4 ms·
It's called WPBT. The answer is yes. This "backdoor" is Windows performing exactly as designed. It's a documented feature. Even if a vendor doesn't use WPBT be
by AshamedCaptain 3y ago
It's called WPBT. The answer is yes. This "backdoor" is Windows performing exactly as designed. It's a documented feature.
Even if a vendor doesn't use WPBT because the reputation of WPBT its a bit iffy these days, they'll just create a fake ACPI node that triggers WIndows Update to download a specific driver from the vendor, which is basically the same thing.
MSI uses this second option for the almost identically named option in the BIOS, and it will also download as much "potentially unwanted applications" as Gigabyte's (was that the Windows Defender euphemism for vendor malware again?) .
Like Gigabyte, it's an option which is disabled by default, but tends to "get enabled" a lot. They don't really have to sneak it in -- even power users enable it since they see the motherboard crapware as a benefit (e.g. temperature sensing, color LED strips and related crap)
- dist-epoch 3y agoHow does WPBT interact with SecureBoot? Given it's an official Windows feature, I guess it passes through with no warnings?
- wmf 3y agoSecure boot doesn't apply to apps and that's what this is.
- xmodem 3y agoI've noticed that simply plugging a Logitech USB dongle into a Windows machine with no other interaction is enough to trigger it to download and install Logitech's crapware.
- 0cf8612b2e1e 3y agoThis is so aggravating! Especially on my locked down corporate laptop. Logitech startup process was able to install itself without my approval, but requires admin privileges to uninstall. So, now it’s just there, forever. Hardware industry has an impeccable security record, so I’m sure it is fine.
- actionfromafar 3y agoYes, they would never install for instance a proxy which forwards all traffic to them. cough Lenovo
- hutzlibu 3y agoSorry for cynism, but in my opinion, the main problem is still, that most people understand allmost nothing about computers, except following procedure x to get it roughly do, what they want. And this is usually problematic enough, so they have 0 bandwith for all the shit that is going on underneath. They cannot understand, what is necessary behavior and what is abusive. That would be probably our job, to raise awareness. But it's exhausting and the result is bloat, crap and spyware as default. Understanding users would never consent to this. But the majority simply doesn't and I get pragmatic and find solutions, that work for me. Like WindowsDebloat and Linux. And avoiding touching normal peoples computers, unless with the permission to clean up a bit before using. Not much else one can do.
- codedokode 3y agoYou have given an approval to do anything with your laptop when you chose to install Windows.
- actionfromafar 3y agoTHAT is worse than I knew. Ouch, one really has to think what about what kind of stuff one plugs into even an otherwise rather hardened Windows installation.
- quantaunkindly 3y agoShort regedit hack to disable this "feature": HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer\DisableCoInstallers = 1
- jeroenhd 3y agoThat's Windows Update, not the Windows API that motherboard manufacturers use to inject themselves into the boot process.
- AshamedCaptain 3y agoWhat I'm saying in my post is that this is also exploited by motherboard manufacturers. They just create a fake ACPI device node which tells Windows Update to download the crapware. MSI, for example, does this.
- ComodoHacker 3y agoTo be frank, MSI's "crap" provides battery life optimized charging, while Windows doesn't (and probably can't).
- AshamedCaptain 3y agoOh I don't disagree that it is useful. E.g., If you bought blikenlights, I'm sure you'd like to see them working. But it doesn't excuse the fact that most motherboard software is crap. Don't get me wrong, it doesn't apply only to MSI. HP's update software ("Support Assistant") for example is spyware by any definition.
- Hizonner 3y ago> This "backdoor" is Windows performing exactly as designed. It's a documented feature. You say "documented feature", I say "attractive nuisance". Although firmware always can tamper with the operating system, it's not a good idea. By formalizing a way to do it, thus making it much easier and more reliable, Microsoft encourages motherboard vendors to do it... which is (1) pretty much guaranteed to lead to them at least sometimes doing things like injecting security holes, and (2) pretty much guaranteed to cause problems that even experienced sysadmins have trouble debugging when it goes wrong in whatever way. It also further entrenches Windows, of course...