Slashdot Mirror
Dell, Toshiba and Lenovo Utilities Expose PCs To More Attacks
jones_supa writes: It turns out that OEM helper software is still often quite fragile and can expose systems wide open to attack. Currently Lenovo, Dell and Toshiba all have unpatched vulnerabilities in their various support utilities for Windows. These vulnerabilities were discovered by a security researcher who goes by the name Slipstream, and he has posted details onlinealong with proof-of-concept exploit code. The vulnerabilities allow arbitrary code execution, planting malicious files and modifying system registry values.
Oh FFS:
"LSCTaskService is further associated with a file called LSCController.dll, which contains methods that can be called using HTTP GET and POST requests to its port. LSCTaskService can be made to run arbitrary code in the unprotected directory %APPDATA%\LSC\Local Store with system privileges, using a LSCController method called RunInstaller."
So javascript on a website can run arbitrary code with system privileges! FFS.
And Dell too? Having been caught installing a backdoor cert on its PCs, here it is again.
No but the PC Decrapifier will... https://www.pcdecrapifier.com/
A note on this, that I think is very important, is that Microsoft likes to stress that genuine Windows guarantees you'll be free of malware and exploits, but this is just false. In fact, I might even go so far as to say that it's the least guarantee (with the exception of Chinese flea markets.)
The one and only way to guarantee that your copy of Windows isn't infected with malware is to do the following:
Download the ISO from The Pirate Bay (use terms like untouched or MSDN with the OS version you download) and run an SHA1 hash against it. Google the hash, and if it matches what Microsoft publishes on the MSDN site, then you have no chance of being compromised.
Burn that or copy it to a thumb drive, boot it from bios, press shift+f10, type 'diskpart', type 'list disk', then 'select disk #' (where # is the primary boot disk number you see listed; likely disk 0), then 'clean'. There, now you've eliminated any chance of malware (and yes, this also wipes out the recovery partition, but you don't want it anyways as it likely contains exploitable OEM crapplets, plus it's needlessly using up part of your primary disk.)
And there is always PC Decrapifier for those PCs that come with "restore partitions" filled with crap, so I really don't get the big deal either.
Of course this is one more reason to go to your local system builder, the only software I install other than Windows is freeware that people can use like a full AV, Libre Office, Pale Moon and Comodo Dragon browsers with Adblock Plus,all spyware free.
ACs don't waste your time replying, your posts are never seen by me.
The last fairly new HP I worked on has no entry in the uninstall list for "Hp Support Assistant." I traced where the program launches from and it uses an acronym to hide behind. Then the uninstaller the directory actually references some HP solutions framework thing. I tried removing that from its entry on the control panel and it said it can't remove it because it was needed by the HP Support Assistant. So I ran the uninstaller directly from the directory and it did quite literally nothing. So I had to remove the entire directory and every reference to it in the various boot time locations in the registry to truly kill it. That's what I like to call malware. It literally violates US laws pertaining to software having to be removable by the user if they want. I'm sure there's some preinstallation EULA BS to get around it though. Great upgrade to that crapware, HP!
you might not want to admit that in public, some of it is free for non-commercial use. installing it as a system builder is commercial use unless you have permission
The best is when you try to uninstall HP Security Centre, but Windows refuses to run the uninstaller because... wait for it... HP _revoked_ the certificate the uninstaller is signed with! Oh it's hilarious - let me get this straight:
1. HP signs crapware with certificate X.
2. HP pre-installs crapware on a zillion PCs/laptops.
3. HP certificate ends up in the hands of retards who use it to sign a bunch of malware.
4. HP panics and revokes the certificate.
And now, due to HP's endless stream of incompetent boobery, I can no longer uninstall their garbage.