9 ms·
This is exactly why you should remove any bundled software from vendors and try to start afresh when picking up a new machine.
by albertgoeswoof 7y ago
This is exactly why you should remove any bundled software from vendors and try to start afresh when picking up a new machine.
- NullPrefix 7y agoLenovo pulled a stunt before where they loaded their "extra software" inside UEFI to be installed by Windows after a fresh install.
- josteink 7y agoThat caused so much of a backlash that they released a new BIOS version without that stuff. As was absolutely fair. Abusing Windows' ability to obtain HW-drivers though UEFI (something which can be used for good) to bundle shit-ware is just absolutely rotten.
- twblalock 7y agoMicrosoft should prevent this. It's not in their interest to allow OEMs to circumvent the normal software installation methods for Windows. It should be prohibited in whatever agreement OEMs make with Microsoft, and maybe Windows should prevent execution of such code if it's possible to tell it apart from drivers.
- ru999gol 7y agothat's something Apple would do, but unfortunately Microsoft doesn't give a shit
- ilikehurdles 7y agoI'm inclined to agree. Microsoft's philosophy has been "give vendors all the rope they could think of asking for" for a really long time.
- bahmboo 7y agoPretty sure there was a USG lawsuit about what MSFT could require from OEMs.
- Gene_Parmesan 7y agoI don't think that settlement applies to this. The OEM part of that lawsuit, from my recollection, hinged on the fact that Microsoft's OEM licenses required that the OEM limit the percentage of computers they sold without a Windows OS pre-installed. I don't remember there being anything about how OEMs use their APIs. I think it would be perfectly fair for Microsoft to require OEM licensees to not use that feature for shitware installations. I can't see how that would fall afoul of antitrust or related regulations. Maybe I'm wrong though, that was a while ago and it wasn't my specialty when I practiced law.
- deogeo 7y agoFair would be sending executives to jail for hacking. Releasing a non-backdoored BIOS was the absolute minimum. Edit: As pointed out by josteink, the BIOS wasn't backdoored - it was used to install a backdoor. But calling what it installed "insecure Windows-software" is also inaccurate. According to https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci..., its purpose was man-in-the-middle attacks against the user. So I still think criminal liability and jail time would be just. Ordinary people have been sent to jail for far less.
- stcredzero 7y agoFair would be sending executives to jail for hacking. That would be up to a prosecutor. A civil suit would take the form of a class action.
- josteink 7y agoTo be fair and technically correct, the BIOS itself was not backdoored. The BIOS itself was fine, but it contained insecure Windows-software which it requested/instructed Windows to install. Install any other OS (like Linux) and there would be no backdoor at all. To be clear I’m not trying to defend Lenovo’s actions here, I’m just trying to be clear about what this incident was actually about. The simplistic description is IMO a bit too simplistic in this case.
- walshemj 7y agoOr banning for a period of years the company from any government work as happened to Arthur Anderson in the UK.
- MisterTea 7y agoI wouldn't call that good. More like a bad solution to a problem which shouldn't exist. Nothing should ever be located in system firmware save for the boot firmware and perhaps a basic diagnostic tool like memtest.
- sneak 7y agoThat’s astounding. Suddenly my “zero the entire storage, including partition table” methodology which I always somewhat regarded as overkill appears to be reasonable and/or necessary.
- albertgoeswoof 7y agoYour approach won’t solve that, you’d need to also flash the chip with patched / clean firmware
- cryptonector 7y agoAnd you might not be able to.
- w8rbt 7y agoZero it and install Linux. Problem solved.
- cryptonector 7y agoIt could effectively a ring -2 rootkit, and it could prevent you from removing it.
- Wowfunhappy 7y agoShort of flashing the chip, which is impractical, are there any other "imperfect but probably sufficient" workarounds? For example, would loading Grub first, and then loading Windows from Grub, prevent the issue?
- snazz 7y agoBasically none. You’ve got the ME (or AMD’s equivalent) on the CPU anyway so you really can’t avoid having some kind of root kit. Older Intel hardware that doesn’t have the ME or can be neutered is the best bet, and these machines don’t use UEFI anyway. Otherwise you could go for a non-Intel/AMD architecture, but there aren’t that many of those around anymore.
- mehrdadn 7y ago> Lenovo pulled a stunt before where they loaded their "extra software" inside UEFI to be installed by Windows after a fresh install. Holy cow. Would you have a link on this?
- NullPrefix 7y agoThe tech is called Windows Platform Binary Table, WPBT for short. Here's a random article covering it https://www.howtogeek.com/226308/the-windows-platform-binary-table-why-crapware-can-come-back-after-a-clean-install/ https://www.howtogeek.com/226308/the-windows-platform-binary... You can find others by searching for "lenovo wpbt" or "lenovo unremovable crapware".
- mehrdadn 7y agoThanks!
- shawnz 7y agoI just checked on my Dell workstation at work and it seems they are now using this method to load the Lojack anti theft rootkit. I see the wpbbin.exe file and it's signed by Absolute Software. I guess that is what the feature is designed for, though.
