5 ms·
It's probably because Lenovo's suspend feature relies on an unsigned binary blob from China sideloaded during system boot over an unsecure HTTP connection. Why
by rubbingalcohol 8y ago
It's probably because Lenovo's suspend feature relies on an unsigned binary blob from China sideloaded during system boot over an unsecure HTTP connection.
Why anyone still trusts Lenovo enough for this sort of thing to come up as an issue is beyond me.
- organsnyder 8y agoCitation on that? Never heard that before, and I own two ThinkPads (including a four-month-old T480).
- rubbingalcohol 8y agohttps://www.makeuseof.com/tag/security-failings-demonstrate-avoid-lenovo/ https://www.makeuseof.com/tag/security-failings-demonstrate-... Or who could forget Lenovo's surveillance malware that performed man-in-the-middle attacks on SSL traffic? Seriously, these machines should be banned for sale in the U.S. on national security grounds.
- pritambaral 8y agoDell has done similar things in the past, too. Intel has its ME, which is much worse than any of these. AMD has its own ME-equivalent.
- rubbingalcohol 8y agoIntel Management Engine is worse than secretly installing an SSL MitM and sending browsing data to an adware company run by former Israeli spies? Give me a break. Intel ME is worrisome. Lenovo's behavior was actually malicious. There's kind of a difference.
- pritambaral 8y agoLenovo Superfish was incompetently malicious. The ME allows Intel to competently pull off far more nefarious activities than blindly forwarding all browsing data and easily evade detection. Superfish was removable. The ME is far from it. There are alternatives to using Lenovo software or hardware, thus Superfish is even completely avoidable. The ME and its AMD equivalent are not. Both are worrisome. Backdoor-in-hardware is far more worrisome.
- Kliment 8y agoME is removable. Coreboot devs will often remove it for you if you meet them in real life and ask nicely. I've since got a setup for doing that myself so if you are ever around me in real life ask nicely and I'll remove it from your machine
- pritambaral 8y ago> ME is removable. With proper hardware tooling and care, perhaps. (Side question: even for latest gen chips?) For the vast majority of people, ME is not removable. For the AMD users, AMD's ME equivalent is not removable.
- Kliment 8y agoYes, even for latest gen chips. See http://blog.ptsecurity.com/2017/08/disabling-intel-me.html http://blog.ptsecurity.com/2017/08/disabling-intel-me.html for details. me_cleaner supports this method.
- philsnow 8y agothat link says nothing about > Lenovo's suspend feature relies on an unsigned binary blob from China sideloaded during system boot over an unsecure HTTP connection it talks about Lenovo Service Engine, Superfish, Lenovo Solution Center, and Lenovo Customer Feedback. if you blow away the default install of windows, including the UEFI partition, and install (windows or linux or whatever) from scratch, how could any of those things affect you?
- BlackLotus89 8y agoThere is persistable malware that installs itself on your fresh windows [0] I only use old thinkpads like the t420 (my x61 needs fixing) and w520. Coreboot on the t420 and soon on the w520. Dell Laptops for work. [0] https://www.theregister.co.uk/2015/08/12/lenovo_firmware_nasty/ https://www.theregister.co.uk/2015/08/12/lenovo_firmware_nas...
- 1996 8y agoFunny coincidence! I added w520 support to coreboot as a weekend project several years ago! It should still work great on your w520, except there were several power management issues related to the optimus GPU I just couldn't fix. Oh and careful with the RAM if you use 32G as some brands will not work well, because of raminit issue (I haven't followed, maybe they are fixed now)
- rubbingalcohol 8y agoLenovo Service Engine was BIOS-level bloatware loading garbage into clean installs of Windows over HTTP. Lenovo's drivers were so bad that they couldn't get Microsoft WHQL certification, so their BIOS was sideloading them in a very unsecure manner.
- slrz 8y agoNote that this is an official Windows feature and it is the OS that executes the firmware-provided crapware in the first place. It should provide an option to turn it off. Of course, malicious firmware doesn't really depend on the OS's cooperation. It would just be harder to implement and the result a lot more flaky.
- FredFS456 8y agoI'm assuming they're speculating/exaggerating.
- freehunter 8y agoThat's how I read it as well. Kind of rephrasing "I don't know why anyone trusts them after all their high-profile security problems, I wouldn't be surprised if their BIOS was unsigned code loaded over an unsecured HTTP connection."
- deleted 8y ago[deleted]
- gandreani 8y agoI don't know why the OP posted such a terrible link. I found an alternate one: https://www.pcworld.com/article/2969365/security/lenovos-service-engine-marks-yet-another-bloatware-blunder-for-the-company.html https://www.pcworld.com/article/2969365/security/lenovos-ser... It says the Thinkpad lines were never affected by this
- borplk 8y agoThere just aren't enough (better) alternatives in the market.