Slashdot Mirror
Dell, Toshiba and Lenovo Utilities Expose PCs To More Attacks
jones_supa writes: It turns out that OEM helper software is still often quite fragile and can expose systems wide open to attack. Currently Lenovo, Dell and Toshiba all have unpatched vulnerabilities in their various support utilities for Windows. These vulnerabilities were discovered by a security researcher who goes by the name Slipstream, and he has posted details onlinealong with proof-of-concept exploit code. The vulnerabilities allow arbitrary code execution, planting malicious files and modifying system registry values.
Yeah, but there is a new threat/consideration.
I wanted to perma-block Windows 10 on the machines I look after. Ran the batch file that turns everything off. Job done.
Two days later I notice the GWX icon on an HP machine. The "helpful" HP utilities (that I never consciously invoke myself) must have summoned the evil that is WX.
So I re-ran the perma-blocker AND did my best to kill all vestiges of HP helpers on the machine. So far so good.
I come here for the love
haven't they always?
I don't know. I've been building my own PCs and installing OEM Windows since 486 days. I also use this thing called the "No" or "Cancel" button when installers and websites generously offer me things I was not looking for. I really don't understand many of the PC/Windows problems that so many talk about. ;-)
Uh this is no more secure than if you paid for a retail copy and also verified the SHA1 or purchased an MSDN subscription.
The problem with a retail copy is that your software that rips it is invariably going to place its own timestamps and other variations in the file, so your checksum likely won't be valid. An MSDN subscription is also likely too expensive for most people.
I realize it's fun to get modded up for encouraging pirating Windows but it's not really a behavior that should be supported.
If you buy a computer that has Windows installed, and it comes with a COA, then you already own a paid copy of Windows. If you look at the license terms, the COA itself is proof that you own a copy of Windows, and so long as you install the same edition (home, pro, etc) and license channel type (retail, upgrade, OEM) to match that COA, then it's not a pirated copy. Want a simple way to ensure that? Easy: Download the best version possible (i.e. for 7, get ultimate, for 8+, get pro) and then when it asks, just type in the key listed on the COA. It will automatically select the version you've paid for and install it, and likewise it will even activate just fine with Microsoft's servers (or call in, if necessary.)