9 ms·

SteelSeries include adware in driver automatically installed by Windows Update

122 points by supernes 6y ago

matheusmoreira 6y ago
This is USB HID hardware, right? People can use wireshark to capture USB packets and create an equivalent driver for Linux. Assuming there aren't any already. The only reason to use this proprietary malware is to reverse engineer it.
- loa_in_ 6y ago
  There is apexctl repository on GitHub that is a userspace driver for SteelSeries keyboards. Written in Haskell, but binaries are also available.
- supernes 6y ago
  Their hardware, in the case of gaming mice/keyboards at least, runs absolutely fine with generic drivers. The issue here is them pushing an extra "control center" type app through ads that pop up on the desktop without any consent or interaction from the user.
  - vbezhenar 6y ago
    I guess that proprietary drivers are required to configure additional buttons, DPI, etc. Though Logitech mices save configuration inside, so I was able to configure the mice, then reinstall Windows and use generic driver.
  - matheusmoreira 6y ago
    > The issue here is them pushing an extra "control center" type app through ads that pop up on the desktop without any consent or interaction from the user. Yeah, that's exactly what I mean. These fancy input devices usually have LEDs, macros, variable sensitivity and other nifty features that are configured via vendor-specific driver applications. I've never used one that was even remotely good. My Clevo laptop shipped with gamer-style bloatware that would take over a minute just to start up. I managed to reverse engineer it with wireshark and made a command line program that implements most of the features I cared about. The code is pretty short, here is the project in case anyone wants to see how it works or create a custom version for their own hardware: https://github.com/matheusmoreira/ite-829x https://github.com/matheusmoreira/ite-829x It was just a matter of figuring out what data the manufacturer's application sends to the device and making my program do the same thing.
tasubotadas 6y ago
I have SteelSeries headphones and if you don't have SteelSeries engine installed, you are losing quite a bit of functionality. I think it's a grey zone as for most of the cases people are going to be happy to get that software.
- unionpivo 6y ago
  No it's really not. Installing adware on my computer without any input from me is NOT ok. And I have been using headphones(wired) for 5 years without feeling the need to use their sowtware.
- supernes 6y ago
  It does improve the experience of using their hardware, even though mice for example work absolutely fine without it. I had it running for a while, but decided not to use it as it added nothing in my case. The issue is they're pushing unwanted software that displays ads on the desktop through a (possibly bogus) driver update that you can't really refuse without halting Windows Update altogether.
  - martin_bech 6y ago
    I would not say mice work “fine” without engine software. You need engine to set DPI etc, which you want to do, if you want to get the most of it for gaming.
  - dogma1138 6y ago
    There is little to no point of buying their hardware without it, you can’t change settings, create profiles, macros or rebind keys.
    - blibble 6y ago
      on my apex pro I can do all of the above except rebind keys just by using the keyboard
  - srtjstjsj 6y ago
    How is it bogus?
huhtenberg 6y ago
Logitech does this too. Just plug in a mouse - Windows fetches the driver package and, voila, you are a proud owner of LogiLDA.dll that will pester you with random marketing bullshit until forcibly removed from the system.
- unionpivo 6y ago
  hmm i have it on system, but haven seen any adds. Where do they pop up ?
  - huhtenberg 6y ago
    At logon, via HKLM\Software\Microsoft\Windows\CurrentVersion\Run. You can switch it off with SysInternal's Autoruns [1] ... along with all other stuff that Autoruns will dig up. [1] https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns https://docs.microsoft.com/en-us/sysinternals/downloads/auto...
- AshamedCaptain 6y ago
  MS explicitly allows this; to spam you regarding a more featured driver when the one from WU is installed.
  - lifty 6y ago
    MS doesn't have any self respect and any respect for its users. Luckily there is Apple which side with the user in these kind of matters.
    - foepys 6y ago
