Hacker News Reader

Comment by sneak | Hacker News Reader

I'm wondering how long, or if ever, it takes for reasonable people to resume buying Lenovo products after they got busted using a firmware-based rootkit to reinstall their manufacturer spyware onto a freshly formatted OS install (the same year they got busted preinstalling third-party adware, which resulted in an FTC settlement/fine).

Do you wait like a year or three? five? Do you never buy Lenovo again? What's reasonable? This isn't rhetoric: I'm legitimately asking for a figure, as well as a rationale, because I don't know the answer.

Personally I'm in the market for a high end laptop for running Linux, and I just couldn't see myself buying something from them ever, no matter how good their machines are, because I just don't trust the people in the organization who develop products to take system integrity seriously enough.

View on HN

I don't like Lenovo. Their laptops have steadily declined by every metric I care about since the X220. But Thinkpads are still better (by those same metrics) than anything else I've come across.

Would be willing to buy something else. Anything else. But most other laptops out there have even worse keyboards (which I deeply care about), terrible form factors, specs that are stuck in 2010, awful support/warranty, no Linux support, or all of the above!

If someone builds something I'm happy with, I'll buy it. Price is not an issue. My laptop is my toolbox. I want it to work the way I like it. If it breaks, I need to have fixed preferably today, but tomorrow or the day after can be acceptable as well. That basically leaves Lenovo & Dell.

System76?

No AMD option, I don't think.

if only they werent plastic. my laptops would be toast after about a year but my mbp is going on 5 (did have to replace the screen, but was done under warranty)

The web is full of complaints about System76. And the, they have really cheap parts compared to Thinkpads.

I just looked at the System76 laptops, and they are strikingly similar to the Powerspec(Micro Center)/Sager laptops? Is the resemblance superficial or something else?

System76 uses Clevo/Sager laptops. However, they don't "just" pull off the shelf computers and put an OS on them, they're involved with the design of the laptops from the beginning.

This thread has more information from someone who works at System76.

https://news.ycombinator.com/item?id=17039414

From what I can tell from their website, their idea of "support" seems to be RMA. I'm not going to be buying a laptop from someone who expects me to ship it to the other side of the planet so they can fix it. That's a hard pass for me. It's really hard to beat Lenovo (or Dell) next-business-day-on-site repairs.

Lenovo’s on site support is not that great though. I used it twice. Once for a broken drive, where they shipped me a new drive without any explanation or ever sending someone. Second time a broken keyboard a month ago, where they refused to send someone because I was working from home and not from a business address, and also refused to send the part (which is supereasy to install) because it was not marked as user-serviceable and then threatened they would revoke my remaining warranty if i bought the part direct and installed it myself. (I did it anyway.)

My understanding is that the Thinkpad line is a bit segmented from the rest of the company. As a result, those poor decisions haven't effected the Thinkpad line. It helps also that I immediately switch everything over to Linux

I do understanding that it's entirely feasible for them to rootkit Linux from the BIOS and install malware onto their Thinkpads but I just haven't seen it happen yet

For what it's worth, I also own quite a few of their older laptop lines (Mainly X230's) and I've been slowly flashing Coreboot onto them

I know that's not feasible for their newer lines, which I also own

> I do understanding that it's entirely feasible for them to rootkit Linux from the BIOS and install malware onto their Thinkpads but I just haven't seen it happen yet

It’s not actually, because the mechanism which allows a vendor to provide “drivers” via UEFI is used by Windows only and nobody else. Windows exclusively is the target of such UEFI abuse.

Lenovo can put as much garbage and bloatware they want in the relevant UEFI firmware-sections, and Linux will simply ignore it, like it always have. No root-kit will be triggered.

As a Linux-user you are actually 100% immune against this abuse. As a ThinkPad-owner doubly so, since this major fuck-up only affected budget/non-Thinkpad product-lines.

Hm, it was a problem on the professional ThinkPad line as well.

https://thehackernews.com/2015/09/lenovo-laptop-virus.html?m...

Naw, that story is ridiculous. One person bought two "refurbished" ThinkPads from IBM and claims they found some stuff on them.

Show me one example - any example - of Lenovo installing any of this kind of stuff on a factory fresh ThinkPad, and then we'll have something to talk about.

Until then, I suggest ignoring biased and axe-grinding sources like "thehackernews".

I'm in the security industry and bought a ThinkPad (X1 Carbon) 6 months ago. It has the form factor and specs that I want.

