13 ms·

Lenovo pulled a stunt before where they loaded their "extra software" inside UEFI to be installed by Windows after a fresh install.

josteink 8y ago
That caused so much of a backlash that they released a new BIOS version without that stuff. As was absolutely fair. Abusing Windows' ability to obtain HW-drivers though UEFI (something which can be used for good) to bundle shit-ware is just absolutely rotten.
- twblalock 8y ago
  Microsoft should prevent this. It's not in their interest to allow OEMs to circumvent the normal software installation methods for Windows. It should be prohibited in whatever agreement OEMs make with Microsoft, and maybe Windows should prevent execution of such code if it's possible to tell it apart from drivers.
  - ru999gol 8y ago
    that's something Apple would do, but unfortunately Microsoft doesn't give a shit
    - ilikehurdles 8y ago
      I'm inclined to agree. Microsoft's philosophy has been "give vendors all the rope they could think of asking for" for a really long time.
  - bahmboo 8y ago
    Pretty sure there was a USG lawsuit about what MSFT could require from OEMs.
    - Gene_Parmesan 8y ago
      I don't think that settlement applies to this. The OEM part of that lawsuit, from my recollection, hinged on the fact that Microsoft's OEM licenses required that the OEM limit the percentage of computers they sold without a Windows OS pre-installed. I don't remember there being anything about how OEMs use their APIs. I think it would be perfectly fair for Microsoft to require OEM licensees to not use that feature for shitware installations. I can't see how that would fall afoul of antitrust or related regulations. Maybe I'm wrong though, that was a while ago and it wasn't my specialty when I practiced law.
- deogeo 8y ago
  Fair would be sending executives to jail for hacking. Releasing a non-backdoored BIOS was the absolute minimum. Edit: As pointed out by josteink, the BIOS wasn't backdoored - it was used to install a backdoor. But calling what it installed "insecure Windows-software" is also inaccurate. According to https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci..., its purpose was man-in-the-middle attacks against the user. So I still think criminal liability and jail time would be just. Ordinary people have been sent to jail for far less.
  - stcredzero 8y ago
    Fair would be sending executives to jail for hacking. That would be up to a prosecutor. A civil suit would take the form of a class action.
  - josteink 8y ago
    To be fair and technically correct, the BIOS itself was not backdoored. The BIOS itself was fine, but it contained insecure Windows-software which it requested/instructed Windows to install. Install any other OS (like Linux) and there would be no backdoor at all. To be clear I’m not trying to defend Lenovo’s actions here, I’m just trying to be clear about what this incident was actually about. The simplistic description is IMO a bit too simplistic in this case.
  - walshemj 8y ago
    Or banning for a period of years the company from any government work as happened to Arthur Anderson in the UK.
- MisterTea 8y ago
  I wouldn't call that good. More like a bad solution to a problem which shouldn't exist. Nothing should ever be located in system firmware save for the boot firmware and perhaps a basic diagnostic tool like memtest.
sneak 8y ago
That’s astounding. Suddenly my “zero the entire storage, including partition table” methodology which I always somewhat regarded as overkill appears to be reasonable and/or necessary.
- albertgoeswoof 8y ago
  Your approach won’t solve that, you’d need to also flash the chip with patched / clean firmware
  - cryptonector 8y ago
    And you might not be able to.
    - w8rbt 8y ago
      Zero it and install Linux. Problem solved.
      - cryptonector 8y ago
        It could effectively a ring -2 rootkit, and it could prevent you from removing it.
  - Wowfunhappy 8y ago
    Short of flashing the chip, which is impractical, are there any other "imperfect but probably sufficient" workarounds? For example, would loading Grub first, and then loading Windows from Grub, prevent the issue?
    - snazz 8y ago
      Basically none. You’ve got the ME (or AMD’s equivalent) on the CPU anyway so you really can’t avoid having some kind of root kit. Older Intel hardware that doesn’t have the ME or can be neutered is the best bet, and these machines don’t use UEFI anyway. Otherwise you could go for a non-Intel/AMD architecture, but there aren’t that many of those around anymore.
mehrdadn 8y ago
> Lenovo pulled a stunt before where they loaded their "extra software" inside UEFI to be installed by Windows after a fresh install. Holy cow. Would you have a link on this?
- NullPrefix 8y ago