      Ah, yeah Apple and mice. The operating system where the shoulder buttons of my old but perfectly fine Logitech MX518 don't work and I have to jump through hoops to get them to simply make them take me back in a browser. Truly a masterpiece of engineering. /s Apple's drivers for basic input devices are extremely bad. I couldn't believe it when I was first using a Mac. You need vendor drivers for everything.
r1ch 6y ago
I do wonder how Microsoft verifies 3rd party drivers before pushing them through Windows Update. I've seen some very low quality drivers (and associated bloat of services and background exes) be pushed through, to the point where I disabled driver updates and went back to doing it manually. A supply chain attack here could be devastating.
- AniseAbyss 6y ago
  If its the official driver from the hardware manufacturer they'll "verify" it. I don't really blame MS people just want to plug in and play.
- choeger 6y ago
  Absolutely, that could get very expensive for MS if someone does something really nasty and people start sueing MS for distributing malware. Come to think of it, they are probably also partially liable through the GDPR alone...
- matheusmoreira 6y ago
  Low quality drivers? At least two drivers released by games companies had privilege escalation as a feature: https://securelist.com/elevation-of-privileges-in-namco-driver/83707/ https://securelist.com/elevation-of-privileges-in-namco-driv... https://twitter.com/thewack0lian/status/779397840762245124 https://twitter.com/thewack0lian/status/779397840762245124 https://old.reddit.com/r/Games/comments/545cjy/sfvs_new_pc_update_is_accessing_kernel_level_in/ https://old.reddit.com/r/Games/comments/545cjy/sfvs_new_pc_u... https://github.com/tandasat/ExploitCapcom https://github.com/tandasat/ExploitCapcom I don't think I trust proprietary drivers anymore. Especially if they come from the gaming industry.
serguzest 6y ago
I am experiencing same thing with asus ROG mechanical keyboard. Windows automatically installed crapware along with couple services. Its uninstaller gives error, parts that uninstalled get re-installed again. I hate it.
coldcode 6y ago
Mac is not immune to this type of crap, I tried Corel Painter demo version and the updater it installed put up random windows with ads after a while until I figured it out and removed it.
- indymike 6y ago
  Corel has become so spammy and nickel-and-dimey. I'm probably going to just stop using their design products when my current subscription ends. I'd love it if they'd just focus on having great products instead of selling add-ons that are of little value (no I don't want to buy huge packs of stock art like its 1999 and everything comes on a stack of cd-roms).
- jasonlotito 6y ago
  Apple advertises for stuff as well. I never installed adware, but Apple installs it, and I don't know how to shut if off. Just so people are aware, here is just one example: https://discussions.apple.com/thread/7428677 https://discussions.apple.com/thread/7428677 A fullscreen add after you go into Music, and apparently no way to turn it off permanently. I've had this happen to me this year. I had this happen after I went to play music, and this popped up for me AFTER selecting a song I owned to play. So, if we are going to go after Steelseries for advertising for free software specifically used for the hardware the person owns, let's make sure we call it out wherever it's happening.
Havoc 6y ago
Steelseries, Razer and Nvidia drivers are all a pain in the ass. How hard is it to make a driver that works and has a config page? Instead they make you jump through a million extra hoops to get it to work It’s only a matter of time until we get a DRM mouse that only works when online
- kawsper 6y ago
  Nvidia can't even figure out how to build an application that remembers my login details, every time I open it up I have to login again.
  - Havoc 6y ago
    Yup. And if you have a pihole running the login fails silently. Took me forever to figure out that an ad blocker breaks their driver stuff login...which is all sorta of wtf in itself
    - TheCraiggers 6y ago
      Sadly, this is becoming the new norm. In another decade, that won't even be "wtf" any more. There's just not enough pressure on these giant corporations to change. And with the next generation being indoctrinated to a constant stream of ads, live services, and generally trading privacy for features, I doubt they will care either. Ugh. I think my bad week is spilling into my comments.
  - slantyyz 6y ago
    The bigger question though is why do you need to login in the first place? For the longest time the GeForce Experience application didn't need a login. A lot of users (like me) have that application just to do the automatic driver updates. Why do I need to login to do that?
