13 ms·
Yet another pre-installed spyware app discovered on Lenovo computers
- JoeAltmaier 11y agoThese guys have absolutely zero awareness of sensitive privacy issues. The trample on their customers rights, secretly and obviously maliciously, and they do it over and over again! I can think of no reasonable response but to abandon Lenovo products entirely.
- deleted 11y ago[deleted]
- Ao7bei3s 11y agoAnd go where?
- at-fates-hands 11y agoHere's a good start: https://en.wikipedia.org/wiki/List_of_computer_hardware_manufacturers https://en.wikipedia.org/wiki/List_of_computer_hardware_manu...
- Redoubts 11y agoThis isn't a helpful reply to someone looking for products without bundled crapware.
- at-fates-hands 11y agoI guess I thought it was pretty common for people to understand if they don't want bundled crapware, then they shouldn't buy laptops from retailers. Maybe buying direct from another manufacturer on the list in the link I posted or buying a laptop or PC without an OS on it solves 95% of the problem. Maybe I'm just assuming too much here. I guess this confirms my initial point when it comes to hardware, people are not that well informed.
- Redoubts 11y agoThis is also a silly reply, manufacturers bundle crapware themselves all the time.
- at-fates-hands 11y agoRemind me again how a you can buy a laptop without an OS installed and still get bundled crapware?
- dandelion_lover 11y agoI just quote: "Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=ddf3e32512932172454de515091db014#p29497693 http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... " via https://news.ycombinator.com/item?id=10039306 https://news.ycombinator.com/item?id=10039306
- dandelion_lover 11y agoThen maybe this can help: https://www.fsf.org/ryf https://www.fsf.org/ryf
- SpaghettiCat 11y agoLemote: http://www.lemote.com/en/products/Notebook/2010/0310/112.html http://www.lemote.com/en/products/Notebook/2010/0310/112.htm... That Rev. Stallman uses their laptop speaks for Lemote's trustfulness.
- pki 11y agorms uses a Thinkpad X60 with libreboot, iirc the lemote hasn't been his thing for a while now
- deleted 11y ago[deleted]
- nly 11y agoOf course, source aside, if you want a $300 laptop then you'll get the low build-quality, plastic-fantastic piece of spyware-riddled crap you pay for. If you're paying a premium, for a product range where reputation and quality actually matters, you stand a better chance. Unfortunately in the current laptop market, imho, that means paying a minimum of $1000, with low-end Apple prices being preferable. Dells business range isn't so bad. I bought a Latitude in January of last year and, although it had some superfluous fluff bundled with it, it was lean enough that I didn't bother to format and reinstall from scratch (although I dual boot). I previously bought a Lenovo ThinkPad for more and returned it because the depressing build quality (I don't remember much about the bundled software because it simple doesn't factor in to my purchasing decisions). I think the fact that this spyware was found on a refurbed ThinkPad shows just how far the brand has fallen.
- kuschku 11y agoThe 700€ Thinkpads also are free of spyware or any preinstalled such software. So, it is possible.
- scott_karana 11y ago> The 700€ Thinkpads also are free of spyware or any preinstalled such software. So, it is possible. The machine in this article is a Thinkpad.
- mey 11y agoIf you are getting a Windows box, http://signature.microsoft.com/ http://signature.microsoft.com/ is an option. Otherwise business class systems are typically better about pre-installed cruft.
- balakk 11y agoIt's not that straightforward; there are a ton of drivers that Lenovos come with; fingerprint scanners, synaptics touchpad, Sound cards and so on. These are usually bundled in a Lenovo System Update - when it gets installed, it installs a ton of cruft. It's a pity really - I have the latest X1 Carbon; it's a marvellous gadget. Pity the software is so poor.
- mey 11y agoThere honestly isn't a perfect option out there, but for example I've sworn off Lenovo at this point entirely. The unfortunate thing is Google recently sold Motorola to them.
- ehartsuyker 11y agoI live in Germany and recently got a Schenker. I'm running Debian 8 on it, and it works wonderfully. I imagine they do international shipping.
- rihegher 11y agoClevo, fully compatible with the last Ubuntu LTS, shipping worldwide.
