Lenovo Ushers in a New Era of Mobile Workstation Power and Performance with Lenovo ThinkPad P50 and P70
-
Looks like they are still at it - though in a less notorious way this time.
The long and the short - Lenovo is using a method that security companies like LoJack have been using for years to install software into windows from the BIOS.
Microsoft has made this even easier for them by creating a new connection in the UEFI that is part of Windows itself.
On the surface, something like this seems really convenient for consumers (not needed for businesses - they have IT staff to build images, etc). You scratch install the system but of course Windows doesn't have drivers for the hardware, the BIOS pushes down a version of the driver into windows and the end user doesn't have to be concerned about using another computer to find drivers (assuming the network drivers in windows aren't there).
The main bad part is inclusion of OneKey Optimizer - which is being reported as Lenovo junkware - but other than claiming to clean up some temp files, I'm not really sure what the issue with this software is.
Frankly I fully expect to see embedded drivers like this on all future systems. Manufacturers are trying to find ways to reduce their support overhead. Pushing out at least a starter driver to get the system online, then a manufacturer update tool to get the latest drivers from the manufacturer's website - this seems like a win for the consumers - as long as it's implemented correctly (think TLS connections, etc).
-
As suspected, the paid PR shills and the community fanboys are starting to come out calling anyone who things what Lenovo did "paranoid".
-
Oh right, so it's SuperFish, there isn't a third "network shim" out there.
I'd already caught up on the latest bit of fun, so much warning clients.
https://darait.co.uk/2015/08/lenovo-another-security-hole-found/
-
@Breffni-Potter said:
Oh right, so it's SuperFish, there isn't a third "network shim" out there.
Yes, Superfish was a network shim that ran a man in the middle attack not just on HTTP but with a signed SSL cert so that it could intercept secure data too like banking information.
-
@scottalanmiller said:
@Breffni-Potter said:
Oh right, so it's SuperFish, there isn't a third "network shim" out there.
Yes, Superfish was a network shim that ran a man in the middle attack not just on HTTP but with a signed SSL cert so that it could intercept secure data too like banking information.
Yeah I know what it did, Just got confused halfway through the thread in case they did it on a separate occasion.
-
@scottalanmiller said:
As suspected, the paid PR shills and the community fanboys are starting to come out calling anyone who things what Lenovo did "paranoid".
Are you saying that against what I just wrote?
The links provided above specifically mention that HP and Dell have been found to be deploying the autochk.exe as well. This isn't just a Lenovo thing.
Granted - Lenovo seems to have gone a step further with their OKO. But I can't say that OKO is crossing the line, if it's malware or tracking, etc - then it's crossing the line, otherwise...
Let's take Lenovo out of this for a second.
If Dell did this, and had a BIOS shim that installed a NIC/WiFi driver that downloaded a Dell support package - would you crucify them?
-
@Breffni-Potter said:
Oh right, so it's SuperFish, there isn't a third "network shim" out there.
I'd already caught up on the latest bit of fun, so much warning clients.
https://darait.co.uk/2015/08/lenovo-another-security-hole-found/
You said 'third'
Are you saying that SuperFish was #1
and Lenovo's driver shim was #2? -
@Dashrender said:
Are you saying that against what I just wrote?
No, I hadn't even seen that you had written anything. In SW a known semi-troll is out using terms like paranoid and claiming that Lenovo did nothing wrong.
-
@scottalanmiller said:
@Dashrender said:
Are you saying that against what I just wrote?
No, I hadn't even seen that you had written anything. In SW a known semi-troll is out using terms like paranoid and claiming that Lenovo did nothing wrong.
OK just checking after our conversation of yesterday
-
@Dashrender said:
If Dell did this, and had a BIOS shim that installed a NIC/WiFi driver that downloaded a Dell support package - would you crucify them?
No, because they don't have a track record of inexcusable behaviour. We are talking about a known malicious entity doing another thing very malicious.
Would I be happy if Dell was doing something similar? No. But if they were at least doing it with good intentions (legit drivers) it would not warrant crucifixion. If they did it to push malware? Absolutely.
-
@scottalanmiller said:
@Dashrender said:
If Dell did this, and had a BIOS shim that installed a NIC/WiFi driver that downloaded a Dell support package - would you crucify them?
No, because they don't have a track record of inexcusable behaviour. We are talking about a known malicious entity doing another thing very malicious.
Would I be happy if Dell was doing something similar? No. But if they were at least doing it with good intentions (legit drivers) it would not warrant crucifixion. If they did it to push malware? Absolutely.