  The tech is called Windows Platform Binary Table, WPBT for short. Here's a random article covering it https://www.howtogeek.com/226308/the-windows-platform-binary-table-why-crapware-can-come-back-after-a-clean-install/ https://www.howtogeek.com/226308/the-windows-platform-binary... You can find others by searching for "lenovo wpbt" or "lenovo unremovable crapware".
  - mehrdadn 8y ago
    Thanks!
  - shawnz 8y ago
    I just checked on my Dell workstation at work and it seems they are now using this method to load the Lojack anti theft rootkit. I see the wpbbin.exe file and it's signed by Absolute Software. I guess that is what the feature is designed for, though.
    - snazz 8y ago
      Many computer manufacturers seem to do this at least. There might be a way to trick the UEFI into thinking that you’re installing a non-Windows OS but I’m not sure.
      - josteink 8y ago
        You got it completely backwards. UEFI doesn't install anything. It provides a machine-specific binary for Windows to install (intended to ensure that Windows has proper drivers for all the machine’s hardware). Windows then decides to install this, based on the assumption that OEMs won’t bundle non-critical shit-ware using this method. Which has turned out to be the faulty assumption here. Either way: Use any other OS except Windows and these UEFI-bundled binaries does nothing. They’re duds. UEFI doesn’t need to be “tricked” and it can’t force the installation of anything into an OS not wanting it. It’s really simple, so no need to invent overly complicated threat models.
vondur 8y ago
Lenovo has a program basically identical to this. I wonder if it’s got any of the same problems as the Dell version.
criddell 8y ago
My last two computers have been Lenovo ThinkPads (T520 and Yoga S1) and they bundle more crappy software than just about any other business computer maker. It's good hardware and once you reformat and reinstall Windows (or Linux) they are great machines.
- Gene_Parmesan 8y ago
  I'm strongly considering the ThinkPad P1 as my next work machine -- any other issues you've experienced? I wouldn't have expected Lenovo to mess with the ThinkPad brand like that. My image of ThinkPad has always been no-nonsense, get-stuff-done, power-user-favored. Packing in a bunch of cruft doesn't seem to mesh with that image.
  - jake_the_third 8y ago
    > I wouldn't have expected Lenovo to mess with the ThinkPad brand like that. My image of ThinkPad has always been no-nonsense, get-stuff-done, power-user-favored. I used to think the same until I got a T480. I was drawn to it because it was one of the few laptops that still has a direct hardware Function-key row (I use linux, so software Function Keys are not fun). The keyboard, while mechanically excellent, is horribly designed if you depend on it to do your job: They "innovated" by moving the Home/End keys up to the Function row, they "innovated" by completely removing the context menu key from the keyboard and placing the PrintScreen key (of all things) in its place, and they also placed the Fn key at the bottom left corner of the keyboard where Ctrl is usually located (you can fortunately swap Ctrl/Fn with each other in the bios, so the last one isn't a issue if you're willing to live with mislabeled keys). If you're a heavy keyboard user, I strongly suggest properly testing a laptop's keyboard before buying.
    - neilv 8y ago
      The T520 mentioned above is the last in the T5x0 line before Lenovo started changing the keyboard layout and action in a way that seemed anti-ThinkPad. Same with the move from T420 to T430, so your T480 was a few generations further along an anti-ThinkPad path. Personally, I'm currently standardized&stockpiled on two legacy ThinkPad models, and one of the reasons is keyboards. I also transplant keyboard parts manufactured to T60 specs, into later models, because Lenovo started making the keyboard flex-prone, even as the part was otherwise equivalent.
tinus_hn 8y ago
Microsoft pulled a stunt before when they made Windows load an executable from inside UEFI during every boot.
- Wowfunhappy 8y ago
  I chuckled, but come now, that's not the same thing. Apple keeps track of what you type for autocorrect and word prediction. "Apple installs a keylogger on every iPhone."
  - tinus_hn 8y ago
    Sure it isn’t the same thing. Microsoft created a system supporting malware that survives OS reinstallation. Lenovo was just using that system as intended.
m463 8y ago
oh come on, it uninstalls itself after it has collected enough data. (sarcasm) [i thought it uninstalled itself after a few months]

josteink 8y ago

That caused so much of a backlash that they released a new BIOS version without that stuff. As was absolutely fair. Abusing Windows' ability to obtain HW-drivers though UEFI (something which can be used for good) to bundle shit-ware is just absolutely rotten.

