top | item 20969334

Lenovo crams unremovable crapware into laptops by hiding it in the BIOS (2015)

130 points| beefhash | 6 years ago |theregister.co.uk | reply

85 comments

order
[+] areoform|6 years ago|reply
Some of my highest rated comments were for Apple's recent failures. Their laptops shipped with an unworkable keyboard. New product lines were confusing. The existence of the MacBook alongside the MacBook Air defied logic. Their "pro" machines were no longer pro. The list went on.

Apple has changed some of that, but even if they don't, my next laptop will still be a Mac.

Because Apple doesn't install shit on my machine. Apple fixes security holes. Apple doesn't cheat me on my privacy when I buy a machine.

Apple might suck donkey balls but everyone else sucks even more. Pardon my French.

[+] echelon|6 years ago|reply
Thinkpads do not have this crapware installed and can run Linux exceptionally well. You should look into one, because they're the best engineering laptop on the market.

Thinkpads have excellent keyboards, are user serviceable, support SIM cards, have tons of ports, are rugged yet lightweight. The manuals have hardware break downs to help you reinstall battery, RAM, drives, modems, etc.

The machines last forever. I have a few that are over a decade old and are still a joy to write software on.

Thinkpads are truly at another level.

[+] Medicalidiot|6 years ago|reply
I'm not a huge fan of Apple, but I love everything about my 2019 MBP minus the keyboard. After using Linux for close to a decade it's a fairly seamless transition compared to going back to Windows.
[+] delfinom|6 years ago|reply
>Apple doesn't cheat me on my privacy when I buy a machine.

Except that siri thing

[+] coldtea|6 years ago|reply
They keyboard, ok, and I'll give you the "pro" (though, if you're talking about their laptops and not their desktop pro model, they were totally pro). But this sounds like hardly a complain:

"New product lines were confusing. The existence of the MacBook alongside the MacBook Air defied logic"

One could always buy one or the other or neither...

[+] mrkeen|6 years ago|reply
I owned a MBP back around 2007.

I later purchased (in-person, in-store) an ipad pro using a credit card, maybe around 2015. The receipt they gave me had my email address printed on it. That really creeped me out.

[+] plg|6 years ago|reply
What about Microsoft surface book? I have colleagues who are in science/coding/tech and they really like them.
[+] chachachoney|6 years ago|reply
>> Apple doesn't cheat me on my privacy when I buy a machine.

Have you ever monitored all the telemetry Mac OS sends back to apple related domains?

[+] elorant|6 years ago|reply
Then buy a Linux laptop. Problem(s) solved.

I can't understand some of you guys. You pay 2k for a laptop which has a shitty keyboard and then you look for excuses to justify your decision. Sure, a lot of what you mention about Windows machines is true. But they're also preventable with work arounds. What kind of a work-around is there for the problem with MacPros keyboards?

I have a Toshiba laptop (Tecra Z40). Aside from the crap they install to make their tailor-made hardware to work everything else is stellar. The machine works for the last two years problem free, and it will probably keep working for another five. Don't make it sound like every non Apple laptop is crap because it isn't.

[+] redprince|6 years ago|reply
For what it's worth, the professional equipment marketed under the "Think" brand was not affected by this. It was only ever a problem for their consumer line of devices.

https://news.lenovo.com/pressroom/press-releases/lenovo-stat...

In general the Intel platform is quite the horror show of complex, deeply embedded layers of closed source software outside of the control of the user or the operating system. All the while these components have full control over the machine and all software running on it.

Intel ME, AMD PSP, the UEFI BIOS were just some sources of vulnerabilities coming with the hardware. So just buying another brand of laptop, PC or server won't do. There would need to be a fundamental shift towards handing back the user or owner full control over what is executed on his machine.

[+] tonyedgecombe|6 years ago|reply
For what it's worth, the professional equipment marketed under the "Think" brand was not affected by this

That doesn't make it OK.

[+] api|6 years ago|reply
I still wont buy them as the entire brand is tainted by this customer hostile crap.
[+] peter_d_sherman|6 years ago|reply
Here's a writeup on what I've been able to piece together (thus far) on this:

https://pastebin.com/wLyjNvFC

Note that it this rootkit/malware seems to be somewhat independent of manufacturer, that is, it's not just Lenovo but several other prominent laptop manufacturers where the same phenomena occurs...

[+] josteink|6 years ago|reply
To be fair this crapware affected Windows users only, and was removed swiftly in a quickly issued BIOS update after this caused a PR nightmare... back in 2015.

So why are we discussing this now, almost half a decade later? Why is this suddenly relevant again?

[+] i_am_proteus|6 years ago|reply
Because there are a lot of people who really like Macs and there are a lot of people who really like things that aren't Macs and these people do seem to enjoy engaging with/against each other.
[+] Jemm|6 years ago|reply
My brand new Lenovo has no crapware at all. It had McAffee (now owned by intel) but that was easy to remove.

Compared to Samsung who put a non removable Facebook app on their A50 phone I am happy with my Lenovo. The Samsung -home went back not only because of the Facebook app but also because the fingerprint reader did. To work better than 10% of the time and the digitizer was horrible.

[+] noja|6 years ago|reply
> My brand new Lenovo has no crapware at all. It had McAffee

McAfee is crapware.

> Compared to Samsung who put a non removable Facebook app

adb shell pm uninstall -k --user 0 com.X

[+] tinus_hn|6 years ago|reply
It had no crap at all, except for this crap.
[+] runlevel1|6 years ago|reply
McAfee was actually spun back out of Intel in 2017.
[+] Wowfunhappy|6 years ago|reply
So, how can I disable the Windows functionality that makes this type of thing possible? Surely there's a way?
[+] Vrondi|6 years ago|reply
No. Windows does not control the BIOS. The BIOS activates when the machine is powered on, before the operating system becomes active. This is at the hardware maker level, and outside the control of Windows.
[+] tinus_hn|6 years ago|reply
The issue is with Microsoft forcing this ridiculous behavior.
[+] usr1106|6 years ago|reply
Doesn't affect me because I have not run Windows for 10 years. I install Windows on every PC. I would prefer to run ARM more wideley, but unfortunately the hardware choice is limited.

That said I am not overly confident that with Linux I am totally immune against executing code I never intended to. The kernel needs to cooperate with the BIOS. I would not been surprised if the BIOS can make it execute arbitrary code provided by the vendor. It just needs to be a bit more tricky than telling the operating system look here is a binary in RAM, please save it on root file system as /bin/init

[+] bluecmd|6 years ago|reply
You don't even need that. The BIOS can just install vulnerable SMM handlers and then you're screwed.

I don't get why you say it doesn't affect you - bloated and crappy firmware affects everyone, regardless of OS.

[+] Vrondi|6 years ago|reply
If it's in the BIOS, it doesn't matter what OS you use. The BIOS powers up first and is active before the operating system ever is.
[+] usr1106|6 years ago|reply
stupid mistake, sorry

> I install Windows on every PC

Linux of course