhash • 7 years ago

130 85 7 years ago

theregister.co.uk

usr11065• 7 years ago

Doesn't affect me because I have not run Windows for 10 years. I install Windows on every PC. I would prefer to run ARM more wideley, but unfortunately the hardware choice is limited.

That said I am not overly confident that with Linux I am totally immune against executing code I never intended to. The kernel needs to cooperate with the BIOS. I would not been surprised if the BIOS can make it execute arbitrary code provided by the vendor. It just needs to be a bit more tricky than telling the operating system look here is a binary in RAM, please save it on root file system as /bin/init

bluecmd• 7 years ago

You don't even need that. The BIOS can just install vulnerable SMM handlers and then you're screwed.

I don't get why you say it doesn't affect you - bloated and crappy firmware affects everyone, regardless of OS.

usr11065• 7 years ago

The described mechanism does not affect me, because Linux kernel or any distro does not take a binary from RAM and installs it into the rootfs.

I don't claim that Linux could not be made to execute arbitray code injected by the BIOS. So far I am somewhat optimistic that no HW vendor does it, it's a bit more tricky because different from Windows Linux does not offer a specified API to do such installation. With enough dedication and effort the BIOS could install programs to be run every boot also in Linux. I have no illusions that Linux prevents that (unless you use image signing, dm_verity and whatnot), I am just somewhat optimistic PC vendors don't bother to make the effort required.

usr11065• 7 years ago

The BIOS can just install vulnerable SMM handlers and then you're screwed.

Writing SMM handlers is not an easy job. Using the API provided by Windows to make installations as described by the article is an easy job. The installed program is just plain simple user space code that can use all services of the operating system. No special skills required to make it phone home.

Are there any reports of an SMM handler able to phone home? (Honestly curious)

usr11065• 7 years ago

install vulnerable SMM handlers

How can an SMM handler be vulnerable? The biggest problem with SMM is that they run in ring -2. Nothing on the machine can see what they are doing. Well, they are using memory, if you can manipulate the memory they are using you can manipulate what the handler does, even if you cannot see it executing. But wasn't that the hole closed in 2011? https://www.theregister.co.uk/2015/08/11/memory_hole_roots_i...

This is fascinating to discuss or very worrying to use. That's why I wrote I'd prefer ARM over Intel any time. It just does not have such a horrible mess of BIOS, SMM, ME and whatnot taking control away from the programmer/machine owner.

But setting a simple Windows API like WPBT described in the article in relation to SMM is comparing apples and oranges. Linux has nothing comparable to WPBT, but of course it cannot be more trustworthy than the Intel/PC platform to begin with. For a dedicated 3 letter agency that's probably equivalent to not at all, but for the average PC vendor trying to force their idea of "user support" on you it's a sufficient hurdle, I'd hope.

Vrondi6• 7 years ago

If it's in the BIOS, it doesn't matter what OS you use. The BIOS powers up first and is active before the operating system ever is.

tinus_hn3• 7 years ago

Except only Windows cares to actively look for the Windows program offered by the BIOS and run it.

usr11065• 7 years ago

stupid mistake, sorry

I install Windows on every PC

Linux of course

basicplus2• 7 years ago

not sure why anyone in the know would ever buy lenovo..

Also cannot believe IBM compromised themselves being involved with Lenovo with their pc's and legacy servers like systemx

https://systemx.lenovofiles.com/help/topic/com.lenovo.system...

areoform3• 7 years ago

Some of my highest rated comments were for Apple's recent failures. Their laptops shipped with an unworkable keyboard. New product lines were confusing. The existence of the MacBook alongside the MacBook Air defied logic. Their "pro" machines were no longer pro. The list went on.

Apple has changed some of that, but even if they don't, my next laptop will still be a Mac.

Because Apple doesn't install shit on my machine. Apple fixes security holes. Apple doesn't cheat me on my privacy when I buy a machine.

Apple might suck donkey balls but everyone else sucks even more. Pardon my French.

elorant2• 7 years ago

Then buy a Linux laptop. Problem(s) solved.

