6 ms·

Friendly reminder that Lenovo has repeatedly shipped laptops infested with malware and backdoors (https://en.wikipedia.org/wiki/Lenovo#Security_and_privacy_inci

Friendly reminder that Lenovo has repeatedly shipped laptops infested with malware and backdoors (https://en.wikipedia.org/wiki/Lenovo#Security_and_privacy_incidents https://en.wikipedia.org/wiki/Lenovo#Security_and_privacy_in...) sometimes doing so in exchange for money. They've also hidden malware in UEFI so that even reformatting your hard drive wouldn't help. In one case, after they were found out they first claimed "we have thoroughly investigated this technology and do not find any evidence to substantiate security concerns" and only after it started being reported by more and more news orgs did they finally admit to what they'd done and release instructions on how to fix it. Sadly, those instructions removed the bloatware, but left the vulnerability it introduced in place giving users a false sense of security, and only after they were caught out for that in the press did they finally release a "removal tool" The wikipedia page doesn't even list all their offenses or the most recent events. See also : https://www.zdnet.com/article/lenovo-patches-uefi-vulnerabilities-impacting-millions-of-device-users-worldwide/ https://www.zdnet.com/article/lenovo-patches-uefi-vulnerabil... Repairable or not, use Lenovo at your own risk.

chx 3y ago
this is just propaganda that was consumer side Lenovo laptops, IdeaPad and the like 7+ years ago. They learned their lesson and even there don't do it any more. This didn't affect ThinkPads. Every time Lenovo is mentioned someone brings this up and I am thoroughly sick of it.
- vorpalhex 3y ago
  My Lenovo android tablet started installing adware suddenly, more than a year after purchase. This was a clean device with a single program and the adware came with.. Lenovo ads. Yeah I think it's fair to say Lenovo is still no good here.
- miohtama 3y ago
  Lenovo got fined for $3.5M for installing spyware that hijacks HTTPS connections, so it’s a bit stretch to call it propaganda https://www.zdnet.com/article/lenovo-receives-3-5m-fine-for-pre-installing-adware-that-hijacks-https-connections/ https://www.zdnet.com/article/lenovo-receives-3-5m-fine-for-... When a company engages to such deceptive business and outright illegal business practices, there is little reason to trust them for a decade or two until we can be sure everyone who worked there by the time is gone.
  - freedomben 3y ago
    > until we can be sure everyone who worked there by the time is gone. That seems a little extreme. I always maintain a skeptical eye, but most corporate leaders have an eye for profits and PR, and their personal integrity/moral compass doesn't play a large role in their decision making. As long as it's bad/risky PR for Lenovo to do stuff like that, the incentives are on our side. Always be watching though, and I personally favor vendors who have good track records.
    - BossingAround 3y ago
      Well... I can look at it from the other perspective; in my previous org, the director came like 15 years ago from Oracle, and his ideas, management style, and goals were very much aligned with what you'd expect Oracle was like 20 years ago. It took firing him and two managers below him to turn around the org, despite adopting new practices, new ideas, working in completely new directions, etc. I wouldn't completely discard the idea to be honest.
      - freedomben 3y ago
        Thanks for sharing, that does make sense. Humans are creatures of habit and the way we are brought up is a strong lean on us in future decision making. Changing philosophies can be very hard
- autoexec 3y ago