twblalock 8y ago
Microsoft should prevent this. It's not in their interest to allow OEMs to circumvent the normal software installation methods for Windows. It should be prohibited in whatever agreement OEMs make with Microsoft, and maybe Windows should prevent execution of such code if it's possible to tell it apart from drivers.
- ru999gol 8y ago
  that's something Apple would do, but unfortunately Microsoft doesn't give a shit
  - ilikehurdles 8y ago
    I'm inclined to agree. Microsoft's philosophy has been "give vendors all the rope they could think of asking for" for a really long time.
- bahmboo 8y ago
  Pretty sure there was a USG lawsuit about what MSFT could require from OEMs.
  - Gene_Parmesan 8y ago
    I don't think that settlement applies to this. The OEM part of that lawsuit, from my recollection, hinged on the fact that Microsoft's OEM licenses required that the OEM limit the percentage of computers they sold without a Windows OS pre-installed. I don't remember there being anything about how OEMs use their APIs. I think it would be perfectly fair for Microsoft to require OEM licensees to not use that feature for shitware installations. I can't see how that would fall afoul of antitrust or related regulations. Maybe I'm wrong though, that was a while ago and it wasn't my specialty when I practiced law.
deogeo 8y ago
Fair would be sending executives to jail for hacking. Releasing a non-backdoored BIOS was the absolute minimum. Edit: As pointed out by josteink, the BIOS wasn't backdoored - it was used to install a backdoor. But calling what it installed "insecure Windows-software" is also inaccurate. According to https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci..., its purpose was man-in-the-middle attacks against the user. So I still think criminal liability and jail time would be just. Ordinary people have been sent to jail for far less.
- stcredzero 8y ago
  Fair would be sending executives to jail for hacking. That would be up to a prosecutor. A civil suit would take the form of a class action.
- josteink 8y ago
  To be fair and technically correct, the BIOS itself was not backdoored. The BIOS itself was fine, but it contained insecure Windows-software which it requested/instructed Windows to install. Install any other OS (like Linux) and there would be no backdoor at all. To be clear I’m not trying to defend Lenovo’s actions here, I’m just trying to be clear about what this incident was actually about. The simplistic description is IMO a bit too simplistic in this case.
- walshemj 8y ago
  Or banning for a period of years the company from any government work as happened to Arthur Anderson in the UK.
MisterTea 8y ago
I wouldn't call that good. More like a bad solution to a problem which shouldn't exist. Nothing should ever be located in system firmware save for the boot firmware and perhaps a basic diagnostic tool like memtest.

sneak 8y ago

That’s astounding. Suddenly my “zero the entire storage, including partition table” methodology which I always somewhat regarded as overkill appears to be reasonable and/or necessary.

albertgoeswoof 8y ago
Your approach won’t solve that, you’d need to also flash the chip with patched / clean firmware
- cryptonector 8y ago
  And you might not be able to.
  - w8rbt 8y ago
    Zero it and install Linux. Problem solved.
    - cryptonector 8y ago
      It could effectively a ring -2 rootkit, and it could prevent you from removing it.
- Wowfunhappy 8y ago
  Short of flashing the chip, which is impractical, are there any other "imperfect but probably sufficient" workarounds? For example, would loading Grub first, and then loading Windows from Grub, prevent the issue?
  - snazz 8y ago
    Basically none. You’ve got the ME (or AMD’s equivalent) on the CPU anyway so you really can’t avoid having some kind of root kit. Older Intel hardware that doesn’t have the ME or can be neutered is the best bet, and these machines don’t use UEFI anyway. Otherwise you could go for a non-Intel/AMD architecture, but there aren’t that many of those around anymore.

mehrdadn 8y ago

> Lenovo pulled a stunt before where they loaded their "extra software" inside UEFI to be installed by Windows after a fresh install. Holy cow. Would you have a link on this?

