Lenovo Ushers in a New Era of Mobile Workstation Power and Performance with Lenovo ThinkPad P50 and P70
-
-
Bit late to the conversation.
Yoga Network Shims, any source articles of that to reference?
-
@Breffni-Potter said:
Bit late to the conversation.
Yoga Network Shims, any source articles of that to reference?
There are tons, most articles only talk about it as malware as the majority of users are unaware of the concept of a network shim. That it was a network shim was blatant as it blocked sites like MangoLassi (how it was first detected around here) by intercepting the HTTP stream and not handling io.socket calls correct (very common in older proxies, so it was immediately clear what was happening) and by the fact that even a fresh install of Windows, even a direct from Microsoft one, had the issue instantly when the only available driver for the internal network cards, the one from Lenovo, was installed. The only source of the shim was in the network driver itself!
http://www.forbes.com/sites/thomasbrewster/2015/02/19/superfish-need-to-know/
-
From the above article:
But there’s a bigger concern that Lenovo is intercepting encrypted traffic so it can show ads on people’s computers. In the security world, this is known as a man-in-the-middle attack.
-
-
Looks like they are still at it - though in a less notorious way this time.
The long and the short - Lenovo is using a method that security companies like LoJack have been using for years to install software into windows from the BIOS.
Microsoft has made this even easier for them by creating a new connection in the UEFI that is part of Windows itself.
On the surface, something like this seems really convenient for consumers (not needed for businesses - they have IT staff to build images, etc). You scratch install the system but of course Windows doesn't have drivers for the hardware, the BIOS pushes down a version of the driver into windows and the end user doesn't have to be concerned about using another computer to find drivers (assuming the network drivers in windows aren't there).
The main bad part is inclusion of OneKey Optimizer - which is being reported as Lenovo junkware - but other than claiming to clean up some temp files, I'm not really sure what the issue with this software is.
Frankly I fully expect to see embedded drivers like this on all future systems. Manufacturers are trying to find ways to reduce their support overhead. Pushing out at least a starter driver to get the system online, then a manufacturer update tool to get the latest drivers from the manufacturer's website - this seems like a win for the consumers - as long as it's implemented correctly (think TLS connections, etc).
-
As suspected, the paid PR shills and the community fanboys are starting to come out calling anyone who things what Lenovo did "paranoid".
-
Oh right, so it's SuperFish, there isn't a third "network shim" out there.
I'd already caught up on the latest bit of fun, so much warning clients.
https://darait.co.uk/2015/08/lenovo-another-security-hole-found/
-
@Breffni-Potter said:
Oh right, so it's SuperFish, there isn't a third "network shim" out there.
Yes, Superfish was a network shim that ran a man in the middle attack not just on HTTP but with a signed SSL cert so that it could intercept secure data too like banking information.
-
@scottalanmiller said:
@Breffni-Potter said:
Oh right, so it's SuperFish, there isn't a third "network shim" out there.
Yes, Superfish was a network shim that ran a man in the middle attack not just on HTTP but with a signed SSL cert so that it could intercept secure data too like banking information.
Yeah I know what it did, Just got confused halfway through the thread in case they did it on a separate occasion.
-
@scottalanmiller said:
As suspected, the paid PR shills and the community fanboys are starting to come out calling anyone who things what Lenovo did "paranoid".
Are you saying that against what I just wrote?
The links provided above specifically mention that HP and Dell have been found to be deploying the autochk.exe as well. This isn't just a Lenovo thing.
Granted - Lenovo seems to have gone a step further with their OKO. But I can't say that OKO is crossing the line, if it's malware or tracking, etc - then it's crossing the line, otherwise...
Let's take Lenovo out of this for a second.
If Dell did this, and had a BIOS shim that installed a NIC/WiFi driver that downloaded a Dell support package - would you crucify them?
-
@Breffni-Potter said:
Oh right, so it's SuperFish, there isn't a third "network shim" out there.
I'd already caught up on the latest bit of fun, so much warning clients.
https://darait.co.uk/2015/08/lenovo-another-security-hole-found/
You said 'third'
Are you saying that SuperFish was #1
and Lenovo's driver shim was #2? -
@Dashrender said:
Are you saying that against what I just wrote?
No, I hadn't even seen that you had written anything. In SW a known semi-troll is out using terms like paranoid and claiming that Lenovo did nothing wrong.
-
@scottalanmiller said:
@Dashrender said:
Are you saying that against what I just wrote?
No, I hadn't even seen that you had written anything. In SW a known semi-troll is out using terms like paranoid and claiming that Lenovo did nothing wrong.
OK just checking after our conversation of yesterday
-
@Dashrender said:
If Dell did this, and had a BIOS shim that installed a NIC/WiFi driver that downloaded a Dell support package - would you crucify them?
No, because they don't have a track record of inexcusable behaviour. We are talking about a known malicious entity doing another thing very malicious.
Would I be happy if Dell was doing something similar? No. But if they were at least doing it with good intentions (legit drivers) it would not warrant crucifixion. If they did it to push malware? Absolutely.
-
@scottalanmiller said:
@Dashrender said:
If Dell did this, and had a BIOS shim that installed a NIC/WiFi driver that downloaded a Dell support package - would you crucify them?
No, because they don't have a track record of inexcusable behaviour. We are talking about a known malicious entity doing another thing very malicious.
Would I be happy if Dell was doing something similar? No. But if they were at least doing it with good intentions (legit drivers) it would not warrant crucifixion. If they did it to push malware? Absolutely.
OK so we're on the same page then, the general idea of what is going on here is OK'ish, but because it's Lenovo - and we hate them with cause - this is untrustable.
-
@Dashrender said:
OK so we're on the same page then, the general idea of what is going on here is OK'ish, but because it's Lenovo - and we hate them with cause - this is untrustable.
OKish at best. If it is well known and easily testable and controllable, then okay. If it is secret, not controllable and/or pushing malware it is not okay at all. That it is secret, pushing malware and doing so from a known threat source we have a pretty major issue.
-
For example, if Dell or HP did this and offered a way to turn it on and off in the BIOS settings, great. Having this sort of thing as an option is wonderful. Options are "always" good.
But it's no different than saying we are installing software. Guy comes to your house and installs MS Office for you. Good. Another guy comes to your house and installs five toolbars on IE or whose, a keylogger. Bad.
It's not the act of installing the software that is good or bad, it is what is being done. Primarily. In this case the uncontrolled push of the software is another problem. We can say "oh it's just a NIC driver, that's good" but we are specifically talking about a vendor who put spying capabilities into their NIC drivers.
-
What's more concerning to me is if hackers will be able to update the UEFI remotely to include their own updates to your system though either the older or now available MS solution, AKA a wipe and reinstall won't be effective anymore.
Just like a wipe and reinstall of Lenovo's machines wasn't effective because the shim was baked into their NIC driver, which was your only option for using the building in WiFi.
-
@Dashrender said:
What's more concerning to me is if hackers will be able to update the UEFI remotely to include their own updates to your system though either the older or now available MS solution, AKA a wipe and reinstall won't be effective anymore.
Yes, while what Lenovo has done technical makes them hackers (the Superfish case at least) the much bigger fear is not that Lenovo themselves will use their tools to siphon off your banking info because they have too much too lose (I have no doubt that they would if they thought that they could get away with it) but that others will leverage this as a gateway to your systems. This would be a field day for hackers - and it can be as easy as being a Lenovo employee or knowing one to potentially have access to data that would make this trivial to exploit without even needing to break into anything. And since Lenovo operates from a jurisdiction that will protect them in case of an attack on US companies, there is effectively no legal or financial incentive to keep them from doing so.