  History is not propaganda. Lenovo repeatedly sold out their customers, lied to them, and put them at risk of everything from spying to remote code execution. They've more than earned their reputation and it should haunt them every time they are mentioned. Maybe after several decades have gone by without incident I might consider that they've changed their ways, but I sure wouldn't count on that happening. Here's them still not having learned their lesson in Feb of 2021 https://www.theregister.com/2021/09/03/lenovo_indelible_adware/ https://www.theregister.com/2021/09/03/lenovo_indelible_adwa... Here's them still not having learned their lesson in April of 2022 https://www.zdnet.com/article/lenovo-patches-uefi-vulnerabilities-impacting-millions-of-device-users-worldwide/ https://www.zdnet.com/article/lenovo-patches-uefi-vulnerabil... Today, I wouldn't trust this company to make an alarm clock (https://blog.talosintelligence.com/vulnerability-spotlight-hard-coded-password-vulnerability-could-allow-attacker-to-completely-take-over-lenovo-smart-clock/ https://blog.talosintelligence.com/vulnerability-spotlight-h...) let alone a laptop.
- rnk 3y ago
  Hey chx, got a response to the details listed here?
  - unethical_ban 3y ago
    Not chx, but note that none of the linked articles mention Thinkpads.
    - hfsh 3y ago
      Sure, but nobody but chx even brought up Thinkpads in the first place.
    - autoexec 3y ago
      All of these links do though and they include examples of more hard coded passwords, more Lenovo spyware, and more insecure Lenovo software that exposed users to threats: https://www.theregister.com/2018/01/26/lenovo_thinkpad_fingerprint_manager_vulnerability/ https://www.theregister.com/2018/01/26/lenovo_thinkpad_finge... https://www.computerworld.com/article/2984889/lenovo-collects-usage-data-on-thinkpad-thinkcentre-and-thinkstation-pcs.html https://www.computerworld.com/article/2984889/lenovo-collect... https://www.crn.com.au/news/thinkpad-vulnerable-in-latest-lenovo-scare-403646 https://www.crn.com.au/news/thinkpad-vulnerable-in-latest-le... https://www.pcworld.com/article/633410/up-to-100-lenovo-laptops-are-a-security-risk.html https://www.pcworld.com/article/633410/up-to-100-lenovo-lapt... https://www.itpro.com/security/vulnerability/369491/lenovo-patches-thinkpad-yoga-ideapad-uefi-secure-boot-vulnerability https://www.itpro.com/security/vulnerability/369491/lenovo-p... https://github.com/Cr4sh/ThinkPwn https://github.com/Cr4sh/ThinkPwn
      - unethical_ban 3y ago
        Well that would do it then.
      - chx 3y ago
        Yeah, this is propaganda as I said. Now you guys are listing security vulnerabilities when the topic was spyware. Everything has vulnerabilities. They are fixed. So what?
- ClumsyPilot 3y ago
  > They learned their lesson and even there don't do it any more. If I did this, I'd be learning my lesson in prison for 20 years.
- demandingturtle 3y ago
  How is this propaganda? Either it's true or it is false. You haven't said or proved this is false. "consumer side" still Lenovo. "They learned their lesson" and so have we. "7+ years ago" it still happened The only propaganda is coming from you.
isoprophlex 3y ago
agreed, i was about to comment "but will these 4 out of 5 devices allow removal of the lenovo crapware?"
- verdverm 3y ago
  Same reason I left Verizon for Fi, avoidance of their bloatware. Couldn't imagine going back to a phone with apps I cannot uninstall (like Amazon & NFL apps, seriously, I don't care about sportsball at all and haven't used Amazon in more than 6 years)
imglorp 3y ago
Would the UEFI malware affect a non-windows OS installed on that machine?
- freedomben 3y ago
  It definitely could if they wanted it to. I'm less worried about that because of the threat of PR blowback that helps keep them in check, but if it's really important to you then you should probably avoid Lenovo. Frame.work is quite a nice option.
- happymellon 3y ago
  No, and that's due to 2 reasons. 1. The malware was a rootkit for Windows 2. Windows has an interesting "feature" that will blindly auto-install software that is embedded in a certain location in the BIOS. If a rootkit is placed there, Windows will always try and install it. It's bad for Lenovo, but it's also bad that Windows has this anti-feature.
  - valleyer 3y ago