    - ahelwer 6y ago
      It's to reduce signup friction for their geforce now cloud gaming service. Also probably to target you with ads when they release a card that would be a nice upgrade for your current one. Very annoying, yes.
AnIdiotOnTheNet 6y ago
Not sure where the setting is exposed, but O&O ShutUp10 has a toggle for "Disable automatic downloading of manufacturer's apps and icons for devices" that I suspect would prevent this. I haven't dug into it, but from my own usage I believe this setting ensures that only the driver dlls and not any extraneous software is installed by Windows Update.
- gibspaulding 6y ago
  I'm not sure where I originally saw the recommendation for OOSU10, but it was someone on HN, so whoever you were, thank you! After Firefox, it's the first thing I install on a fresh Windows install, and just applying their recommended actions makes Windows a much more tolerable experience!
  - AnIdiotOnTheNet 6y ago
    Sadly I have to agree. Not using something like OOSU10 is like not running an ad blocker on the web. Not coincidentally I blame a lot of the ways Windows has been ruined lately on the adoption of web development trends.
lemmonii 6y ago
It's really funny to see the redditors defend this.
ziml77 6y ago
What is the adware here? The SteelSeries control center most certainly has never displayed an ad to me.
- boomlinde 6y ago
  See the screenshot in the linked post. The software is advertising Steelseries Engine.
  - srtjstjsj 6y ago
    What is Engine? It looks like a driver for the hardware installed.
    - syntheticcdo 6y ago
      SteelSeries Engine is the fat-drivers for the mouse. This is not an ad to buy new mice, it is an indication that the user paid a lot of money for a mouse and is unable to utilize it's features without the full drivers.
noxer 6y ago
Laughable nonsense and misleading title. The updated driver suggests additional software to use all features of the hardware he plunged in. This usually is because Microsoft does not want to auto install the full version of third party "drivers" so you only get a minimal version of the driver without extensive settings and all that. No one wants windows to download a 300MB Electron app if you plug in a mouse you may only temporary use. But its fair to notify the user about the existence of said app.
- gameswithgo 6y ago
  negative, getting a pop up from an updated driver is bot fair. it is infuriating. i use my computer to do work, pop ups interrupt that. it becomes a growing practical problem as more people believe it is acceptable to this as it happens more often.
  - derefr 6y ago
    > I use my computer to do work Yes, well, not everybody does; and plugging in a gaming mouse is a pretty good signal that you’re one of the people that don’t. (Or that you’re at least a person with multiple computers who doesn’t use that one for work.)
    - SAI_Peregrinus 6y ago
      I've used a Roccat Tyon mouse for work. Gaming mouse, but the macro system & chord button makes automating common actions easy. The extra axis is also great for working in 3D modeling (CAD) programs, though not as good as having a true 3D mouse (but also a lot cheaper).
      - noxer 6y ago
        Great, you are the target of the popup, there is a chance you want the full software made for your specific hardware. If you don't want it ffs click it away and move on.
      - derefr 6y ago
beervirus 6y ago
https://old.reddit.com/r/steelseries/comments/ishp8t/unwanted_steelseries_ads_installed_to_my_computer/ https://old.reddit.com/r/steelseries/comments/ishp8t/unwante... Fixed link to avoid Reddit’s horrible new interface.
gregjw 6y ago
Booooo
jasonlotito 6y ago
Okay, so then technically, Apple does this as well. Apple installs adware of the same type that SteelSeries does.
1_player 6y ago
God the Reddit comments on that post are absolute rubbish. The most upvoted comments are along the lines of "you're using Windows 10, who cares if something else spies on you LUL" which is the dumbest argument I've ever heard, which makes me suspect they might be corporate puppets. Or perhaps we've just been conditioned to ignore any privacy concerns as bullshit and just laugh and shrug whenever yet another company wants to make money off our data.
srtjstjsj 6y ago
Is the issue here that the driver installation program looks so pretty that people can't understand it's a driver installation program, and so they assume it's trying to scam them?

