Slashdot Mirror
Lenovo Installed Software On Laptops That Persisted After Complete Wipes
An anonymous reader writes: The Next Web has confirmed reports from owners of Lenovo laptops that the company used a BIOS feature to install its software on the laptops even if a user wiped a device clean and reinstalled the operating system. "If Windows 7 or 8 is installed, the BIOS of the laptop checks 'C:\Windows\system32\autochk.exe' to see if it's a Microsoft file or a Lenovo-signed one, then overwrites the file with its own. Then, when the modified autochk file is executed on boot, another two files LenovoUpdate.exe and LenovoCheck.exe are created, which set up a service and download files when connected to the internet." Lenovo has published a patch to remove this functionality. The article notes that this technique seems to be sanctioned by a Microsoft policy. "Manufacturers are obligated to ensure that the mechanism can be updated if an attack is discovered and should be removable by the user, but the rules outlined in the document are fairly loose and don't require the OEM to notify the owner of the laptop that such a mechanism is in place."
This is actually a mechanism called Windows Platform Binary Table (WPBT).
More information can be found in the Microsoft WPBT whitepaper:
"This paper describes the format of a Windows Platform Binary Table (WPBT). The WPBT is a fixed Advanced Configuration and Power Interface (ACPI) table that enables boot firmware to provide Windows with a platform binary that the operating system can execute. The binary handoff medium is physical memory, allowing the boot firmware to provide the platform binary without modifying the Windows image on disk. In the initial version, the WPBT simply contains a physical address pointer to a flat, Portable Executable (PE) image that has been copied to physical memory. The WPBT is extensible, allowing the layout of published platform binaries to be more complex in future versions and allowing the support of more than one binary type.
It is expected that the binary pointed to by the WPBT is part of the boot firmware ROM image. The binary can be shadowed to physical memory as part of the initial bootstrap of the boot firmware, or it can be loaded into physical memory by extensible boot firmware code prior to executing any operating system code. A boot firmware component would create the WPBT based on the location of the platform binary. During operating system initialization, Windows will read the WPBT to obtain the physical memory location of the platform binary. In the first version, the binary is required to be a native, user-mode application that is executed by the Windows Session Manager during operating system initialization. Windows will write the flat image to disk, and the Session Manager will launch the process. Windows may reclaim the physical memory described in the WPBT.
If Windows observes a WPBT during operating system initialization, it will attempt to use an ACPI control method to communicate binary execution status back to the platform."
Sorry, but this is what happens when you let a country under the sway of a totalitarian government build you computers.
But isn't Lenovo based in China these days, not America?
The problem is that this feature mostly targets users who are trying to get rid of lenovo software. On a laptop you would normally restore your system or reinstall windows using the recovery partition which is full of vendor-added software. If you went through the trouble of installing a clean version of windows (by finding an OEM install of windows you can use your key with) it probably means that you expect your installation to be clean of any lenovo software. But guess what, you still end up with Lenovo software installed behind your back. I'm not saying there is absolutely no good reason to have the Lenovo software installed, but they could at least prompt you with a message like "We detected that you are running a fresh installation of windows, would you like to install our software to improve the performances of your computer and fix known hardware problems ?". Then it's your choice to go along with their software or handle the possible windows update mess yourself like a responsible geek.
Tell me your thoughts on the NSA and FBI please
Do NOT buy an NSA or FBI laptop.
Yep My Thinkpad X250 has this and there is a bios update to fix it.
Do not look at laser with remaining good eye.
... install Windows ...
I think I just found how to fix it. Don't install Windows!
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
You must be newer. He was making a sarcasm.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.