    Wow. Could you point us to more technical information about this "feature" of Windows? I'm hoping someone has reverse-engineered it somewhere, but I'm not finding anything with some brief Googling.
    - lights0123 3y ago
      No need to reverse engineer it when it's fully documented: https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-4e2d-a559-4a27cf905a80/windows-platform-binary-table.docx https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-...
      - valleyer 3y ago
        Thank you!
        3y ago
deleted 3y ago
[deleted]
infogulch 3y ago
To add a reference, here's a reproduction of my comment on a discussion of Lenovo from 4 years ago [1]: I want to emphasize how bad the TLS MITM malware was (adware is too nice a term): they installed a TLS MITM attack by adding the same CA public key to the trust store of every non-business device they sold, and then proxied all internet traffic through an on-device MITM proxy that contained the private key to that CA. Yes you read that right: every device with this malware had the public and private key used to decrypt the TLS traffic of every other device with this malware, effectively exposing every user to have all of their traffic both decrypted and MITM'd again by anyone who tries. This train wreck was malicious and incompetent. I don't consider this a technical failure, this is a fatal business failure: either nobody in Lenovo reviewed this software integration from a privacy and security perspective, or they did review it and the business deal overruled the security team's ability to veto it, or they're so inept that they didn't notice how bad it was. In any case, this indicates an organizational dysfunction so severe there's no way I can trust Lenovo with my personal or business security again. [1]: https://news.ycombinator.com/item?id=22194428 https://news.ycombinator.com/item?id=22194428 | Lenovo now shipping Ubuntu on high end workstations in the US
JTbane 3y ago
Also the build quality of Lenovo laptops have gone down so much it's appalling.
- baz00 3y ago
  Yeah this. Keyboard is shite on the new T14 gen 3. Horrible to use.
  - sbuk 3y ago
    I swear the trackpad on my work-issued one takes 5 minutes to warm up before it is useable. It is quite possibly the worst laptop I've ever owned, and I've had a Vostro and a 2018 Macbook with the dodgy keyboards.
- bityard 3y ago
  I used to be a Thinkpad fanatic due to nice build quality and good Linux support. But in the past few years, I have taken to just buying Dell's midrange business laptops. The build quality can vary by model but they are cheaper, ubiquitous, have great support while in warranty, and Linux always runs just fine on them if you pay attention to the hardware you're buying.
  - baz00 3y ago
    Oh man fuck Dell. I get through one every 9 months at work. Absolutely the worst laptops I've ever used. Precision series.
    - RajT88 3y ago
      What model? I've been pretty happy with Dell machines at work. Happy enough I bought an older model refurb for 200 dollars shipped, which fits the chargers and docks and such I had lying around from work. Model: Precision 7520 Cpu: i7-6820HQ Memory: 32gb Gpu: Nvidia Quadro M2200 4GB Storage: 500gb SSD Display: 15" 1080p Pretty good specs for the price. Serviceable for older/lower requirements games. Pretty bulky machine though.
sacnoradhq 3y ago
That's unnecessarily alarmist FUD from a decade ago that has nothing to do with today. Windows 11 installed clean with support drivers has only minimal Lenovo items: - Lenovo EasyResume Service - enables a grace period before hibernation - Lenovo HotKey Client Loader - makes the special keys work - Lenovo Intelligent Thermal Solution Service - fans go brrrrr - Lenovo Platform Service - (not running) - Lenovo PM Server - power management coordinator The only other thing is their user-attended updater, Lenovo Update Service, that doesn't run in the background and doesn't do anything uncommanded. It finds driver, BIOS, and firmware updates. It's optional and you have to install it yourself.

