Lenovo announces laptops using new mobile Xeon processors • Hacker News Board

Re: Lenovo announces laptops using new mobile Xeon processors

#71

Post by yuhong » Wed, Aug 12, 2015, 12:52 AM UTC

ilurk wrote: post #35

chuckup wrote: post #10

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo ser…

This is getting increasingly disturbing with each new generation of hardware. You no longer have the right to own the hardware you buy. Now it has become a service subject to their terms. That Windows Platform Binary Table sounds disturbing and is ripe for being exploited. Interesting info found [1]: > Lenovo Service Engine (LSE) is a utility in the BIOS for certain Lenovo desktop systems. It automatically sends non-…

Not Intel ME, Intel Boot Guard.

Re: Lenovo announces laptops using new mobile Xeon processors

#72

Post by kozukumi » Wed, Aug 12, 2015, 1:09 AM UTC

chuckup wrote: post #30

justThis1Post wrote: post #15

Earlier quoted context omitted.

RMS is sounding less and less crazy with discoveries like this. To think a manufacturer would essentially rootkit their own machines is testament to how bad things have become. Would running TrueCrypt full disk encryption protect you from your own hardware? If the BIOS can't read the disk on boot, I don't think it would inject the binary into the file system.

No - see my reply to the Ars thread. Windows 8 introduced an "official" way to do this called "Windows Platform Binary Table". Every time Windows boots, it checks your ACPI table for an entry called "WPBT", writes that to disk as "wpbbin.exe", and executes it. There does not seem to be any way to disable this behavior in Windows. Truecrypt would not help in this case because it happens after boot.

Another [very valid!] reason not to run Windows IMHO. This kind of thing is totally unacceptable.

Re: Lenovo announces laptops using new mobile Xeon processors

#73

Post by chias » Wed, Aug 12, 2015, 3:35 AM UTC

riquito wrote: post #50

chuckup wrote: post #10

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo ser…

About thinking before buying Lenovo... I've bought a Lenovo notebook, wanted to download a copy of Windows from them (it's OEM), and searched on their forums for clues, since I didn't find anything on the site. This is what a moderator wrote > If what you wish to achieve is an OEM imaged system, the only way is to obtain official recovery media through official channels. There are no legal downloads available, theref…

Better response than I got. This was just a couple months ago, the laptop shipped with Superfish installed on it in spite of assurances that it wouldn't, so I called them to ask where I could get driver installers for after I wipe / reinstall windows. I was told that I could under no circumstances reinstall Windows (even if I went and bought a brand new Windows license), that it would void my warranty and break everything and there were no drivers because: "it's not Microsoft Windows on these machines, it's Lenovo Windows".

I am never buying from them again, and at this point there is literally nothing they can do to regain my trust as a consumer.

Re: Lenovo announces laptops using new mobile Xeon processors

#74

Post by Teknoman117 » Wed, Aug 12, 2015, 4:43 AM UTC

RaitoBezarius wrote: post #67

chuckup wrote: post #10

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo ser…

Does anyone know if Lenovo try to put some rootkit on Linux / BSD based OSes? I mean, if it does attempt to do it on Windows, it may as well do it on Linux / BSD based OSes. I was wondering about buying a ThinkPad soon to improve my hardware... And I'm pretty scared about this.

You'd be safe. First thing is that they are probably uninterested in we Linux & BSD users to begin with, but, entertaining the notion, I have a few thoughts.

The two methods of how this works could be blocked. For systems without support for WPBT, where the firmware attempts to overwrite system files, one could use whole drive encryption (like LUKS) on Linux to prevent the firmware from being able to write directly onto your drive. If they are more sneaky and have this tied directly to the firmware methods for writing to disk, you can always compile the Linux kernel to not require the bios after loading the kernel. This may be the default mode of operation now, i'm not entirely certain.

For the systems using WPBT, its even easier. There is no way in hell they could get a patch into the mainline or any real community kernels that would load contents of the system firmware and immediately execute them. No self respecting distribution would enable this either without the user explicitly authorizing it in the first place either.

If they are super evil and actually attempt to inject code directly into the system memory, this would depend on a explicit kernel version because the in memory model & organization aren't guaranteed to be the same between kernel versions. The last thing someone wanting to take over your computer wants to do is render it unstable. It just makes what they are doing more apparent.

The fact that Microsoft actually provided a way of having binaries executed without the user's permission (or ability to turn it off) is absolutely unacceptable. It's like they want to be able to run what they want on our systems...

