Slashdot Mirror
Yet Another Compromising Preinstalled "Glitch" In Lenovo Laptops
New submitter execthis writes: Japanese broadcaster NHK is reporting that yet another privacy/security-compromising "glitch" has been found to exist in preinstalled software on Lenovo laptops. The article states that the glitch was found in Spring and that in late July Lenovo began releasing a program to uninstall the difficult-to-remove software. The article does not specify, but it could be referring to a BIOS utility called Lenovo Service Engine (LSE) for which Lenovo has released a security advisory with links to removal tools for various models.
Lenovo is now a puppet for the Chinese government. Of course they will have backdoor to spy on you.
We are just seeing the tip of an iceberg here - we can't trust our computers anymore.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Are their PC's based on their laptops affected too? Stuff like the Idea Center?
IMHO, Lenovo are a piece of shit, I have an ideacenter of theirs and it won't switch on unless you unplug the network cable and power, press 'on' a few times, them plug them back in and press on. This is just yet another reason I won't buy any of their kit, PC, Android, phone.
And where exactly are the privacy laws ?: "The utility also sends non-personally identifiable system data to Lenovo servers"
Why even post this article. It's 2 lines. "Oh we found something", well good for you, how about telling us what you actually found?
Buck Feta. You know what to do.
we can't trust our computers anymore
Our computers? Even though I "bought" my computer . . . I'm not sure that I actually "own" it. There is probably a legalese expression in the fine print pf the documentation somewhere, that the manufacturer has a right to install any sort of spyware that they want on "my" computer.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
FFS, courtesy of the TSA backdooring luggage locks, even the locks are worthless these days.
http://boingboing.net/2015/08/21/make-your-own-tsa-universal-lu.html
Spotify decides to help itself to all your data on your phone on an upgrade. And Google make a phone that permits that.
Samsung installs spyware/helpware on their phones and tablets that let it take over the tablet remotely and do *everything*, read everything, fake SMSs intercept calls, the lot. Hackers backdoor this and suddenly people are aware their stuff is just spyware only because hackers 'misuse' it, as if that feature was ever useful.
HTTPS/TLS is backdoored because certificate authorities are NSA backdoors.
Uber has its 'god' app that spies on its customers wherever they go and whoever they meet with.
It's like governments have abrogated their duty to protect people from this kind of shit and companies like Uber and Lenovo are having a field day.
The last thing I want is my firmware getting updated automatically.
I'd really like for all writable memory in my computer to be removable. And that includes the bios memory. Have it be a micro SD card or something.
Here someone will say it will make the machine take 1 second longer to boot up or OH NOES the mobo will cost 10 cents more to make. But its worth it. It means you can audit the system to check for viruses really easily. You pull the chip, plug it into a clean system, and scan it. Or if you prefer... wipe it. Write the whole thing with ones then zeros... and then flash it with a proper version of the bios.
And this also means that corrupted bios memory is less of a problem. You can pull the chip. Sure, if the processors or something else is damaged then this won't help. But i've had a few mobos that were totally fine except the bios was so corrupt you couldn't flash a fresh version. With this change, that problem is gone.
Cue people saying "you can't do that because no one has done it that way yet"... climb a fucking tree so I can throw bananas at you then, you filthy animal! :-D
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
Easy fix: wipe the system and install Linux. No self respecting /. reader runs an OS provided by the machine manufacturer, with all the crapware preinstalled.
That goes for Lenovo, Dell, HP, Asus, etc -- all of them.
Help your friends and family get converted over to OpenSource!
LOL and then watch the UEFI bios reinstall everything without telling you
http://www.techworm.net/2015/0...
The BIOS isn't installing apps to the hard drive (give it time?) As AC indicates this is a Windows-only issue. the BIOS -holds- an application that Windows helpfully detects and installs into itself on behalf of the hardware. A Linux system will totally ignore the app (which is Windows-specific anyway!!) sitting in the BIOS.
RETURN without GOSUB in line 1050
We are just seeing the tip of an iceberg here - we can't trust our computers anymore.
You haven't been able to trust your computer since flash bios and/or programmable CPU microcode. If you've been trusting your computer between then and now, you're a rube.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Covered on slashdot ten days ago:
http://tech.slashdot.org/story...
"Those who do not learn from history are doomed to repeat it" - Santayana
E
If you have windows 7 the bios replaces the file. The feature you mention is only for windows 8 and 10.
... it wasn't hidden well enough and somebody noticed.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Funny thing about this, I have a business-grade Lenovo laptop, and whenever one of these stories has come out I've looked to see whether I've got whatever backdoor/malware is being talked about on my machine. Nothing. No trace of any of them. So it seems the way to avoid these things is to buy a business-market Lenovo PC, not a home/casual-user market one. Backdooring large businesses seems to be something they don't want to risk...
(One possible reason for this is that apart from the political repercussions, you're paying a significant premium for their business-grade hardware, so they don't need to subsidise it with adware and other crap).
Backdooring business is risky but also very profitable, just because you didn't see it doesn't mean that it's non-existent. It may just mean that it needs a specific trigger to get activated.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Lesson to the wise: 1) Buy good, newish, used computers at a large discount off new prices and save money 2) Wipe the hard drive clean (or install a new one) 3) Install the OS of your choice (a Linux version is best) and save more money, and lastly, 4) Install whatever applications programs you want from a trusted Linux repository onto your hard drive and save even more money. End result: The only software residing on your "new" computer should be software that you want or don't mind having. Unfortunately, if you want something done correctly you usually must do it yourself.