- snazz 7y agoMany computer manufacturers seem to do this at least. There might be a way to trick the UEFI into thinking that you’re installing a non-Windows OS but I’m not sure.
- josteink 7y agoYou got it completely backwards. UEFI doesn't install anything. It provides a machine-specific binary for Windows to install (intended to ensure that Windows has proper drivers for all the machine’s hardware). Windows then decides to install this, based on the assumption that OEMs won’t bundle non-critical shit-ware using this method. Which has turned out to be the faulty assumption here. Either way: Use any other OS except Windows and these UEFI-bundled binaries does nothing. They’re duds. UEFI doesn’t need to be “tricked” and it can’t force the installation of anything into an OS not wanting it. It’s really simple, so no need to invent overly complicated threat models.
- vondur 7y agoLenovo has a program basically identical to this. I wonder if it’s got any of the same problems as the Dell version.
- criddell 7y agoMy last two computers have been Lenovo ThinkPads (T520 and Yoga S1) and they bundle more crappy software than just about any other business computer maker. It's good hardware and once you reformat and reinstall Windows (or Linux) they are great machines.
- Gene_Parmesan 7y agoI'm strongly considering the ThinkPad P1 as my next work machine -- any other issues you've experienced? I wouldn't have expected Lenovo to mess with the ThinkPad brand like that. My image of ThinkPad has always been no-nonsense, get-stuff-done, power-user-favored. Packing in a bunch of cruft doesn't seem to mesh with that image.
- jake_the_third 7y ago> I wouldn't have expected Lenovo to mess with the ThinkPad brand like that. My image of ThinkPad has always been no-nonsense, get-stuff-done, power-user-favored. I used to think the same until I got a T480. I was drawn to it because it was one of the few laptops that still has a direct hardware Function-key row (I use linux, so software Function Keys are not fun). The keyboard, while mechanically excellent, is horribly designed if you depend on it to do your job: They "innovated" by moving the Home/End keys up to the Function row, they "innovated" by completely removing the context menu key from the keyboard and placing the PrintScreen key (of all things) in its place, and they also placed the Fn key at the bottom left corner of the keyboard where Ctrl is usually located (you can fortunately swap Ctrl/Fn with each other in the bios, so the last one isn't a issue if you're willing to live with mislabeled keys). If you're a heavy keyboard user, I strongly suggest properly testing a laptop's keyboard before buying.
- neilv 7y agoThe T520 mentioned above is the last in the T5x0 line before Lenovo started changing the keyboard layout and action in a way that seemed anti-ThinkPad. Same with the move from T420 to T430, so your T480 was a few generations further along an anti-ThinkPad path. Personally, I'm currently standardized&stockpiled on two legacy ThinkPad models, and one of the reasons is keyboards. I also transplant keyboard parts manufactured to T60 specs, into later models, because Lenovo started making the keyboard flex-prone, even as the part was otherwise equivalent.
- tinus_hn 7y agoMicrosoft pulled a stunt before when they made Windows load an executable from inside UEFI during every boot.
- Wowfunhappy 7y agoI chuckled, but come now, that's not the same thing. Apple keeps track of what you type for autocorrect and word prediction. "Apple installs a keylogger on every iPhone."
- tinus_hn 7y agoSure it isn’t the same thing. Microsoft created a system supporting malware that survives OS reinstallation. Lenovo was just using that system as intended.
- m463 7y agooh come on, it uninstalls itself after it has collected enough data. (sarcasm) [i thought it uninstalled itself after a few months]
- tssva 7y agoUnfortunately I have a MacBook and Apple won't even let me uninstall the chess program bundled with macOS.
- Razengan 7y agoIt's barely 5 megabytes.. and it's probably not connecting to anything. The protections for pre-installed apps help to make sure nothing else tampers with them, e.g. injecting some malware, but I'm sure you can remove those protections and reclaim the 5 MB if you really wanted to. https://developer.apple.com/library/archive/documentation/Security/Conceptual/System_Integrity_Protection_Guide/ConfiguringSystemIntegrityProtection/ConfiguringSystemIntegrityProtection.html https://developer.apple.com/library/archive/documentation/Se...
- tssva 7y agoChess was given as an example of the ridiculous situation that not even a game can be removed by default. There are a host of other larger apps I would like to remove such as Home, Maps, News, Books, FaceTime, Messages and Mail. I never use any of them and would prefer they were gone from my computer. Disabling system integrity protection to uninstall them should not be required and I'm guessing wouldn't be a long term solution anyways because likely they would reappear when upgrading macOS versions. There is also the issue of why does chess need greater protection from being tampered with than say Apple Pages.
- gerdesj 7y agoI installed Arch on this Dell laptop without even seeing Windows. I personally would do as you suggest if I wanted Windows on it but then I own an MS "partner". Everyone else has to run the uninstallers and hope that they actually remove everything and not leave things behind.
- tracker1 7y agoIt's been a while... but prior to my current laptop, I'd generally remove the factory HD and replace with an SSD before even booting once. Installing a fresh OS from the start.