Lenovo: researchers find 'massive security risk'
bbc.co.uk
bbc.co.uk
And I don't know about Lenovo, but I know that on the Dell laptops I last dealt with could never get a stock Windows 7 install to be stable without downloading Dell's drivers for the video card at minimum.
The solution was to download an official Windows 8 copy from Microsoft's website - the Windows installer will get the license key from the EFI.
Not as good as a recovery disk, as you will need to download and install manually all drivers, but vetting everything is part of the point.
EDIT: for those looking, this is the link from where I downloaded the Windows 8 binary from Microsoft website: http://windows.microsoft.com/en-us/windows-8/create-reset-re...
[1] http://arstechnica.com/gadgets/2015/02/save-yourself-from-yo...
http://www.microsoft.com/en-us/software-recovery
You would of course need to grab drivers from the manufacturer as well, but you can skip all of the bloatware (and borderline spy/malware) that comes with a retail machine.
I ended up putting a Microsoft Windows 8.1 iso on a flash drive using rufus. https://rufus.akeo.ie/
I don't understand why Microsoft won't just make the latest build of its operating system publicly accessible in ISO format for anyone to download. I mean I still have to enter a serial number and activate. Why not just let me download from a trusted source without jumping through a bunch of hoops?
With an image from microsoft and an easy to find, spy-ware free, super easy to use executable (I'll avoid mentioning names on here), it was way too easy to pirate windows.
Also, not sure why you still got bloatware with this method. Manufacturers typically offer all of the required drivers individually online. The drivers themselves are bloatware-free but maybe you got roped into installing a software pack for the machine or something?
Then install ThinkVantage System Update http://support.lenovo.com/us/en/documents/ht080136
or
Dell Command Update http://en.community.dell.com/techcenter/enterprise-client/w/...
Be careful of The ThinkVantage System Update, you dont need all the suggested installations.
As far as I know, the power utility is the only thing I installed from Lenovo. The graphics drivers from nVidia came directly through Windows Update.
Should I be concerned? Should I uninstall the power management tools?
How would such a message come about? Do Lenovo pay Microsoft to put in error messages? Did it look for the answer to your problem online?
if you don't put special software on your linux before you boot a live cd, your thinkpad t500 fries itself.
sure it does.
i'm having a hard time imagining a computer booting, without a cpu fan. OS: I'm starting up - so do all these things! as fast as possible!
I am replying to this guy. Never spin up? Overheat? He's completely wrong.
I know full well how it works, I don't have it backwards.
- The CPU fan might be controlled via ACPI.
- The operating system is supposed to run ACPI code provided by the BIOS.
- A BIOS can specify different sets of ACPI code for different operating systems, so Linux might get different code from Windows.
- The ACPI code provided by the BIOS for Linux might be broken, or lacking fan control.
- The hardware vendor may have decided not to provide APCI controls for anything, relying instead on proprietary interfaces.
Section 1.9 of https://www.kernel.org/doc/ols/2005/ols2005v1-pages-59-76.pd... looks like it might be related.
That will usually "restore" the crap as well.
You might be better off installing a Free Software operating system from scratch. (e.g. OpenBSD for the security fanatics, or any other *BSD, or Solaris, or some Linux distro.)
Even better: Buy a laptop without any operating system. However, in some cases this may make the laptop more expensive. (e.g. what if Lenovo gets paid by crap providers for pre-installing?)
For those who don't know how, buy only "Signature Edition" PCs.
http://www.microsoftstore.com/store/msusa/en_US/cat/category...
Depends. Some ship drivers and such on a separate disc, others don't.
Patently absurd, I know, but when you drink enough Kool-Aid...
When all vendors sell products running the same OS, with essentially the same keyboard, screen, processor, etc., their products become commodities and margins disappear; consumers will buy whatever costs least.
If consumers associate a special experience with your product, you might be able to charge a little more or at least have some brand loyalty.
One could also differentiate by focusing on a custom-tailored UI/UX. This is a bit harder to do with Windows than it is with Linux (including Android), though.
I have the same priorities, but how do you know which vendor's hardware is more reliable? All we have is anecdotal experiences. FWIW my experience is that HP's business product lines are most reliable, and Dell's business lines have relatively many quality issues. The HP Elite laptops have exceptional serviceability (better than any I've seen -- find a video and just look at how the laptop case opens for service) and tech support.
> I'm sure I'm not alone (though probably part of a minority of shoppers).
Consumers buy on price, but the priorities of business IT departments are similar to yours: reliability, serviceability, and support; the costs of downtime and skilled labor for repairs far exceed the savings from buying cheap machines. Each vendor sells consumer (e.g., Dell Inspiron), and business (e.g., Dell Latitude) product lines. Maybe try shopping the products they sell to corporate IT; those match your priorites. They cost more, but you get what you pay for.
And the great thing is that Lenovo is keeping all that stuff current to support an ancient-in-internet years piece of hardware. This isn't HP consumer machine crapware...this is the stuff that costs Lenovo money not something they get paid to pre-install.
I hope Win10 brings in more control from MS. The status quo really sucks.