- bgibson 11y ago/second. And also custom-assembled at places like http://xoticpc.com/ http://xoticpc.com/
- jamiesonbecker 11y agoUPDATE: I've made a huge mistake. seduced by the matte black dark side. Avoid all modern Intel CPU/chipsets (post 2006) if you value your privacy and security: In summary, the Intel Management Engine and its applications are a backdoor with total access to and control over the rest of the PC. The ME is a threat to freedom, security, and privacy, and the libreboot project strongly recommends avoiding it entirely. Since recent versions of it can't be removed, this means avoiding all recent generations of Intel hardware. http://libreboot.org/faq/#intel http://libreboot.org/faq/#intel Original comment follows: Former Thinkpad fan. I love my new Dell Rugged Extreme. I got the 12. This thing is built the way Thinkpads used to be (complete with the price tag of a used car). The only thing(s) I don't like about it is the missing trackpoint. I really miss that. And the fact that black-box UEFI is built in (but what do we know about modern microcode anyway, might as well get some ostensible security measures for 'free'). Oh, one more: the "QD" connectors do not accept standard straps/slings -- only insanely expensive (and hard to find) Dell brand straps/handles. Everything else about it is outstanding. This thing is a brick with rounded, rubber edges. Drive over it with your truck. (watch the video) Use it as body armor. (no, don't really) Go scuba diving in the arctic. (Check out the frozen-in-an-ice-block video on Youtube.. while running on battery.) The screen is incredibly bright, but it also has a slick quick-kill for all the lights. Just the thing for when a warlord is on your tail. The multi-color LED backlit keyboard looks awesome. It runs Kali Linux (built on Debian Jessie) perfectly. Everything works, including the touch screen and stylus, out of the box.
- JoshTriplett 11y ago> And the fact that black-box UEFI is built in UEFI isn't any more black-box than BIOS in general. Sure, I'd rather run entirely FOSS firmware, but in the absence of that, UEFI doesn't make things any worse. If anything, it allows quite a bit more introspection and extensibility. And its core is FOSS (https://github.com/tianocore/edk2 https://github.com/tianocore/edk2), just not the versions shipped by board/system vendors.
- jamiesonbecker 11y agoUEFI starts with encrypted code and wraps additional layers of encrypted, signed code around it. It's impenetrable, and purposefully so. That's the practical definition of "black box". It's huge, too, with a much larger attack surface. https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface#Criticism https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_In...
- gambiting 11y agoAt the risk of getting downvoted - Apple. Sure, Apple is a huge corporation that sits deep within US government pocket, sure. But at least their software tends to be written by them and them only, their laptops come with a uniform operating system that has no 3rd party malware, for which you don't need external drivers, which has good encryption software built in(again, probably not US-government proof, but good enough for most), and really good permission settings which only allow approved apps to be installed. And then it's a great operating system for developers, programmers, web designers etc. You can say many things about Apple, but at least when you buy their hardware you know exactly what to expect. If you used one of their laptops you've used them all.
- jamiesonbecker 11y agoDownvoting is rude. But, to your point -- Apple hardware, like most modern laptops, are built on Intel chipsets and cryptographically signed to prevent tampering by the owner. You're locked out of your own laptop. If you're concerned about security or even if you just like to hack on the stuff you paid for, it's probably not where you want to be. You have no idea what's going on in there, and it's heavily encrypted at multiple layers to keep you from finding out. See my comment above: you were backdoored before the operating system was even installed. I was too, with my sweet new matte black Dell. (See my comment above). The sad part is that there are very few modern laptops (if any) that we're not steadily being locked out of. It's not just Apple. It's (almost) everyone. and, of course, it's our phones, too. Check out the libreboot and coreboot websites for some modern(ish) gear that isn't backdoored.
- dspillett 11y ago> These guys have absolutely zero awareness of sensitive privacy issues. Just because they don't care, doesn't mean they don't understand. I suspect they are fully aware but money beats morality every time. > I can think of no reasonable response but to abandon Lenovo products entirely. I'm with you there, but I doubt enough people with buying power are concious about the issue for it to make much difference and most of those that are concious of it either will forget soon enough. I've not knowingly bought a product with Sony written on it since the rootkit incident in 2005, and that doesn't seem to have done them much harm!
- jessaustin 11y agoSony are still in business, but they're not killing it like they were in the '80s and '90s. In fact one might see the rootkit thing as just one aspect of the long slow slide they've had for the last 1.5 decades.
- fpgaminer 11y agoThey may not have awareness of sensitive privacy issues, but they certainly have awareness of bad press. Every time a big discovery like this is revealed, Lenovo laptops go on sale. It's both funny and scary.
