3 ms·

Would the UEFI malware affect a non-windows OS installed on that machine?

freedomben 3y ago
It definitely could if they wanted it to. I'm less worried about that because of the threat of PR blowback that helps keep them in check, but if it's really important to you then you should probably avoid Lenovo. Frame.work is quite a nice option.
happymellon 3y ago
No, and that's due to 2 reasons. 1. The malware was a rootkit for Windows 2. Windows has an interesting "feature" that will blindly auto-install software that is embedded in a certain location in the BIOS. If a rootkit is placed there, Windows will always try and install it. It's bad for Lenovo, but it's also bad that Windows has this anti-feature.
- valleyer 3y ago
  Wow. Could you point us to more technical information about this "feature" of Windows? I'm hoping someone has reverse-engineered it somewhere, but I'm not finding anything with some brief Googling.
  - lights0123 3y ago
    No need to reverse engineer it when it's fully documented: https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-4e2d-a559-4a27cf905a80/windows-platform-binary-table.docx https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-...
    - valleyer 3y ago
      Thank you!
      - autoexec 3y ago
        On the subject of this "feature", I found this handy https://michlstechblog.info/blog/windows-identify-a-wpbt-binary-in-biosuefi/ https://michlstechblog.info/blog/windows-identify-a-wpbt-bin...
  - vondur 3y ago
    I have a motherboard from Gigabyte that will prompt after the first boot in Windows to install some of their software. https://arstechnica.com/security/2023/06/millions-of-pc-motherboards-were-sold-with-a-firmware-backdoor/ https://arstechnica.com/security/2023/06/millions-of-pc-moth... With my motherboard you can deny the install at least.
- nope96 3y ago
  Re: #2 - The UEFI bloatware/rootkit checked the Windows version: if you used Windows 8 or up it used the "feature" called "Windows Platform Binary Table", but Windows 7 didn't have that, so for Windows 7 it overwrote CHKDSK.EXE with a Lenovo loader on every reboot. So, yeah, they were overwriting OS binaries on disk, not just relying on WPBT. (But no reports of binaries being overwritten on on Linux)
  - autoexec 3y ago
    I'm surprised they got around windows file protection! That had been around since at least XP so I wonder what they did to avoid it. The writers of the malicious software lenovo has so far been caught including in their products were specifically targeting windows users, but I see no reason to think that they wouldn't include malicious software that targets linux if some seedy company decided it was worth the effort to write it and offered lenovo enough cash. Their total lack of integrity and respect for their customers is enough that I could never feel fully confident that I was safe just because I was running a non-windows OS.
    - DANmode 3y ago
      Windows File Protection seems ineffective against malware signed by a Microsoft vendor. and/or for malware that can disable WFP.

It definitely could if they wanted it to. I'm less worried about that because of the threat of PR blowback that helps keep them in check, but if it's really important to you then you should probably avoid Lenovo. Frame.work is quite a nice option.

happymellon 3y ago

No, and that's due to 2 reasons. 1. The malware was a rootkit for Windows 2. Windows has an interesting "feature" that will blindly auto-install software that is embedded in a certain location in the BIOS. If a rootkit is placed there, Windows will always try and install it. It's bad for Lenovo, but it's also bad that Windows has this anti-feature.

valleyer 3y ago
Wow. Could you point us to more technical information about this "feature" of Windows? I'm hoping someone has reverse-engineered it somewhere, but I'm not finding anything with some brief Googling.
- lights0123 3y ago
  No need to reverse engineer it when it's fully documented: https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-4e2d-a559-4a27cf905a80/windows-platform-binary-table.docx https://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-...
  - valleyer 3y ago
    Thank you!
    - autoexec 3y ago
      On the subject of this "feature", I found this handy https://michlstechblog.info/blog/windows-identify-a-wpbt-binary-in-biosuefi/ https://michlstechblog.info/blog/windows-identify-a-wpbt-bin...
- vondur 3y ago
  I have a motherboard from Gigabyte that will prompt after the first boot in Windows to install some of their software. https://arstechnica.com/security/2023/06/millions-of-pc-motherboards-were-sold-with-a-firmware-backdoor/ https://arstechnica.com/security/2023/06/millions-of-pc-moth... With my motherboard you can deny the install at least.
nope96 3y ago
Re: #2 - The UEFI bloatware/rootkit checked the Windows version: if you used Windows 8 or up it used the "feature" called "Windows Platform Binary Table", but Windows 7 didn't have that, so for Windows 7 it overwrote CHKDSK.EXE with a Lenovo loader on every reboot. So, yeah, they were overwriting OS binaries on disk, not just relying on WPBT. (But no reports of binaries being overwritten on on Linux)
- autoexec 3y ago
  I'm surprised they got around windows file protection! That had been around since at least XP so I wonder what they did to avoid it. The writers of the malicious software lenovo has so far been caught including in their products were specifically targeting windows users, but I see no reason to think that they wouldn't include malicious software that targets linux if some seedy company decided it was worth the effort to write it and offered lenovo enough cash. Their total lack of integrity and respect for their customers is enough that I could never feel fully confident that I was safe just because I was running a non-windows OS.
  - DANmode 3y ago
    Windows File Protection seems ineffective against malware signed by a Microsoft vendor. and/or for malware that can disable WFP.