1) This particular malware may be removable by reformatting and installing from a clean copy of Windows (which may not even be available without a separate purchase, since it's likely that the recovery disc that comes with the laptop contains the same default software installation.)
2) Reformatting and reinstalling to remove the malware requires knowing that there's a problem, which you wouldn't have if the articles about it hadn't come out.
Microsoft, Google, Apple, Ubuntu, et al. all make decent OSes that are designed to, um, work. I don't get why manufacturers don't get this simple fact and always have to tamper with stuff. For the less-technical people out there, can't we have a "Nexus" sort of PC manufacturer who prides themselves in selling with ONLY vanilla OSes and as-standard-as-possible hardware components?
It's still only one sort of business strategy. Not every hardware company is necessarily pursuing this line.
I thought the real reason manufacturers do this is because they're in a very low margin industry. For computers they get some deal with software companies to pre-install their product, and similar for cell phones with service providers.
With that said, differentiating by custom UIs on top of the base platform (i.e. the Android approach) would be much better, and would be actually-useful differentiation rather than a matter of "well which company's going to fuck me over the least with their preinstalled shitware?".
This also isn't exactly universally true. HTC was pretty responsive in getting Lollipop out to my One M8, for example, even with its whole "Sense UI" shebang.
Does that not void the warranty?
So I don't think changing a hard drive would void it. But also, I don't usually care about warranties. Things usually break only after the warranty expires, and for any electronic device, as long as it's a common enough model number it's usually possible to get spare parts on eBay when the time comes.
Also, Thinkpads all have a BIOS whitelist that prevents you from actually using the hardware you just easily installed.
When the customer is not a consumer but a company, then things might be different (companies may be able to give away their rights in a way that consumers may not).
In EU countries, a manufacturer may offer a warranty, but this is just supposed to be an extra service; the seller is at least required to provide defect liability (i.e. a device must fixed if broken when it is sold and it must last for a reasonable time in reasonable use).
For example, If your HDD fails under warranty, they'll ship you a new one with the simple instructions to replace it. Only tool needed is a small Philips screwdriver. :-)
It is well known (via Snowden) that the US installs backdoors into US hardware and software for export to China, and it has for at least 15 years warned about the same from imports.
So none of this is particularly new. What is new is that the US is now moving against China on all fronts to prevent it from acquiring superpower status - to isolate it economically and politically, to block its trade and international investment programs, and to increase the risk of its using its military (with the second largest funding of any nation) to project power lawfully in the Asia Pacific.
So these articles come at a good time for the US.
You should not trust pretty much any hardware - recent revelations have shown that products come with backdoors; that is the article does not establish the absence of 'security flaws' by other manufacturers.
I know HN hates the US and thinks China and Russia are bastions of liberty and human rights, but the US's method are a million times more ethical than autocratic states in regards to SIGINT. Heck, Putin had Kaspersky give him information on journalists he didn't like. Meanwhile, my Russian friends on VK are always bugging me about citizenship and H1bs. Yeah, they WANT to come here, pal. They hate it there, they aren't blinded by anti-US, anti-UN, anti-NATO propaganda so popular here. They're gentle geeks in fear of a dictator who could eliminate them at any moment.
If I had the power and wealth I would hire them all and bring them to the states. Every. Single. One.
>China on all fronts to prevent it from acquiring superpower status - to isolate it economically and politically,
We power their economy via our manufacturing and via the sales of our products. If anything they are close economic partners. Are we moving all of our manufacturing to Mexico or something? Seems to me the US is very much tied to the success of China. I can't interpret your statement as anything but incredibly dishonest. Does our national firewall block alibaba now? Oh right, we don't have a national firewall. They do. hell, my own company is tortured by their VPN and censorship limitations. This is a daily headache for me and I'm TRYING TO DO BUSINESS WITH THEM. If anyone is business hostile its them - to us. Hell, they outright block Google services on Android.
> and to increase the risk of its using its military
This is asinine. China is unilaterally taking over disputed islands with zero attempts to use diplomacy, the UN, etc. The Japanese, Korea, and others have claims on those islands. Why are you dismissing their rights? Because they are "evil US" partners as well?
Meanwhile the Chinese prop up the worst state in modernity which has become a mass murder state we have not seen since Stalinist times. I was just in South Korea and its complete madness that a modern democratic state needs to be terrorized by a client Chinese state 24/7 via a madman with nuclear weapons because the CCP likes to "stick it to America." The Koreans we met, drank with, laughed with, etc were no different than me. They bought us gifts and were so gentle, humorous, and loving (especially of children and the elderly) it breaks my heart to think they are one madman's decision away to shell Seoul which would destroy it, and them, in minutes. But I get to fly home to a secure nation because of our strong military and they get to sit there waiting the CCP to tell their pet attack dog to invade or have their pet attack dog go off chain and shell a few things and blow up some nukes to terrorize them. Its depressing. The one man who had a son in the military was so proud of his son's service and showed us many photos, knowing full well, that kid is mincemeat when the North decides it times to roll tanks with Beijing's blessing. The kid looked 16.