NullPrefix 8y ago
The tech is called Windows Platform Binary Table, WPBT for short. Here's a random article covering it https://www.howtogeek.com/226308/the-windows-platform-binary-table-why-crapware-can-come-back-after-a-clean-install/ https://www.howtogeek.com/226308/the-windows-platform-binary... You can find others by searching for "lenovo wpbt" or "lenovo unremovable crapware".
- mehrdadn 8y ago
  Thanks!
- shawnz 8y ago
  I just checked on my Dell workstation at work and it seems they are now using this method to load the Lojack anti theft rootkit. I see the wpbbin.exe file and it's signed by Absolute Software. I guess that is what the feature is designed for, though.
  - snazz 8y ago
    Many computer manufacturers seem to do this at least. There might be a way to trick the UEFI into thinking that you’re installing a non-Windows OS but I’m not sure.
    - josteink 8y ago
      You got it completely backwards. UEFI doesn't install anything. It provides a machine-specific binary for Windows to install (intended to ensure that Windows has proper drivers for all the machine’s hardware). Windows then decides to install this, based on the assumption that OEMs won’t bundle non-critical shit-ware using this method. Which has turned out to be the faulty assumption here. Either way: Use any other OS except Windows and these UEFI-bundled binaries does nothing. They’re duds. UEFI doesn’t need to be “tricked” and it can’t force the installation of anything into an OS not wanting it. It’s really simple, so no need to invent overly complicated threat models.

vondur 8y ago

Lenovo has a program basically identical to this. I wonder if it’s got any of the same problems as the Dell version.

criddell 8y ago

My last two computers have been Lenovo ThinkPads (T520 and Yoga S1) and they bundle more crappy software than just about any other business computer maker. It's good hardware and once you reformat and reinstall Windows (or Linux) they are great machines.

Gene_Parmesan 8y ago
I'm strongly considering the ThinkPad P1 as my next work machine -- any other issues you've experienced? I wouldn't have expected Lenovo to mess with the ThinkPad brand like that. My image of ThinkPad has always been no-nonsense, get-stuff-done, power-user-favored. Packing in a bunch of cruft doesn't seem to mesh with that image.
- jake_the_third 8y ago
  > I wouldn't have expected Lenovo to mess with the ThinkPad brand like that. My image of ThinkPad has always been no-nonsense, get-stuff-done, power-user-favored. I used to think the same until I got a T480. I was drawn to it because it was one of the few laptops that still has a direct hardware Function-key row (I use linux, so software Function Keys are not fun). The keyboard, while mechanically excellent, is horribly designed if you depend on it to do your job: They "innovated" by moving the Home/End keys up to the Function row, they "innovated" by completely removing the context menu key from the keyboard and placing the PrintScreen key (of all things) in its place, and they also placed the Fn key at the bottom left corner of the keyboard where Ctrl is usually located (you can fortunately swap Ctrl/Fn with each other in the bios, so the last one isn't a issue if you're willing to live with mislabeled keys). If you're a heavy keyboard user, I strongly suggest properly testing a laptop's keyboard before buying.
  - neilv 8y ago
    The T520 mentioned above is the last in the T5x0 line before Lenovo started changing the keyboard layout and action in a way that seemed anti-ThinkPad. Same with the move from T420 to T430, so your T480 was a few generations further along an anti-ThinkPad path. Personally, I'm currently standardized&stockpiled on two legacy ThinkPad models, and one of the reasons is keyboards. I also transplant keyboard parts manufactured to T60 specs, into later models, because Lenovo started making the keyboard flex-prone, even as the part was otherwise equivalent.

tinus_hn 8y ago

Microsoft pulled a stunt before when they made Windows load an executable from inside UEFI during every boot.

Wowfunhappy 8y ago
I chuckled, but come now, that's not the same thing. Apple keeps track of what you type for autocorrect and word prediction. "Apple installs a keylogger on every iPhone."
- tinus_hn 8y ago
  Sure it isn’t the same thing. Microsoft created a system supporting malware that survives OS reinstallation. Lenovo was just using that system as intended.

m463 8y ago

oh come on, it uninstalls itself after it has collected enough data. (sarcasm) [i thought it uninstalled itself after a few months]