What is the threat model? They will not be using the rootkit for hiding useland malware. Are they extracting my documents and misuing them? Are they performing MITM on my connections and doing something harmful? While the capability is there, I don't see the software being used in a way that will inconvenience me.

It is a weak point in the system, maybe someone else exploits it, but I have so much software that I can say that about. When looking at threats the question for me is what is most likely to get me owned. It will probably be phishing or a malicious document. That's not going to change based on the manufacturer I buy from.

If I do get owned by some targeted malware that uses a Lenovo driver for priv esc, well they were probably going to get me with or without that. As good as it would feel to boycott a company with poor security practices, I'm over running unrefined System76 laptops.

“ Are they extracting my documents and misuing them? Are they performing MITM on my connections and doing something harmful? While the capability is there, I don't see the software being used in a way that will inconvenience me.”

Please explain this further.

Not snark, genuinely curious.

There are capabilities that can be misused, but I generally trust the companies with those capabilities to not misuse them.

Maybe Lenovo will include a sketchy driver, but I trust Lenovo to not use that driver to drop ransomware on my machine. In the same sense I trust Google with my location and emails. You may trust an AV company that can upload any file on your machine to not grab your tax returns and open a new credit card in your name.

Even if Lenovo starts intercepting my private web traffic or placing files on my machine there is only so much damage they can do. They are not about to frame me by dropping plans to overthrow the government in my downloads folder then blackmailing me to design more secure drivers for no pay.

There are threats I'm afraid of and a computer manufacturer, no matter how negligent, is not one of them. Is OP avoiding Intel too? Meh.

Did you miss superfish?

https://www.cnet.com/news/superfish-torments-lenovo-owners-w...

It did MITM to inject ads, including adding their cert to the trust store to MITM SSL connections.

Of course the software needed the private key to work, which they shipped to every laptop and was quickly put online.

All of the sudden banking at coffee shops on a lot of Lenovo models was no longer private.

I'm not sure if captured traffic could be retroactively decrypted, but I wouldn't doubt it. PFS support probably wasn't high on Superfish's priorities.

please folks, dont do your banking on open coffee shop wifi

I do this all the time. My machine has a modern browser, up to date OCSP, HSTS already cached, all that. Could you please explain to me the danger or threats you are warning against?

What does "up to date OCSP" even mean?

Have you configured your browser(s) to "fail closed" when it comes to OCSP queries? CRL and OCSP behavior has been, well, "not ideal" since basically forever.

Honest question - why not? My bank uses this cool thing called TLS. What’s the threat model here?

yes legitimate traffic is going to be fully encrypted thanks to TLS, the risk comes from attacks where you believe you're logging into your banking site securely when you're actually not. for example dns cache poisoning, ssl downgrade attacks, etc.

in the case of a starbucks, the AP itself is not necessarily secure (under a counter somewhere?) so it's possible users are connecting to a malicious AP.

the threat model depends on the level of risk: the convenience may outweigh those risks, it may not. for myself it is one of a few tasks i wouldn't engage in on a network i don't have more trust in, but in retrospect this advice was indeed probably too strong for most.

Again - who cares about dns cache poisoning when your cert chain is sound and your browser is sensible about cert downgrades (which all of them are now)? Who cares about how secure the AP is? It’s an encrypted, securely authenticated connection. That’s the whole point of the cert chain. The AP can be as malicious and evil as it wants - good luck usefully tampering with or impersonating my bank’s public key.

Again, what’s the threat model here? Exploiting a browser vulnerability? Maybe?

Superfish was never on Thinkpads, only Lenovo's consumer laptops. The Thinkpad division and the consumer laptop division seem to operate somewhat separately.

Not to excuse Lenovo - they fucked up big.

Superfish was never found, but there has definitely been malware installed on the ThinkPad line:

https://thehackernews.com/2015/09/lenovo-laptop-virus.html?m...

The firmware rootkit, to my knowledge, has never been found on ThinkPads.

It seems to me this would be a function of available alternatives more than anything else. Some Lenovo products, as best I can tell, make for excellent Linux machines. What are the alternatives if that's your criteria? There are alternatives which might be acceptable depending on your other requirements for hardware, form factor, price, or geographic availability. But for some subset of requirements, Lenovo is still going to be the best option by a wide margin which is going to push someone to making that tradeoff. I don't think it's a function of time.

edit: "some Lenovo products"

For me, it is never. I tend to trust people and companies to do the right thing, but when they violate that trust, they get on my permanent blacklist. I also don't fly United or park in Impark lots for the same reason. And I will never again turn off my ad-blocker after the Forbes fiasco, despite sites begging me to do so.

