Hacker News Reader

To add a reference, here's a reproduction of my comment on a discussion of Lenovo from 4 years ago [1]:

I want to emphasize how bad the TLS MITM malware was (adware is too nice a term): they installed a TLS MITM attack by adding the same CA public key to the trust store of every non-business device they sold, and then proxied all internet traffic through an on-device MITM proxy that contained the private key to that CA. Yes you read that right: every device with this malware had the public and private key used to decrypt the TLS traffic of every other device with this malware, effectively exposing every user to have all of their traffic both decrypted and MITM'd again by anyone who tries. This train wreck was malicious and incompetent.

I don't consider this a technical failure, this is a fatal business failure: either nobody in Lenovo reviewed this software integration from a privacy and security perspective, or they did review it and the business deal overruled the security team's ability to veto it, or they're so inept that they didn't notice how bad it was. In any case, this indicates an organizational dysfunction so severe there's no way I can trust Lenovo with my personal or business security again.

[1]: https://news.ycombinator.com/item?id=22194428 | Lenovo now shipping Ubuntu on high end workstations in the US

That's unnecessarily alarmist FUD from a decade ago that has nothing to do with today.

Windows 11 installed clean with support drivers has only minimal Lenovo items:

- Lenovo EasyResume Service - enables a grace period before hibernation

- Lenovo HotKey Client Loader - makes the special keys work

- Lenovo Intelligent Thermal Solution Service - fans go brrrrr

- Lenovo Platform Service - (not running)

- Lenovo PM Server - power management coordinator

The only other thing is their user-attended updater, Lenovo Update Service, that doesn't run in the background and doesn't do anything uncommanded. It finds driver, BIOS, and firmware updates. It's optional and you have to install it yourself.

Also the build quality of Lenovo laptops have gone down so much it's appalling.

Yeah this. Keyboard is shite on the new T14 gen 3. Horrible to use.

I swear the trackpad on my work-issued one takes 5 minutes to warm up before it is useable. It is quite possibly the worst laptop I've ever owned, and I've had a Vostro and a 2018 Macbook with the dodgy keyboards.

I used to be a Thinkpad fanatic due to nice build quality and good Linux support.

But in the past few years, I have taken to just buying Dell's midrange business laptops. The build quality can vary by model but they are cheaper, ubiquitous, have great support while in warranty, and Linux always runs just fine on them if you pay attention to the hardware you're buying.

Oh man fuck Dell. I get through one every 9 months at work. Absolutely the worst laptops I've ever used. Precision series.

What model? I've been pretty happy with Dell machines at work. Happy enough I bought an older model refurb for 200 dollars shipped, which fits the chargers and docks and such I had lying around from work.

Model: Precision 7520 Cpu: i7-6820HQ Memory: 32gb Gpu: Nvidia Quadro M2200 4GB Storage: 500gb SSD Display: 15" 1080p

Pretty good specs for the price. Serviceable for older/lower requirements games. Pretty bulky machine though.

5550 - two complete thermal failures. 7670 has blown up two $400 docks, won't charge half the time, blue screens once a week, weighs a ton, gets hotter than satan's nuts.

Wild! I have not at all had any of those issues, and I've had at this point 9 different Dell machines for work or play in the last ~10 years, all laptops. I'm typing this on a Latitude 5421.

Granted - My work has been heavy on memory but light on CPU, so perhaps I'm not applying enough deadly heat.

Do you live in the arctic circle?

TBF their monitors are good. I have two Dell P2723QE's and they are absolutely great.

Midwest US where it gets both plenty hot and plenty cold.

Tell me about it. Our company was recently acquired and they are swapping out Thinkpad P1's with Dell precision. Protest was no use.

Same. I've got a work Precision 7670 in top spec, literally a £7000(!!!!!) machine, and it overheats within 5 seconds of being under load, the CPU hits 100C and throttles down hard. It's equipped with a 3080Ti but it's the same story - the GPU overheats and throttles down to 200MHz, so anything you play is just a stuttery mess. And it's not surprising - inside it there are 2 heat pipes going to two small fans with only one air outlet. Even my "gaming" MSI laptop with half the spec has much beefier cooling, it can run its 3070Ti under full load indefinitely. Not to mention their £400 thunderbolt docks that work maybe 50% of the time.

Same hardware. Absolute turd. Also the screen on mine is the OLED one which is so reflective I can't see anything on the screen other than my own reflection. Who designed that POS!

I purchase the business version of the ThinkPads and the warranties are fine. In fact, HP, Dell and Lenovo use the same company in my area when they send out technicians to work on them.