I can't understand some of you guys. You pay 2k for a laptop which has a shitty keyboard and then you look for excuses to justify your decision. Sure, a lot of what you mention about Windows machines is true. But they're also preventable with work arounds. What kind of a work-around is there for the problem with MacPros keyboards?

I have a Toshiba laptop (Tecra Z40). Aside from the crap they install to make their tailor-made hardware to work everything else is stellar. The machine works for the last two years problem free, and it will probably keep working for another five. Don't make it sound like every non Apple laptop is crap because it isn't.

acqq4• 7 years ago

Then buy a Linux laptop. Problem(s) solved.

I use Linux on the notebooks since around 2003. The problems are far from being solved, from my experience:

- There was constantly some piece of hardware that wasn't supported.

- There were constantly pieces of operating system and user space that were simply broken until a lot of manual work is applied.

- The brokenness increases with every update. At the start I didn't use LTS (I don't even remember if the LTS versions even existed for the distro I've used) -- it was a major pain. Six months go by, new upgrade, everything's broken. Search the internet, ask: "oh you upgrade an existing installation? It's not tested, you should installed blank and copied your data, we do that" -- oh thanks.

- The brokenness of power saving is amazingly persistent. Linux notebooks typically worked acceptable only when plugged in.

- Even worse, the brokenness of the possibility of playing the stutter free videos: https://xkcd.com/619/ I have still that problem (it was not only "flash" that was and is the problem!) and discovered that the "lighter" compositors that are advertised as supposedly needing less resources made even worse results. I still have computers that in 2019 with the latest Linuxes can't play videos normally, whereas on the same computer videos in Windows play perfectly.

In short, if you need a computer only for a very reduced set of tasks and are ready to spend the time "fixing" the remaining issues, Linux can work for you. But don't expect "problems solved."

On another side using Windows brings its own crazy pains: if you keep even the Windows provided "antivirus" solution on, even file copying can be orders of magnitude slower than what the machine would be able to do.

Plus the crapware. And the exposure to many more viruses trojans etc. Or even the ads built in in the OS.

So what's then left? Apple. Also not perfect, of course, but some problems are actually "solved" from the start. But using Apple computers brings its own issues and, of course, prices.

It's just the question which kinds of problems you want to be exposed to.

I personally can't stand not being able to reasonably easy replace a hard disk in my notebook. I don't even know what I can buy the next time.

areoform3• 7 years ago

I feel this comment is unnecessarily combative.

Setting aside security. I have owned laptops from every major brand. IBM ThinkPads, Toshibas, Lenevos, Dells, Macs and ASUS. So far, other than ASUS, I've run into more hardware issues with these laptops with fewer repair options available. They've also had bad battery lives compared to the Macs at the time.

I've bought laptops and flashed Linux on them. I've used Ubuntu since Hardy Heron. But none of the laptops worked as seamlessly and as well as my Macs. The touchpad wouldn't work. The WiFi would fail. Sometimes updates broke the machine if they worked at all. Printers weren't plug and play. A few times the system crashed because of a configuration error that was unintentional. All in all, it was a poor experience.

The difference in the experience is summed up by what happens when you open the box. A new Linux laptop would require an install, then hunting down the files, copying it over, doing updates, changing settings, changing the configuration etc etc. A new Mac is simple. I bring it home. Turn it on. It goes on my WiFi, finds my Time Machine and does the rest. I have perfect continuity from my old machine to the new. I have settings and programs here from 3 machines ago.

I like to use my computer to work rather than working on the computer.

Moreover, from a security perspective, I trust a company like Toshiba less. Mostly because the Toshiba comes with a ton of bloatware installed; https://www.google.com/search?newwindow=1&hl=en&ei=hsR8XZmLF... and you never know what they might install. As of writing, my Mac just doesn't.

spodek• 7 years ago

Agreed. My past several computers have been used from Craig's List, $500 for roughly $2,000 machines. Installing Mint has been flawless. Everything just works (Lenovo Carbon X1).

Vrondi6• 7 years ago

External keyboards? LOL!

delfinom• 7 years ago

Apple doesn't cheat me on my privacy when I buy a machine.