You can find a reason to blacklist every company and then you can't buy anything.

There’s a difference between being nit picky and blacklisting a company for being openly hostile to their customers. Will I ever create a new Facebook account? No. Will I ever open a Wells Fargo account after their habit of making faking ones? Nope.

Writing off a company for adding root kits to their machines out of the box seems to be perfectly reasonable.

Do you use Aspirin?

Do you acetylsalicylic acid or a specific manufacturer's product?

Regardless, a lot of people would say no to either, acetomenephen and ibuprofen have largely replaced Asprin for most uses.

I've never had aspirin to my knowledge. I wonder how it's possible it's been gone for decades and it's still somehow a known product name.

Yes, most companies do something bad, sometimes and I'm all for forgive-and-forget if the error is understandable and they take steps to correct it. But doing something so way-out egregious as installing a rootkit on customer's machines speaks to a company culture that makes me extremely reluctant to do business with them again.

It’s two years. But seriously check out system76 hardware. I’ve been pleased.

If system76 would put a TrackPoint onto a laptop keyboard, then I'd never need Lenovo again.

I've thought the same thing. Doesn't IBM hold some patent/royalties on the use of a "trackpoint" though?

So, make it a extra cost option and have the buyer pay for the license?

Or, copy trackpoints from outside of the patent window. A 20 year old trackpoint won't be as good as a modern one (probably, I'm not a trackpoint user), but it's better than no trackpoint?

Probably. Dell/HP/Panasonic have equivelants that are nearly as good, but named differently. I don't know if those involve royalties to IBM or Lenovo. TEX Keyboards in Taiwan also makes a TrackPoint-enabled keyboard too.

Until upper management changes. They are the ones who encourage this behavior (if not directly, then indirectly so they have plausible deniability - see Wells Fargo - but still intentionally). Only when they change is there a hope of this sort of behavior changing.

I should be bothered in a theoretical sense, but I'm just not in a practical sense. I just bought a Legion series because it was the best deal (because Asus doesn't sell in my country). If I'm running Windows, I'm going to get random arbitrary bloat anyway, so I don't really see the mechanism as important.

Arguably you might want to buy from the company that had the most recent scandal because they're more likely to be on their best behavior.

Doesn‘t seem true for Facebook.

The odd thing is that I don't remember this, do you have a link. I mean, I remember the Bloomberg article that claimed unauthorized physical embeds on PCBs from China. But I don't remember the Indestructible Lenovo Spyware scandal!

https://www.zdnet.com/article/lenovo-rootkit-ensured-its-sof...

Nice explanation of how it works:

https://www.howtogeek.com/226308/the-windows-platform-binary...

The trend seems unstoppable, windows telemetry is not optional, apple owns your system, google reads theough your personal information, etc. Pointing only to lenovo isn’t better than pointing to this general tendency of collecting our data non-optionally

They had rootkits on Yoga, Ideapad and other fancy models. Business-oriented laptops did not have rootkits.

Is there a way to detect such big brother firmware and flash it?

It's a non-issue if you're not using windows. Basically it's a windows "feature" where if a certain ACPI table is present in the firmware, it will download and execute it. There isn't actually any malware/spyware executing on the firmware itself.

> Basically it's a windows "feature" where if a certain ACPI table is present in the firmware, it will download and execute it.

What in the actual fuck... this seems straight off a dystopian graphic novel

https://www.gnu.org/philosophy/right-to-read.en.html

When I play movies I've paid for on my iPad I've paid for, if I want to screenshot frames from them to share or reference or meme, the screenshots come out as black rectangles.

Sarcasm: That’s because it would be trivial to screenshot every frame and reassemble the video from there.

No fair use for you!

The intent is that manufacturers would use this to provide critical drivers for windows users. Stuff that wasn't on the retail OS cd, but you would need to get to windows update. Or something, I dunno. Of course, the race to the bottom being what it is, if you can get $20/unit to put sketchy garbage in it, it's going to happen. Just because you're paying for something doesn't mean you're not also the product.