chx 3y ago

this is just propaganda that was consumer side Lenovo laptops, IdeaPad and the like 7+ years ago. They learned their lesson and even there don't do it any more. This didn't affect ThinkPads. Every time Lenovo is mentioned someone brings this up and I am thoroughly sick of it.

vorpalhex 3y ago
My Lenovo android tablet started installing adware suddenly, more than a year after purchase. This was a clean device with a single program and the adware came with.. Lenovo ads. Yeah I think it's fair to say Lenovo is still no good here.
miohtama 3y ago
Lenovo got fined for $3.5M for installing spyware that hijacks HTTPS connections, so it’s a bit stretch to call it propaganda https://www.zdnet.com/article/lenovo-receives-3-5m-fine-for-pre-installing-adware-that-hijacks-https-connections/ https://www.zdnet.com/article/lenovo-receives-3-5m-fine-for-... When a company engages to such deceptive business and outright illegal business practices, there is little reason to trust them for a decade or two until we can be sure everyone who worked there by the time is gone.
- freedomben 3y ago
  > until we can be sure everyone who worked there by the time is gone. That seems a little extreme. I always maintain a skeptical eye, but most corporate leaders have an eye for profits and PR, and their personal integrity/moral compass doesn't play a large role in their decision making. As long as it's bad/risky PR for Lenovo to do stuff like that, the incentives are on our side. Always be watching though, and I personally favor vendors who have good track records.
  - BossingAround 3y ago
    Well... I can look at it from the other perspective; in my previous org, the director came like 15 years ago from Oracle, and his ideas, management style, and goals were very much aligned with what you'd expect Oracle was like 20 years ago. It took firing him and two managers below him to turn around the org, despite adopting new practices, new ideas, working in completely new directions, etc. I wouldn't completely discard the idea to be honest.
    - freedomben 3y ago
      Thanks for sharing, that does make sense. Humans are creatures of habit and the way we are brought up is a strong lean on us in future decision making. Changing philosophies can be very hard
autoexec 3y ago
History is not propaganda. Lenovo repeatedly sold out their customers, lied to them, and put them at risk of everything from spying to remote code execution. They've more than earned their reputation and it should haunt them every time they are mentioned. Maybe after several decades have gone by without incident I might consider that they've changed their ways, but I sure wouldn't count on that happening. Here's them still not having learned their lesson in Feb of 2021 https://www.theregister.com/2021/09/03/lenovo_indelible_adware/ https://www.theregister.com/2021/09/03/lenovo_indelible_adwa... Here's them still not having learned their lesson in April of 2022 https://www.zdnet.com/article/lenovo-patches-uefi-vulnerabilities-impacting-millions-of-device-users-worldwide/ https://www.zdnet.com/article/lenovo-patches-uefi-vulnerabil... Today, I wouldn't trust this company to make an alarm clock (https://blog.talosintelligence.com/vulnerability-spotlight-hard-coded-password-vulnerability-could-allow-attacker-to-completely-take-over-lenovo-smart-clock/ https://blog.talosintelligence.com/vulnerability-spotlight-h...) let alone a laptop.
rnk 3y ago
Hey chx, got a response to the details listed here?
- unethical_ban 3y ago
  Not chx, but note that none of the linked articles mention Thinkpads.
  - hfsh 3y ago
    Sure, but nobody but chx even brought up Thinkpads in the first place.
  - autoexec 3y ago
    All of these links do though and they include examples of more hard coded passwords, more Lenovo spyware, and more insecure Lenovo software that exposed users to threats: https://www.theregister.com/2018/01/26/lenovo_thinkpad_fingerprint_manager_vulnerability/ https://www.theregister.com/2018/01/26/lenovo_thinkpad_finge... https://www.computerworld.com/article/2984889/lenovo-collects-usage-data-on-thinkpad-thinkcentre-and-thinkstation-pcs.html https://www.computerworld.com/article/2984889/lenovo-collect... https://www.crn.com.au/news/thinkpad-vulnerable-in-latest-lenovo-scare-403646 https://www.crn.com.au/news/thinkpad-vulnerable-in-latest-le... https://www.pcworld.com/article/633410/up-to-100-lenovo-laptops-are-a-security-risk.html https://www.pcworld.com/article/633410/up-to-100-lenovo-lapt... https://www.itpro.com/security/vulnerability/369491/lenovo-patches-thinkpad-yoga-ideapad-uefi-secure-boot-vulnerability https://www.itpro.com/security/vulnerability/369491/lenovo-p... https://github.com/Cr4sh/ThinkPwn https://github.com/Cr4sh/ThinkPwn
    - unethical_ban 3y ago
      Well that would do it then.
    - chx 3y ago
      Yeah, this is propaganda as I said. Now you guys are listing security vulnerabilities when the topic was spyware. Everything has vulnerabilities. They are fixed. So what?
ClumsyPilot 3y ago
> They learned their lesson and even there don't do it any more. If I did this, I'd be learning my lesson in prison for 20 years.
demandingturtle 3y ago
How is this propaganda? Either it's true or it is false. You haven't said or proved this is false. "consumer side" still Lenovo. "They learned their lesson" and so have we. "7+ years ago" it still happened The only propaganda is coming from you.

isoprophlex 3y ago

agreed, i was about to comment "but will these 4 out of 5 devices allow removal of the lenovo crapware?"

verdverm 3y ago
Same reason I left Verizon for Fi, avoidance of their bloatware. Couldn't imagine going back to a phone with apps I cannot uninstall (like Amazon & NFL apps, seriously, I don't care about sportsball at all and haven't used Amazon in more than 6 years)

imglorp 3y ago

Would the UEFI malware affect a non-windows OS installed on that machine?