OK so we're on the same page then, the general idea of what is going on here is OK'ish, but because it's Lenovo - and we hate them with cause - this is untrustable.
-
@Dashrender said:
OK so we're on the same page then, the general idea of what is going on here is OK'ish, but because it's Lenovo - and we hate them with cause - this is untrustable.
OKish at best. If it is well known and easily testable and controllable, then okay. If it is secret, not controllable and/or pushing malware it is not okay at all. That it is secret, pushing malware and doing so from a known threat source we have a pretty major issue.
-
For example, if Dell or HP did this and offered a way to turn it on and off in the BIOS settings, great. Having this sort of thing as an option is wonderful. Options are "always" good.
But it's no different than saying we are installing software. Guy comes to your house and installs MS Office for you. Good. Another guy comes to your house and installs five toolbars on IE or whose, a keylogger. Bad.
It's not the act of installing the software that is good or bad, it is what is being done. Primarily. In this case the uncontrolled push of the software is another problem. We can say "oh it's just a NIC driver, that's good" but we are specifically talking about a vendor who put spying capabilities into their NIC drivers.
-
What's more concerning to me is if hackers will be able to update the UEFI remotely to include their own updates to your system though either the older or now available MS solution, AKA a wipe and reinstall won't be effective anymore.
Just like a wipe and reinstall of Lenovo's machines wasn't effective because the shim was baked into their NIC driver, which was your only option for using the building in WiFi.
-
@Dashrender said:
What's more concerning to me is if hackers will be able to update the UEFI remotely to include their own updates to your system though either the older or now available MS solution, AKA a wipe and reinstall won't be effective anymore.
Yes, while what Lenovo has done technical makes them hackers (the Superfish case at least) the much bigger fear is not that Lenovo themselves will use their tools to siphon off your banking info because they have too much too lose (I have no doubt that they would if they thought that they could get away with it) but that others will leverage this as a gateway to your systems. This would be a field day for hackers - and it can be as easy as being a Lenovo employee or knowing one to potentially have access to data that would make this trivial to exploit without even needing to break into anything. And since Lenovo operates from a jurisdiction that will protect them in case of an attack on US companies, there is effectively no legal or financial incentive to keep them from doing so.
-
@Dashrender said:
Just like a wipe and reinstall of Lenovo's machines wasn't effective because the shim was baked into their NIC driver, which was your only option for using the building in WiFi.
Exactly, they are removing the ability for IT pros or end users to protect themselves or even discover when they are being attacked. It's a new level of risk introduced for no reason. Or not a very good one. Getting drivers loaded is not a big deal and there are simple options, like having them loaded in an optional space that would work just fine.
I wonder if this breaks certain OSes or OS version too.
-
@scottalanmiller said:
I wonder if this breaks certain OSes or OS version too.
You're wondering if what breaks certain OSes? The BIOS/UEFI (I'll call it a) authorized hack?
-
@Dashrender said:
You're wondering if what breaks certain OSes? The BIOS/UEFI (I'll call it a) authorized hack?
The forced push of drivers. Sorry that was pretty ambiguous. Even when it isn't doing something "bad" does it, for example, push a version of the NIC driver to Windows 10 even if you have Windows 8 or what about when 11 comes out? How does it do the "forced push" without adding new risks just around reliability?
-
@scottalanmiller said:
@Dashrender said:
You're wondering if what breaks certain OSes? The BIOS/UEFI (I'll call it a) authorized hack?
The forced push of drivers. Sorry that was pretty ambiguous. Even when it isn't doing something "bad" does it, for example, push a version of the NIC driver to Windows 10 even if you have Windows 8 or what about when 11 comes out? How does it do the "forced push" without adding new risks just around reliability?
The previously linked forums posts indicated that a single system was able to tell the difference between Windows 7 and Windows 8 and as such did something different for each system.
Also with rare exceptions Windows 7 drivers work in 8 and 10.
The manufacturer could release a new BIOS update for a new OS that could then support several versions of Windows if needed.
-
@Dashrender said:
The previously linked forums posts indicated that a single system was able to tell the difference between Windows 7 and Windows 8 and as such did something different for each system.
Could do it, yes. But that something is doing detection and force pushing leaves a lot of room for error, right? Does a simple typo case the system to force Windows drivers into ESXi for example? How does it do the detection? How does it ensure it doesn't do the wrong thing? Lots of questions to ask given that traditionally we had humans verifying this stuff.