The design of T490 was a big "F U, users" from Lenovo.

My magnesium top cased T480 (non-s) with 64 GiB RAM, (4) 72 Whr batteries and the internal one still works and is good enough for the girls I go out with and Windows 11 Enterprise.

Disagree! I've been using Thinkpads since 2004 and was a bit obsessed with them around 2010 and almost had a museum with old machines I bought on eBay. I had two 701cs's butterfly models etc. Every model I've had was much better than the one before in almost every way. There's a lot of nostalgia with the older models, but man, compared to what we have today they were unusable and you would not carry something like that around! Super heavy, easily scratched rubber paint, bad plastic.

Now a lot of things I miss a lot. The modularity, latches, ThinkLight, the upside down Thinkpad logo on the outside shell (oriented correctly towards the user, not the other people in the room), 7 row keyboard, good Fn keys functionality like media keys. The T400 that I regularly stood on to impress people how sturdy it was. But all of these things cost a lot in terms of weight and size (except the logo which was just copying the change that Apple made).

Just so you know the context: these are the machines I used a lot. T42p, R60, T400, T440s, T470s, T495s, T14s Gen2 (current).

If you respect the sturdiness vs. form factor trade-off, I believe build quality has gone up with every machine I bought.

Entry level Thinkpads are not particularly impressive.

I have an E585 (bought it with the 2700U and 1080p screen upgrades, but added my own SSD and extra RAM because Lenovo charged the moon) and it replaced an X230 Tablet.

Even though it's the "upgraded" screen, it's still dim and disappointing. I understand very few Thinkpads have excellent screens; while the X230T's was brighter, it managed to burn the browser chrome after a few years of using it for lap-surfing.

The X230 had a slide-off-the-back-side battery. The E585's is inside the case. You could slide open little hatches to access the storage and memory on the X230. The E585 was a single-piece cover with 8 or 9 captive screws and then has to be pried apart with snaps.

The E585 has a rubber foot to prop it to provide clearance for the vents; the tape holding it on gave out a couple months ago, so I've stuck little white adhesive rubber furniture feet on it.

Entry level ThinkPads aren't really ThinkPads, the E-series in particular. Those ones were previously known as ThinkPad Edge, which were designed by a different team.

Exactly. Buy T, X or P series. For non-demanding users L series might be OK, but I prefer to buy second-hand / refurbished T series instead. Avoid E series, or at least don't expect any "ThinkPad-ness" from it.

TBH, if anyone else brought a remotely competent eraser pointer to market, I'd probably consider them. Even the hyperconfigurable Framework doesn't offer one.

Sometimes you can find a random business-line HP or Dell with one, but the Dell one I tried (some 7th generation Core i5 I rode for five years at work) was so terrible, especially on scrolling, that I just plugged in an external mouse, and it's a feature that appears on random models intermittently when it does appear, so it might not meet any of my other (admittedly limited) requirements.

Would the UEFI malware affect a non-windows OS installed on that machine?

It definitely could if they wanted it to. I'm less worried about that because of the threat of PR blowback that helps keep them in check, but if it's really important to you then you should probably avoid Lenovo. Frame.work is quite a nice option.

No, and that's due to 2 reasons.

1. The malware was a rootkit for Windows

2. Windows has an interesting "feature" that will blindly auto-install software that is embedded in a certain location in the BIOS. If a rootkit is placed there, Windows will always try and install it.

It's bad for Lenovo, but it's also bad that Windows has this anti-feature.

Wow. Could you point us to more technical information about this "feature" of Windows? I'm hoping someone has reverse-engineered it somewhere, but I'm not finding anything with some brief Googling.

No need to reverse engineer it when it's fully documented: https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-...

Thank you!

On the subject of this "feature", I found this handy

https://michlstechblog.info/blog/windows-identify-a-wpbt-bin...

I have a motherboard from Gigabyte that will prompt after the first boot in Windows to install some of their software.

https://arstechnica.com/security/2023/06/millions-of-pc-moth...

With my motherboard you can deny the install at least.

Re: #2 - The UEFI bloatware/rootkit checked the Windows version: if you used Windows 8 or up it used the "feature" called "Windows Platform Binary Table", but Windows 7 didn't have that, so for Windows 7 it overwrote CHKDSK.EXE with a Lenovo loader on every reboot. So, yeah, they were overwriting OS binaries on disk, not just relying on WPBT. (But no reports of binaries being overwritten on on Linux)

I'm surprised they got around windows file protection! That had been around since at least XP so I wonder what they did to avoid it.