- AdmiralAsshat 11y agoThis revelation is minor, but nonetheless unsettling. Previous Lenovo snafus up to this point had specifically excluded the Thinkpad line. Apparently they're not immune from Lenovo's meddling after all.
- appleflaxen 11y agoRootkits and spyware are an egregious violation of user trust. One other company with a glaring example was the Sony root kit debacle. Is there a list of companies who have done things like this? Kind of like storing passwords in free text (for which there is a site to name and shame) it doesn't get the press that it probably deserves to.
- natch 11y agoI could give you my list of companies I know of that won't do things like that with their hardware. My list contains one name. For some reason, this company on my list remains a hated company for some geeks. Something about overly restrictive control of the platform, but for me it means having control over my own data, because the platform tries its damnedest to keep bad players from getting inappropriate access. I won't give the list because doing so seems like a cheap shot. But I think everyone knows what company is on it. I'm not saying this is the only such company. It's just the one I know of. Others may have longer lists.
- DenisM 11y agoYeah, Apple is like that. They charge you a pretty penny, but then they don't feel the urge to nickel-and-dime you through backdoors like this. The problem with crapware on Wintel is that Microsoft and Intel consumed all the profit from the industry, commoditizing their compliments - OEMs. OEMs then found themselves in a race to the bottom, which has entirely shaped the field and brought about the behavior we've seen. Android is now facing the same problem on mobile - a race to the bottom among the OEMs is bound to produce all kinds of shady behavior. Apple stayed out of this game entirely, they have thick margins which gives them means to pursue their religion of design, UX, and whatever else they think helps them keep their high-ground spot.
- detaro 11y agoIf it really is only usage reports for Lenovo software, I wouldn't bet on Apple not collecting data like this, but it is hard to compare since they also make the OS and don't add another component on someone else's.
- toothbrush 11y agoSee also this discussion: https://news.ycombinator.com/item?id=10263766 https://news.ycombinator.com/item?id=10263766, which concerns the linked article at Computerworld.
- pfooti 11y agoAha! Here I thought this was an anomaly - normally stuff from BoingBoing is stuff I read on HN the day before. I thought maybe this time it was the other way around - we're discussing a BB article. But no, just a more extended circle.
- dang 11y agoKind of a double loop because we switched the BoingBoing URL to the source it pointed to: https://news.ycombinator.com/item?id=10263971 https://news.ycombinator.com/item?id=10263971.
- toothbrush 11y agoOn an unrelated note (perhaps mere cathartic complaining): i have the really strong impression that "these days" BB is really just another Buzzfeed-like blog-spam platform. I find that a pity, because about 3 years ago i still considered it one of my favourite places to go for a slightly less technical but nevertheless savvy place, that had political leanings i could get behind. I have the impression that there's really a dearth of solid commentary these days, and that it's mostly videos of cats. Videos of cats without further comment at that, which is worse, if possible. I am particularly disappointed because in my perception the decline has been relatively steep and abrupt (whereas i would never mourn Buzzfeed or others in the same way, simply because i never had the impression they had quality ‘content’ in the first place). Anyway, time to move on i guess. Where else do you HN people get news that isn't necessarily focused on startups or programming? I quite like the New Statesman, personally, but i follow it less closely than i used to because of time pressure.
- at-fates-hands 11y agoThis is why I always build my stuff from the ground up. I feel like people have gotten incredibly lazy with their hardware. As pointed out in the article. the author tosses the hard drive and installs his own software when he buys any Lenovo laptop. As long as people don't think about their hardware, this will continue to happen. Either build your own, or don't use vendors like this.
- zorked 11y agoI wish building laptops was easy.
- venomsnake 11y agoReinstalling windows on them sure is.
- Spivak 11y agoThat's not enough if your Lenovo laptop uses LSE. Here's their tool to remove it. http://support.lenovo.com/us/en/downloads/ds104370 http://support.lenovo.com/us/en/downloads/ds104370
- venomsnake 11y agoBy reinstall I mean fdisk, dd if=/dev/zero
- at-fates-hands 11y agoIt's a lot easier than you think. I've done twice and it was a lot easier than I thought it would be. There's two methods - starting from scratch, or buying a barebones system and going from there. I did both with a barebones system, but if you're going from scratch, I'd look at ASUS, CLEVO or SAGR for the parts. Sites like rjtech.com have pretty much all you would need. Guides for barebones approach: http://www.instructables.com/id/Build-your-own-laptop/?ALLSTEPS http://www.instructables.com/id/Build-your-own-laptop/?ALLST... http://www.corsair.com/en-us/blog/2014/april/how_to_build_a_barebones_gaming_notebook http://www.corsair.com/en-us/blog/2014/april/how_to_build_a_... http://www.directron.com/laptopdiy.html http://www.directron.com/laptopdiy.html Ebay listing for Laptop Housing if you're going to start from scratch: http://www.ebay.com/sch/Laptop-Housings-and-TouchPads-For-ASUS/175676/bn_650701/i.html http://www.ebay.com/sch/Laptop-Housings-and-TouchPads-For-AS... Barebones laptop kits: http://www.rkcomputer.net/rkcnotebooks/index.php?l=product_list&c=64 http://www.rkcomputer.net/rkcnotebooks/index.php?l=product_l... Yeah, it's not easy, but if you want to do it, it's totally possible.