Except that siri thing

Austin_Conlon• 7 years ago

Could you elaborate? “Hey Siri” is opt-in when you set up a Mac.

rubbingalcohol• 7 years ago

The installer itself lets you choose to enable or disable Siri. Like it's one of the first choices you make when you first set up the machine.

echelon2• 7 years ago

Thinkpads do not have this crapware installed and can run Linux exceptionally well. You should look into one, because they're the best engineering laptop on the market.

Thinkpads have excellent keyboards, are user serviceable, support SIM cards, have tons of ports, are rugged yet lightweight. The manuals have hardware break downs to help you reinstall battery, RAM, drives, modems, etc.

The machines last forever. I have a few that are over a decade old and are still a joy to write software on.

Thinkpads are truly at another level.

noir_lord• 7 years ago

Not to mention a 3 year on-site warranty (pretty much..it slightly varies on region) as standard on a T series.

My 470P was expensive for a windows laptop at £1368 (I went for the 2560x1440/nvme/i7-7700HQ) but the peace of mind of having it fixed within days combined with the build quality still makes me happy with it as a purchase.

virtualwhys• 7 years ago

You should look into one, because they're the best engineering laptop on the market.

Dell Precision line may not have the great TP keyboard, but otherwise it's hard to beat a 7740, for example, performance-wise. If anything the Thinkpad P73 and Precision 7740 are similar spec-wise (7740 has marginally faster processor i9-9880HK vs. i9-9880H, and GPU, RTX 5000 vs. 4000), with the P73 coming in at 1lb heavier.

Though you'll pay through the nose for the 7740 with maxed out specs. Just for kicks I configured the following machine:

  CPU: i9-9880HK
  GPU: RTX 5000
  HD:  4 X 2TB SSD (RAID 0)
  RAM: 128GB
  SCREEN: UHD 3840 X 2160

A mere $21K USD :)

reaperducer2• 7 years ago

Thinkpads do not have this crapware installed and can run Linux exceptionally well

It's still supporting a company that thinks it's OK to install crapware on their consumer machines. Machines intended for the people least able to mitigate the problem.

Even if someone's not an Apple fan, he's right to send his money to another company.

guitarbill• 7 years ago

I'll call BS. Granted, this was a few years ago, but the W520 and W530 had quite a few issues with the Advanced Programmable Interrupt Controller (APIC), and you had to boot them with `nox2apic`. Additionally, although they had both integrated and discrete graphics cards, only the discrete was routed to the video out (no mux). Switching wasn't good on Linux, so you basically had to force discrete only, which knackered the battery life.

All machines can have issues. By all means, shop around and buy the best machine for your use-case. But brand loyalty is misplaced.

diminoten• 7 years ago

Linux is not a comparable desktop experience to macos.

mcv2• 7 years ago

Until I read this, Thinkpads were at the top of my list for a new laptop. But even if they didn't do this on Thinkpads, the fact that Lenovo did this at all, does not reflect well on any of their brands.

Medicalidiot• 7 years ago

I'm not a huge fan of Apple, but I love everything about my 2019 MBP minus the keyboard. After using Linux for close to a decade it's a fairly seamless transition compared to going back to Windows.

dehrmann• 7 years ago

You should look into how to recover data if the laptop doesn't boot.

mcv2• 7 years ago

With Apple's direction towards their walled garden, glued components, questionable changes to their macbooks, and their recent keyboard troubles, I vowed to buy something else this time. But crap like this might chase me back into the arms of Apple.

chachachoney• 7 years ago

> Apple doesn't cheat me on my privacy when I buy a machine.

Have you ever monitored all the telemetry Mac OS sends back to apple related domains?

aloknnikhil• 7 years ago

If you didn't opt-in to data collection during setup, the only telemetry that goes out is crash reports (also an opt-in for every crash). Crash reports have nothing more than the stack trace and some information on the environment/OS parameters on the system. Nothing that's PII.

plg2• 7 years ago

What about Microsoft surface book? I have colleagues who are in science/coding/tech and they really like them.

staticautomatic• 7 years ago

You mean the one with the screen so fragile you can break it just by closing the laptop normally, replacement of which MS won't cover under warranty because they insist it's not a defect?

mrkeen• 7 years ago

I owned a MBP back around 2007.