> to project power lawfully in the Asia Pacific.
This is pro-China bullshit right here. Lawfully by whose standards? The CCP? Oh okay. Only on a kiddie politics site like HN or reddit would a dishonest and extremely biased anti-US comment like yours be voted to the top. Grow up.
Citation needed.
> > to project power lawfully in the Asia Pacific.
> This is pro-China bullshit right here. Lawfully by whose standards?
International standards. There is nothing wrong with sending your naval forces into international waters so long as proper notifications are made. China is doing this. Is is lawful. It is aggressive. The Japanese and Philippines don't like it. But it is lawful.
> There's a big difference in intercepting packages and installing backdoors in a targeted and legal way, at least acording to SCOTUS who have ZERO problems with our status quo - and massive cyberwar attacks from China and cooked in state mandated malware.
Yes there is. Actually, both the US and China (and France and Israel and Germany and the UK and Russia, etc, etc) perform massive cyberwar attacks. They all also backdoor their hardware and software en masse (not just targeted interception).
> the US's method are a million times more ethical than autocratic states in regards to SIGINT. Heck, Putin had Kaspersky give him information on journalists he didn't like.
I don't think you want an apple to apple comparison with the US... The US just turned their intelligence agencies on the Associated Press to ruin their relationships with informants and to track their sources... The US does have more covert ways of doing things - their censorship and propaganda efforts are more covert and rely more on bribery and deception than force. But is that something we want to cheer on?
The US is much better than Russia on journalistic rights. The US isn't fighting huge swaths of KGB installed media in the US, whereas Russia has to deal with Western NGOs and CIA intermediaries. So what? And why do you want to bring it up?
> We power their economy via our manufacturing and via the sales of our products. If anything they are close economic partners. Are we moving all of our manufacturing to Mexico or something? Seems to me the US is very much tied to the success of China.
We are tied to the success of China. But not its success of becoming a superpower. This is the distinction you are asking for.
> > and to increase the risk of its using its military
> This is asinine. China is unilaterally taking over disputed islands with zero attempts to use diplomacy, the UN, etc. The Japanese and others have claims on those islands. Why are you dismissing their rights? Because they are "evil US" partners as well?
Erg, well the situation is a whole lot more complicated than you made it? Technically nothing they are doing is illegal. I'm not going to say its right?
All I'm getting at is that no state is right. The US isn't a hero. Neither is China.
They are merely in conflict. We are stuck in the middle.
I didn't buy good versus evil. You did. For you the US is good and China is evil.
You are accusing HN (and me) of thinking China is good and the US is evil.
Neither is true. There is no good or evil. There are states in conflict. And there are ideals they both break.
The point of my post is to bring up the point that it is not China breaking with ideals. It is every nation breaking with ideals.
It's true that the Chinese presence in the islands is disputed. US military presence on Japan is disputed. Disputed != Illegality; they should not conflated or confused.
All of the policymakers I follow complain about how difficult the situation is because technically it IS legal. It's unfortunate. But it is legal.
(In addition, they are building new islands from nothing, and then inhabiting them. This is mostly without precident, but the precedents that are there have it legal.)
> This is pro-China bullshit right here. Lawfully by whose standards? The CCP? Oh okay. Only on a kiddie politics site like HN or reddit would a dishonest and extremely biased anti-US comment like yours be voted to the top. Grow up.
If you resort to childish ad hominem attacks, you relinquish your credibility when it comes to telling people to "grow up".
Calling someone childish is an ad hominem. How ironic.
In this day and age, I don't see how any (profit-based) company would provide a clean and trustworthy install.
What level of control should an attacker have ?
The local attacker should have user-level access, but instead has admin/system-level access.
A well organized cyber-crime group or a whole number of spy agencies could have access to at least one such vulnerability throughout the year.
I would venture to guess that the adware service is running as SYSTEM. Any vulnerability in the service would escalate to system. You can do exactly the same thing in Linux (daemon running as root) and it would have a very similar surface area.
The only difference in this specific case is that Windows has idiots for hardware manufacturers. The only way to "fix" it would be for Microsoft to encourage users to wipe the default installation.
Should be : Researchers: Lenovo computers contain 'massive security risk'
This bothers me - a16z podcast also threw up a reference to "200 security hygiene" functions - keeping patches up to date and encryption at rest. But Incan only get to about ten.
Is there an appendix in SysAdmin / oReilly I should read or do I have to watch all the CEF notifications and work backwards to what preventative action Inshould stick in my sh file.
It's a serious question - I just don't feel I know what is dangerous out there anymore let alone have it automated.
It will remove the Lenovo applications, but the 'bloatware' and security risks could exist elsewhere, or example in BIOS or in a separate partition on the hard drive.
If this is considered "Medium" Severity, how bad would it have to be to become High?
Or even worse - it's not inconceivable that some a bit too clever firmware for a ethernet or wifi device could be exploited by a specially crafted IP package that could be sent over the public internet. As such a device usually has DMA access that would be really bad. I don't think even "High" would be sufficient in that case though.