The original intent seems OK. Why the hell does this mechanism need the capability to execute arbitrary .exe files and not just load the most basic type of driver required (INF/DLL/etc. whatever Windows calls it)?

It's still arbitrary code running as a driver, it doesn't matter what form it takes, you can abuse the process to host whatever you want.

A DLL is also executable code; there's really no difference between that and running an arbitrary EXE. Inf files are slightly different, since they're just text-based configuration, but I doubt that you could get your theft-recovery (or whatever other) functionality using just configuration of something built-in.

AFAIK the original purpose was for anti-theft solutions (eg. computrace) to re-install themselves after a wipe. Before this, they would mount the boot drive and rewrite chkdsk.exe (which gets executed each boot) with their program. That way, their tracking software stays on the system even if you wiped the computer.

Some large motherboard vendors do this too. They'll happily drop an autoupdater onto any fresh Windows installation booted from the board.

https://www.techpowerup.com/248827/asus-z390-motherboards-au...

I wipe machines on arrival as a matter of course, so I never stopped buying Lenovo machines, but I only buy Thinkpads and AFAIK they were only pulling that shit with consumer-level machines (which are already a wasteland across most manufacturers—not an excuse, to be sure).

> busted using a firmware-based rootkit to reinstall their manufacturer spyware onto a freshly formatted OS install

Re-imaging the OS would not help in this case, so you would only be protected if Lenovo did not, in fact, put the rootkit on the Thinkpad line.

TIL - I think I had mistaken it for that period of time when they were installing Superfish onto consumer machines. Thanks!

The other option is not running Windows, the only OS which is vulnerable to this UEFI malware injection.

And then you just don’t care about stuff like that, because it honestly doesn’t affect you the slightest.

I still care because it's a strong indicator for the culture at Lenovo. If they were willing to do this then what else might they be doing that we haven't discovered yet.

Wasn't it claimed that did not happen on the Thinkpad lines?

Wasn’t it claimed that it was not happening, generally?

Thank you for the reminder; I firmly believe in voting with wallets, and they haven't done enough to regain my trust after Superfish and the BIOS bloat installer fiasco.

The very first thing I do after buying any laptop is completely wiping everything and installing Linux or re-installing Windows.

I think it's best to always start from clean slate because even 'good' manufacturers put a tonne of shit in there. So in that sense, it doesn't really matter what the manufacturer does, apart from the terrible decision making that they should learn from.

They used to use firmware-based rootkit to reinstall their manufacturer spyware onto a freshly formatted OS install. So, not matter what you do, they will reinstall even if you format the hard drive.

But only if you use Windows.

The person you replied to also suggested running Linux instead, in which case you are not affected.

Many manufacturers, invluding Lenovo, are starting to support the "Linux Virtual Firmware Service" [0].

Honestly, I would not be surprised if one of them, at some point, tried something like this with Linux, too.

---

[0]: https://fwupd.org

But that is a good thing, really.

The only thing this does, is enable you to update your UEFI BIOS and other machine-firmware from Linux, without having to have a separate dual-boot OS like Windows (or bootable USB sticks) to do that one task, and it frees you from having to download and obtain proprietary firmware-installers/checks per device you want updated etc.

I consider it apt-get for firmware and use it all the time. Everything in one place, easy to keep up to date etc. It's great!

And very importantly: It does in no way enable the UEFI-abuse with bloatware "drivers" as outlined earlier, which is still a Windows-only phenomena, because Linux does not check for nor use these drivers.

Edit: Oh hey there Jeremy. Long time no see! Where did my good ol' IRC buddy go these days? :D

While that's true for Windows (and I remember the reports so not arguing the point); it simply _CAN'T_ be true for every OS.

Consider using OpenBSD instead. The barrier to entry is higher, but worth it. Hell I'd be surprised if they could get that to run on linux without exploiting a 0day. Windows tries to be too helpful, and that's where the problems arises.

Your point is valid though; why trust them? If you follow that train of thought all the way down you'll be forced to live naked on a deserted island.

I honestly don't think most people care about this and have already forgotten about it.

That.was.not.the.thinkpad.line.

Please, ffs, learn the difference.

I’d have no problem buying Lenovo if that’s what my local computer store was offering as refurbished reasonably priced laptops.

When I was last in the market they were offering HP, so that’s what I got.

That Lenovo fucked up at some point in the past is immaterial to my purchasing decisions.

And I consider myself a fairly reasonable person.

Reply on news.ycombinator.com