I later purchased (in-person, in-store) an ipad pro using a credit card, maybe around 2015. The receipt they gave me had my email address printed on it. That really creeped me out.

coldtea• 7 years ago

They keyboard, ok, and I'll give you the "pro" (though, if you're talking about their laptops and not their desktop pro model, they were totally pro). But this sounds like hardly a complain:

"New product lines were confusing. The existence of the MacBook alongside the MacBook Air defied logic"

One could always buy one or the other or neither...

redprince2• 7 years ago

For what it's worth, the professional equipment marketed under the "Think" brand was not affected by this. It was only ever a problem for their consumer line of devices.

https://news.lenovo.com/pressroom/press-releases/lenovo-stat...

In general the Intel platform is quite the horror show of complex, deeply embedded layers of closed source software outside of the control of the user or the operating system. All the while these components have full control over the machine and all software running on it.

Intel ME, AMD PSP, the UEFI BIOS were just some sources of vulnerabilities coming with the hardware. So just buying another brand of laptop, PC or server won't do. There would need to be a fundamental shift towards handing back the user or owner full control over what is executed on his machine.

tonyedgecombe• 7 years ago

For what it's worth, the professional equipment marketed under the "Think" brand was not affected by this

That doesn't make it OK.

redprince2• 7 years ago

It should go without saying that it isn't okay. But thank you for helping the people with broken moral compasses.

CaptainZapp• 7 years ago

Certainly not ok, but very helpfuj.

I sure as shit will never, ever buy anything Lenovo. Pro or otherwise.

api• 7 years ago

I still wont buy them as the entire brand is tainted by this customer hostile crap.

Jemm• 7 years ago

My brand new Lenovo has no crapware at all. It had McAffee (now owned by intel) but that was easy to remove.

Compared to Samsung who put a non removable Facebook app on their A50 phone I am happy with my Lenovo. The Samsung -home went back not only because of the Facebook app but also because the fingerprint reader did. To work better than 10% of the time and the digitizer was horrible.

noja• 7 years ago

My brand new Lenovo has no crapware at all. It had McAffee

McAfee is crapware.

Compared to Samsung who put a non removable Facebook app

adb shell pm uninstall -k --user 0 com.X

runlevel1• 7 years ago

McAfee was actually spun back out of Intel in 2017.

tinus_hn3• 7 years ago

It had no crap at all, except for this crap.

josteink• 7 years ago

To be fair this crapware affected Windows users only, and was removed swiftly in a quickly issued BIOS update after this caused a PR nightmare... back in 2015.

So why are we discussing this now, almost half a decade later? Why is this suddenly relevant again?

i_am_proteus• 7 years ago

Because there are a lot of people who really like Macs and there are a lot of people who really like things that aren't Macs and these people do seem to enjoy engaging with/against each other.

Wowfunhappy2• 7 years ago

So, how can I disable the Windows functionality that makes this type of thing possible? Surely there's a way?

Vrondi6• 7 years ago

No. Windows does not control the BIOS. The BIOS activates when the machine is powered on, before the operating system becomes active. This is at the hardware maker level, and outside the control of Windows.

ndidi• 7 years ago

The article mentions how Windows reads an ACPI table, looks for a specific executable file, and willingly runs it. It's not the BIOS forcing anything to happen, Windows goes out of its way to look for an .exe that is bundled in the BIOS and then happily runs it.

peter_d_sherman• 7 years ago

Here's a writeup on what I've been able to piece together (thus far) on this:

https://pastebin.com/wLyjNvFC

Note that it this rootkit/malware seems to be somewhat independent of manufacturer, that is, it's not just Lenovo but several other prominent laptop manufacturers where the same phenomena occurs...

tinus_hn3• 7 years ago

The issue is with Microsoft forcing this ridiculous behavior.

Lenovo crams unremovable crapware into laptops by hiding it in the BIOS (2015)

Related Stories