freedomben 3y ago
It definitely could if they wanted it to. I'm less worried about that because of the threat of PR blowback that helps keep them in check, but if it's really important to you then you should probably avoid Lenovo. Frame.work is quite a nice option.
happymellon 3y ago
No, and that's due to 2 reasons. 1. The malware was a rootkit for Windows 2. Windows has an interesting "feature" that will blindly auto-install software that is embedded in a certain location in the BIOS. If a rootkit is placed there, Windows will always try and install it. It's bad for Lenovo, but it's also bad that Windows has this anti-feature.
- valleyer 3y ago
  Wow. Could you point us to more technical information about this "feature" of Windows? I'm hoping someone has reverse-engineered it somewhere, but I'm not finding anything with some brief Googling.
  - lights0123 3y ago
    No need to reverse engineer it when it's fully documented: https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-4e2d-a559-4a27cf905a80/windows-platform-binary-table.docx https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-...
    - valleyer 3y ago
      Thank you!
      - 3y ago

deleted 3y ago

[deleted]

infogulch 3y ago

To add a reference, here's a reproduction of my comment on a discussion of Lenovo from 4 years ago [1]: I want to emphasize how bad the TLS MITM malware was (adware is too nice a term): they installed a TLS MITM attack by adding the same CA public key to the trust store of every non-business device they sold, and then proxied all internet traffic through an on-device MITM proxy that contained the private key to that CA. Yes you read that right: every device with this malware had the public and private key used to decrypt the TLS traffic of every other device with this malware, effectively exposing every user to have all of their traffic both decrypted and MITM'd again by anyone who tries. This train wreck was malicious and incompetent. I don't consider this a technical failure, this is a fatal business failure: either nobody in Lenovo reviewed this software integration from a privacy and security perspective, or they did review it and the business deal overruled the security team's ability to veto it, or they're so inept that they didn't notice how bad it was. In any case, this indicates an organizational dysfunction so severe there's no way I can trust Lenovo with my personal or business security again. [1]: https://news.ycombinator.com/item?id=22194428 https://news.ycombinator.com/item?id=22194428 | Lenovo now shipping Ubuntu on high end workstations in the US

JTbane 3y ago

Also the build quality of Lenovo laptops have gone down so much it's appalling.

baz00 3y ago
Yeah this. Keyboard is shite on the new T14 gen 3. Horrible to use.
- sbuk 3y ago
  I swear the trackpad on my work-issued one takes 5 minutes to warm up before it is useable. It is quite possibly the worst laptop I've ever owned, and I've had a Vostro and a 2018 Macbook with the dodgy keyboards.
bityard 3y ago
I used to be a Thinkpad fanatic due to nice build quality and good Linux support. But in the past few years, I have taken to just buying Dell's midrange business laptops. The build quality can vary by model but they are cheaper, ubiquitous, have great support while in warranty, and Linux always runs just fine on them if you pay attention to the hardware you're buying.
- baz00 3y ago
  Oh man fuck Dell. I get through one every 9 months at work. Absolutely the worst laptops I've ever used. Precision series.
  - RajT88 3y ago
    What model? I've been pretty happy with Dell machines at work. Happy enough I bought an older model refurb for 200 dollars shipped, which fits the chargers and docks and such I had lying around from work. Model: Precision 7520 Cpu: i7-6820HQ Memory: 32gb Gpu: Nvidia Quadro M2200 4GB Storage: 500gb SSD Display: 15" 1080p Pretty good specs for the price. Serviceable for older/lower requirements games. Pretty bulky machine though.

sacnoradhq 3y ago

That's unnecessarily alarmist FUD from a decade ago that has nothing to do with today. Windows 11 installed clean with support drivers has only minimal Lenovo items: - Lenovo EasyResume Service - enables a grace period before hibernation - Lenovo HotKey Client Loader - makes the special keys work - Lenovo Intelligent Thermal Solution Service - fans go brrrrr - Lenovo Platform Service - (not running) - Lenovo PM Server - power management coordinator The only other thing is their user-attended updater, Lenovo Update Service, that doesn't run in the background and doesn't do anything uncommanded. It finds driver, BIOS, and firmware updates. It's optional and you have to install it yourself.