122 points by supernes 6y ago

This is USB HID hardware, right? People can use wireshark to capture USB packets and create an equivalent driver for Linux. Assuming there aren't any already. The only reason to use this proprietary malware is to reverse engineer it.

loa_in_ 6y ago
There is apexctl repository on GitHub that is a userspace driver for SteelSeries keyboards. Written in Haskell, but binaries are also available.
supernes 6y ago
Their hardware, in the case of gaming mice/keyboards at least, runs absolutely fine with generic drivers. The issue here is them pushing an extra "control center" type app through ads that pop up on the desktop without any consent or interaction from the user.
- vbezhenar 6y ago
  I guess that proprietary drivers are required to configure additional buttons, DPI, etc. Though Logitech mices save configuration inside, so I was able to configure the mice, then reinstall Windows and use generic driver.
- matheusmoreira 6y ago
  > The issue here is them pushing an extra "control center" type app through ads that pop up on the desktop without any consent or interaction from the user. Yeah, that's exactly what I mean. These fancy input devices usually have LEDs, macros, variable sensitivity and other nifty features that are configured via vendor-specific driver applications. I've never used one that was even remotely good. My Clevo laptop shipped with gamer-style bloatware that would take over a minute just to start up. I managed to reverse engineer it with wireshark and made a command line program that implements most of the features I cared about. The code is pretty short, here is the project in case anyone wants to see how it works or create a custom version for their own hardware: https://github.com/matheusmoreira/ite-829x https://github.com/matheusmoreira/ite-829x It was just a matter of figuring out what data the manufacturer's application sends to the device and making my program do the same thing.

tasubotadas 6y ago

I have SteelSeries headphones and if you don't have SteelSeries engine installed, you are losing quite a bit of functionality. I think it's a grey zone as for most of the cases people are going to be happy to get that software.

unionpivo 6y ago
No it's really not. Installing adware on my computer without any input from me is NOT ok. And I have been using headphones(wired) for 5 years without feeling the need to use their sowtware.
supernes 6y ago
It does improve the experience of using their hardware, even though mice for example work absolutely fine without it. I had it running for a while, but decided not to use it as it added nothing in my case. The issue is they're pushing unwanted software that displays ads on the desktop through a (possibly bogus) driver update that you can't really refuse without halting Windows Update altogether.
- martin_bech 6y ago
  I would not say mice work “fine” without engine software. You need engine to set DPI etc, which you want to do, if you want to get the most of it for gaming.
- dogma1138 6y ago
  There is little to no point of buying their hardware without it, you can’t change settings, create profiles, macros or rebind keys.
  - blibble 6y ago
    on my apex pro I can do all of the above except rebind keys just by using the keyboard
- srtjstjsj 6y ago
  How is it bogus?

huhtenberg 6y ago

Logitech does this too. Just plug in a mouse - Windows fetches the driver package and, voila, you are a proud owner of LogiLDA.dll that will pester you with random marketing bullshit until forcibly removed from the system.

unionpivo 6y ago
hmm i have it on system, but haven seen any adds. Where do they pop up ?
- huhtenberg 6y ago
  At logon, via HKLM\Software\Microsoft\Windows\CurrentVersion\Run. You can switch it off with SysInternal's Autoruns [1] ... along with all other stuff that Autoruns will dig up. [1] https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns https://docs.microsoft.com/en-us/sysinternals/downloads/auto...
AshamedCaptain 6y ago
MS explicitly allows this; to spam you regarding a more featured driver when the one from WU is installed.
- lifty 6y ago
  MS doesn't have any self respect and any respect for its users. Luckily there is Apple which side with the user in these kind of matters.
  - foepys 6y ago
    Ah, yeah Apple and mice. The operating system where the shoulder buttons of my old but perfectly fine Logitech MX518 don't work and I have to jump through hoops to get them to simply make them take me back in a browser. Truly a masterpiece of engineering. /s Apple's drivers for basic input devices are extremely bad. I couldn't believe it when I was first using a Mac. You need vendor drivers for everything.

r1ch 6y ago

I do wonder how Microsoft verifies 3rd party drivers before pushing them through Windows Update. I've seen some very low quality drivers (and associated bloat of services and background exes) be pushed through, to the point where I disabled driver updates and went back to doing it manually. A supply chain attack here could be devastating.