The writers of the malicious software lenovo has so far been caught including in their products were specifically targeting windows users, but I see no reason to think that they wouldn't include malicious software that targets linux if some seedy company decided it was worth the effort to write it and offered lenovo enough cash. Their total lack of integrity and respect for their customers is enough that I could never feel fully confident that I was safe just because I was running a non-windows OS.

Windows File Protection seems ineffective against malware signed by a Microsoft vendor.

and/or for malware that can disable WFP.

agreed, i was about to comment "but will these 4 out of 5 devices allow removal of the lenovo crapware?"

Same reason I left Verizon for Fi, avoidance of their bloatware. Couldn't imagine going back to a phone with apps I cannot uninstall (like Amazon & NFL apps, seriously, I don't care about sportsball at all and haven't used Amazon in more than 6 years)

this is just propaganda

that was consumer side Lenovo laptops, IdeaPad and the like 7+ years ago. They learned their lesson and even there don't do it any more.

This didn't affect ThinkPads.

Every time Lenovo is mentioned someone brings this up and I am thoroughly sick of it.

My Lenovo android tablet started installing adware suddenly, more than a year after purchase. This was a clean device with a single program and the adware came with.. Lenovo ads.

Yeah I think it's fair to say Lenovo is still no good here.

Lenovo got fined for $3.5M for installing spyware that hijacks HTTPS connections, so it’s a bit stretch to call it propaganda

https://www.zdnet.com/article/lenovo-receives-3-5m-fine-for-...

When a company engages to such deceptive business and outright illegal business practices, there is little reason to trust them for a decade or two until we can be sure everyone who worked there by the time is gone.

> until we can be sure everyone who worked there by the time is gone.

That seems a little extreme. I always maintain a skeptical eye, but most corporate leaders have an eye for profits and PR, and their personal integrity/moral compass doesn't play a large role in their decision making. As long as it's bad/risky PR for Lenovo to do stuff like that, the incentives are on our side. Always be watching though, and I personally favor vendors who have good track records.

Well... I can look at it from the other perspective; in my previous org, the director came like 15 years ago from Oracle, and his ideas, management style, and goals were very much aligned with what you'd expect Oracle was like 20 years ago. It took firing him and two managers below him to turn around the org, despite adopting new practices, new ideas, working in completely new directions, etc.

I wouldn't completely discard the idea to be honest.

Thanks for sharing, that does make sense. Humans are creatures of habit and the way we are brought up is a strong lean on us in future decision making. Changing philosophies can be very hard

History is not propaganda. Lenovo repeatedly sold out their customers, lied to them, and put them at risk of everything from spying to remote code execution. They've more than earned their reputation and it should haunt them every time they are mentioned.

Maybe after several decades have gone by without incident I might consider that they've changed their ways, but I sure wouldn't count on that happening.

Here's them still not having learned their lesson in Feb of 2021 https://www.theregister.com/2021/09/03/lenovo_indelible_adwa...

Here's them still not having learned their lesson in April of 2022 https://www.zdnet.com/article/lenovo-patches-uefi-vulnerabil...

Today, I wouldn't trust this company to make an alarm clock (https://blog.talosintelligence.com/vulnerability-spotlight-h...) let alone a laptop.

Hey chx, got a response to the details listed here?

Not chx, but note that none of the linked articles mention Thinkpads.

Sure, but nobody but chx even brought up Thinkpads in the first place.

All of these links do though and they include examples of more hard coded passwords, more Lenovo spyware, and more insecure Lenovo software that exposed users to threats:

https://www.theregister.com/2018/01/26/lenovo_thinkpad_finge...

https://www.computerworld.com/article/2984889/lenovo-collect...

https://www.crn.com.au/news/thinkpad-vulnerable-in-latest-le...

https://www.pcworld.com/article/633410/up-to-100-lenovo-lapt...

https://www.itpro.com/security/vulnerability/369491/lenovo-p...

https://github.com/Cr4sh/ThinkPwn

Well that would do it then.

Yeah, this is propaganda as I said.

Now you guys are listing security vulnerabilities when the topic was spyware. Everything has vulnerabilities. They are fixed. So what?

> They learned their lesson and even there don't do it any more.

If I did this, I'd be learning my lesson in prison for 20 years.

How is this propaganda? Either it's true or it is false. You haven't said or proved this is false. "consumer side" still Lenovo. "They learned their lesson" and so have we. "7+ years ago" it still happened The only propaganda is coming from you.