- nly 11y agoIn some ways, this is why I'm glad the year of 'Linux on the desktop' never came. The last thing Linux (as an OS or community) needs are a tonne of OEM tweaked 'editions' of various distributions shipping with all kinds of garbage.
- chadgeidel 11y agoIMHO - this is basically what happened to Android.
- api 11y agoIt's the dark side of the freedom to customize. Apple's fascism keeps this stuff mostly off their platform. Windows is comparatively open with OEMs having much more leeway, hence shitware.
- agumonkey 11y agorebuttal from reddit https://www.reddit.com/r/thinkpad/comments/3lz78g/thinkpads_send_usage_data_to_lenovo_using_lenovo/cvav8ie https://www.reddit.com/r/thinkpad/comments/3lz78g/thinkpads_... tl;dr: uploaded data is lenovo program usage only
- detaro 11y ago" The behavior is documented in the End User License Agreement that all users must read and accept prior to using their Lenovo system for the first time. The EULA can also be found in the “c:\windows\system32\oobe\info” folder." Do current machines actually ship with the EULA on paper or require the user to confirm it on first boot? (Not that that makes it a positive thing)
- pdkl95 11y ago> accept prior to using their Lenovo system for the first time Paper or first boot doesn't matter. While there are other necessary features[1], the post purchase ("shrinkwrap") EULA doesn't have a "meeting of the minds"[2] and thus is not a contract. A contract isn't a "gotcha" game - the entire point is that there is to establish a mutual agreement between parties. At the time of sale (when consideration[3] is exchanged), there is no EULA. Nothing has been negotiated and there is no mutual understanding of what is required of each party. In an ongoing attempt to circumvent the first-sale doctrine[4], the software industry has a bad habit of thinking they can throw an offer[5] at someone afterwords and have it count as a contract. They can make all the offers they want, but without another agreement and exchange of consideration[3] it's not a contract. [1] https://www.law.cornell.edu/wex/contract https://www.law.cornell.edu/wex/contract [2] https://en.wikipedia.org/wiki/Meeting_of_the_minds https://en.wikipedia.org/wiki/Meeting_of_the_minds [3] https://en.wikipedia.org/wiki/Consideration https://en.wikipedia.org/wiki/Consideration [4] https://en.wikipedia.org/wiki/First-sale_doctrine https://en.wikipedia.org/wiki/First-sale_doctrine [5] https://www.law.cornell.edu/wex/adhesion_contract_contract_of_adhesion https://www.law.cornell.edu/wex/adhesion_contract_contract_o... disclaimer: see a real lawyer for proper legal advice
- forscha 11y agoLenovo is sure trying hard to drive their customers away... If they insist, all right then, I will buy a Latitude next time.
- deleted 11y ago[deleted]
- jsumuano 11y agoWell, i own a Lenovo Y40-80 and i found it installed on my laptop, what's going on Lenovo?
- voltagex_ 11y agohttps://support.lenovo.com/us/en/documents/ht102023?tabName=Solutions https://support.lenovo.com/us/en/documents/ht102023?tabName=...
- ChuckMcM 11y agoIt makes me wonder if this is the only way to make a profit in the laptop business then perhaps we have bigger problems.
- Balgair 11y agoFudge, I have a lenovo just like the one they are talking about. When superfish came out, I had it and managed to get rid of it with the help of the internet. My question; how do I determine if I have this and how do I then get rid of it?
- jakejake 11y agoThey give the path to the app in the article so you could check for that.