AniseAbyss 6y ago
If its the official driver from the hardware manufacturer they'll "verify" it. I don't really blame MS people just want to plug in and play.
choeger 6y ago
Absolutely, that could get very expensive for MS if someone does something really nasty and people start sueing MS for distributing malware. Come to think of it, they are probably also partially liable through the GDPR alone...
matheusmoreira 6y ago
Low quality drivers? At least two drivers released by games companies had privilege escalation as a feature: https://securelist.com/elevation-of-privileges-in-namco-driver/83707/ https://securelist.com/elevation-of-privileges-in-namco-driv... https://twitter.com/thewack0lian/status/779397840762245124 https://twitter.com/thewack0lian/status/779397840762245124 https://old.reddit.com/r/Games/comments/545cjy/sfvs_new_pc_update_is_accessing_kernel_level_in/ https://old.reddit.com/r/Games/comments/545cjy/sfvs_new_pc_u... https://github.com/tandasat/ExploitCapcom https://github.com/tandasat/ExploitCapcom I don't think I trust proprietary drivers anymore. Especially if they come from the gaming industry.

serguzest 6y ago

I am experiencing same thing with asus ROG mechanical keyboard. Windows automatically installed crapware along with couple services. Its uninstaller gives error, parts that uninstalled get re-installed again. I hate it.

coldcode 6y ago

Mac is not immune to this type of crap, I tried Corel Painter demo version and the updater it installed put up random windows with ads after a while until I figured it out and removed it.

indymike 6y ago
Corel has become so spammy and nickel-and-dimey. I'm probably going to just stop using their design products when my current subscription ends. I'd love it if they'd just focus on having great products instead of selling add-ons that are of little value (no I don't want to buy huge packs of stock art like its 1999 and everything comes on a stack of cd-roms).
jasonlotito 6y ago
Apple advertises for stuff as well. I never installed adware, but Apple installs it, and I don't know how to shut if off. Just so people are aware, here is just one example: https://discussions.apple.com/thread/7428677 https://discussions.apple.com/thread/7428677 A fullscreen add after you go into Music, and apparently no way to turn it off permanently. I've had this happen to me this year. I had this happen after I went to play music, and this popped up for me AFTER selecting a song I owned to play. So, if we are going to go after Steelseries for advertising for free software specifically used for the hardware the person owns, let's make sure we call it out wherever it's happening.

Havoc 6y ago

Steelseries, Razer and Nvidia drivers are all a pain in the ass. How hard is it to make a driver that works and has a config page? Instead they make you jump through a million extra hoops to get it to work It’s only a matter of time until we get a DRM mouse that only works when online

kawsper 6y ago
Nvidia can't even figure out how to build an application that remembers my login details, every time I open it up I have to login again.
- Havoc 6y ago
  Yup. And if you have a pihole running the login fails silently. Took me forever to figure out that an ad blocker breaks their driver stuff login...which is all sorta of wtf in itself
  - TheCraiggers 6y ago
    Sadly, this is becoming the new norm. In another decade, that won't even be "wtf" any more. There's just not enough pressure on these giant corporations to change. And with the next generation being indoctrinated to a constant stream of ads, live services, and generally trading privacy for features, I doubt they will care either. Ugh. I think my bad week is spilling into my comments.
- slantyyz 6y ago
  The bigger question though is why do you need to login in the first place? For the longest time the GeForce Experience application didn't need a login. A lot of users (like me) have that application just to do the automatic driver updates. Why do I need to login to do that?
  - ahelwer 6y ago
    It's to reduce signup friction for their geforce now cloud gaming service. Also probably to target you with ads when they release a card that would be a nice upgrade for your current one. Very annoying, yes.

AnIdiotOnTheNet 6y ago

Not sure where the setting is exposed, but O&O ShutUp10 has a toggle for "Disable automatic downloading of manufacturer's apps and icons for devices" that I suspect would prevent this. I haven't dug into it, but from my own usage I believe this setting ensures that only the driver dlls and not any extraneous software is installed by Windows Update.

gibspaulding 6y ago
I'm not sure where I originally saw the recommendation for OOSU10, but it was someone on HN, so whoever you were, thank you! After Firefox, it's the first thing I install on a fresh Windows install, and just applying their recommended actions makes Windows a much more tolerable experience!
- AnIdiotOnTheNet 6y ago
  Sadly I have to agree. Not using something like OOSU10 is like not running an ad blocker on the web. Not coincidentally I blame a lot of the ways Windows has been ruined lately on the adoption of web development trends.

lemmonii 6y ago

It's really funny to see the redditors defend this.

ziml77 6y ago

What is the adware here? The SteelSeries control center most certainly has never displayed an ad to me.

boomlinde 6y ago
See the screenshot in the linked post. The software is advertising Steelseries Engine.
- srtjstjsj 6y ago
  What is Engine? It looks like a driver for the hardware installed.
  - syntheticcdo 6y ago
    SteelSeries Engine is the fat-drivers for the mouse. This is not an ad to buy new mice, it is an indication that the user paid a lot of money for a mouse and is unable to utilize it's features without the full drivers.

noxer 6y ago

Laughable nonsense and misleading title. The updated driver suggests additional software to use all features of the hardware he plunged in. This usually is because Microsoft does not want to auto install the full version of third party "drivers" so you only get a minimal version of the driver without extensive settings and all that. No one wants windows to download a 300MB Electron app if you plug in a mouse you may only temporary use. But its fair to notify the user about the existence of said app.

gameswithgo 6y ago
negative, getting a pop up from an updated driver is bot fair. it is infuriating. i use my computer to do work, pop ups interrupt that. it becomes a growing practical problem as more people believe it is acceptable to this as it happens more often.
- derefr 6y ago
  > I use my computer to do work Yes, well, not everybody does; and plugging in a gaming mouse is a pretty good signal that you’re one of the people that don’t. (Or that you’re at least a person with multiple computers who doesn’t use that one for work.)
  - SAI_Peregrinus 6y ago
    I've used a Roccat Tyon mouse for work. Gaming mouse, but the macro system & chord button makes automating common actions easy. The extra axis is also great for working in 3D modeling (CAD) programs, though not as good as having a true 3D mouse (but also a lot cheaper).
    - noxer 6y ago
      Great, you are the target of the popup, there is a chance you want the full software made for your specific hardware. If you don't want it ffs click it away and move on.
    - derefr 6y ago

beervirus 6y ago

https://old.reddit.com/r/steelseries/comments/ishp8t/unwanted_steelseries_ads_installed_to_my_computer/ https://old.reddit.com/r/steelseries/comments/ishp8t/unwante... Fixed link to avoid Reddit’s horrible new interface.

gregjw 6y ago

Booooo

jasonlotito 6y ago

Okay, so then technically, Apple does this as well. Apple installs adware of the same type that SteelSeries does.

1_player 6y ago

God the Reddit comments on that post are absolute rubbish. The most upvoted comments are along the lines of "you're using Windows 10, who cares if something else spies on you LUL" which is the dumbest argument I've ever heard, which makes me suspect they might be corporate puppets. Or perhaps we've just been conditioned to ignore any privacy concerns as bullshit and just laugh and shrug whenever yet another company wants to make money off our data.

srtjstjsj 6y ago

Is the issue here that the driver installation program looks so pretty that people can't understand it's a driver installation program, and so they assume it's trying to scam them?