- devopsproject 11y agoits finally happening here. people are just reading the headlines :(
- tkinom 11y agoI have issue with HP PC in my parent's home. Some customer feedback program will run in background non-stop and can't be disable/uninstall. But Standard Windows/Ubuntu linux/Mac OS install all phone home and "check for security upgrade" everyday too.
- Drdrdrq 11y agoUbuntu? Only if you choose to. And there is a difference between calling home / checking for upgrades and calling home / sending user activity data.
- JeremyMorgan 11y agoI love Lenovos, owned countless awesome thinkpads and I was teetering between a thinkpad and a System 76 for my next upgrade. This just seals it for me. https://system76.com/ https://system76.com/ Great hardware for the price, comes with Ubuntu but you could easily put a good Linux system on there (ducks flying objects)
- coldpie 11y agoI'm afraid touchpads are a deal-killer for me. Are there any manufacturers other than Lenovo that do the nub-mouse or something similar?
- Symmetry 11y agoThere are some critical patents that Thinkpads use in their trackpoints that ought to be expiring soon: http://worldwide.espacenet.com/publicationDetails/biblio?CC=US&NR=5570111&KC=&FT=E&locale=en_EP http://worldwide.espacenet.com/publicationDetails/biblio?CC=... http://worldwide.espacenet.com/publicationDetails/biblio?CC=US&NR=5521596&KC=&FT=E&locale=en_EP http://worldwide.espacenet.com/publicationDetails/biblio?CC=... http://worldwide.espacenet.com/publicationDetails/biblio?CC=US&NR=5489900&KC=&FT=E&locale=en_EP http://worldwide.espacenet.com/publicationDetails/biblio?CC=...
- ShinyCyril 11y agoSome Dell business laptops and HP's older EliteBooks have touch pointers - though I seem to remember they're concave instead of convex (perhaps due to patents?).
- ksk 11y agoIs there any difference when Google/Apple/MS do it?
- lukeschlather 11y agoIt sounds like it's sending a list of what applications you have installed and which ones you use. I'm not really in favor of this, but don't iOS, Android, and Windows 10 all do this as a core part of their design? Obviously it enables all sorts of malicious behavior by the companies and governments they are subject to, but Lenovo seems like they're pretty tame by comparison to the OS vendors.
- sigmar 11y agoThe "Lenovo.TVT.CustomerFeedback.Agent.exe" that this article labels as spyware is explained on lenovo's website below. Did the author bother using google? The program reports if you are using lenovo's apps for usage statistics. https://support.lenovo.com/us/en/documents/ht102023?tabName=Solutions https://support.lenovo.com/us/en/documents/ht102023?tabName=... "Some applications in the preload collect usage data that is transmitted to Lenovo. This includes statistics about which features/settings are being used and how often they are being used. The data does not include any personally identifiable information (PII). Lenovo uses this information to improve our applications and focus on the features that are being used the most." Seems reasonable to me.
- x0x0 11y agoNo, burying notification of telemetry systems with unknown privacy impact (and most likely sloppy coding/encryption practices (if any!), as is standard for oems) in a eula that is probably 10+ pages of dense text is the opposite of reasonable. Yet another reason to just buy macs. Apple doesn't do this shit.
- sigmar 11y agoYea, and Apple's app store has no idea what apps you have on your phone. /s
- x0x0 11y agoThe difference is obviousness. If you interact with the app store to buy an app, you clearly know you did so. If you run a spotlight search and it returns results from the internet, spotlight obviously queried the internet somehow. Lenovo monitors what you are doing without in any way telling you, or the user taking any action.
- irl_zebra 11y agoI like iPhones and Macs but Apple certainly does more than just use Spotlight searches to query the internet. They also, for example, record and log your location without telling the user and without the user taking any action. This via cellular network and not GPS, so the user has no say in what is logged. Exactly the type of thing Lenovo does that you imply Apple does not.
- wonkaWonka 11y agoThis only sucks if you run Windows, sure... But the fact that the company thinks this is perfectly acceptable behavior because EULA, EULA, EULA... ...means they're just as likely to target BIOS, UEFI and other firmware that do the same thing, no matter your OS. A breach of trust foments a breach of loyalty, no?
- digi_owl 11y agoOh even paying customers have long been the product. Just look at printed magazines etc, where the number of subscribers is used as part of the advertisement sales pitch. Hell, buy/rent a DVD/BR these days and you will likely find yourself with a face full of (unskippable) ads. Edit: Welcome to the modern metric laden day. Every waking moment will be measured and assessed by algos and "experts" alike.
- deleted 11y ago[deleted]