Re: Lenovo announces laptops using new mobile Xeon processors

#75

Post by cbd3 » Wed, Aug 12, 2015, 5:28 AM UTC

ilurk wrote: post #35

chuckup wrote: post #10

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo ser…

This is getting increasingly disturbing with each new generation of hardware. You no longer have the right to own the hardware you buy. Now it has become a service subject to their terms. That Windows Platform Binary Table sounds disturbing and is ripe for being exploited. Interesting info found [1]: > Lenovo Service Engine (LSE) is a utility in the BIOS for certain Lenovo desktop systems. It automatically sends non-…

> It's just a shame that with Intel ME the Libreboot/Coreboot devs have given up on Intel machines. I'm very interested in the Purism Librem laptop but I have low hopes. Maybe the future will be ARM.

This isn't true. Libreboot is the fork that only works with completely free platforms, which the newer Intel chipsets make impossible. Coreboot is still very much committed to supporting new Intel chipsets, although the mainboard availability of course depends on what developers have time and interest for.

Google Chromebooks all ship with Coreboot, so they're fully supported and a great choice if you're trying to make the most free usable computer you can get. They can all run Linux, and some of them even Windows with a little more effort. They also have ARM-based ones, some of which are completely blob-free.

Also, if you're putting your hopes on Pursim this may be of interested to you: http://blogs.coreboot.org/blog/2015/08/09/the-truth-about-pu...

Re: Lenovo announces laptops using new mobile Xeon processors

#76

Post by SamReidHughes » Wed, Aug 12, 2015, 5:36 AM UTC

froward wrote: post #65

SamReidHughes wrote: post #29

Earlier quoted context omitted.

The rule of thumb for Thinkpads and Linux is that you'll be fine as long as you get an Intel wifi card (or some other known quantity) and integrated graphics. For example, the NVS 4200M gpu hasn't really worked out of the box for me even on Ubuntu on a T520, nor the Quadro 2000M on a W520, without having to do some fiddling, or (later) knowing what specific packages to install. Optimus or certain multi-monitor setups…

I don't know whose rule you're referring to, but Atheros has always been far more celebrated in terms of their support and openness towards Linux consumers, appliances, etc. than Intel. They had such an impact on the Linux world that Broadcom ended up opening its drivers as a result.

Thinkpads typically come with two kinds of configuration options, when it comes to wifi: Intel, and "Thinkpad" wifi cards where you don't know what you're going to get.

Re: Lenovo announces laptops using new mobile Xeon processors

#77

Post by cbd3 » Wed, Aug 12, 2015, 5:43 AM UTC

Teknoman117 wrote: post #74

RaitoBezarius wrote: post #67

Earlier quoted context omitted.

Does anyone know if Lenovo try to put some rootkit on Linux / BSD based OSes? I mean, if it does attempt to do it on Windows, it may as well do it on Linux / BSD based OSes. I was wondering about buying a ThinkPad soon to improve my hardware... And I'm pretty scared about this.

You'd be safe. First thing is that they are probably uninterested in we Linux & BSD users to begin with, but, entertaining the notion, I have a few thoughts. The two methods of how this works could be blocked. For systems without support for WPBT, where the firmware attempts to overwrite system files, one could use whole drive encryption (like LUKS) on Linux to prevent the firmware from being able to write directly o…

Linux' boot process is at its core designed around mechanisms that allow the bootloader to control binary execution: they're called the kernel command line (init=) and the initramfs. Granted, the bootloader is not the firmware, but since everyone is using GRUB these days it wouldn't be too hard for firmware to locate the right configuration pieces to overwrite. And since initramfs is by design unencrypted because you need it to decrypt the rest, it's trivial to get your evil.ko injected in there.

There's only so much you can do against evil firmware, unfortunately. Getting a coreboot/libreboot capable machine is the only real way out.

Re: Lenovo announces laptops using new mobile Xeon processors

#78

Post by jonorossi » Wed, Aug 12, 2015, 6:10 AM UTC

chuckup wrote: post #10

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo ser…

As others have said there seems to only be a single Word document Microsoft have published on the "Windows Platform Binary Table". I then found the following MSDN Forums question (with posts between 2013-07-16 and 2013-07-18) about how to implement WPBT by someone with the username "kevinwu1980". A Google search for "kevinwu1980 lenovo" gave me this (the page is now a redirect). If that MSDN Forums post is by the same guy then Lenovo was likely working on this in mid-2013:

> Kernel Service Protection for Client Security

> doi.ieeecomputersociety.org/10.1109/MSP.2010.112

> by HJK Wu - ‎2010

> ... for Client Security. Hui Jun (Kevin) Wu , Lenovo Global Desktop Development Laboratory ..... Contact him at kevinwu1980@gmail.com or wuhj@lenovo.com.

https://social.msdn.microsoft.com/Forums/windowsdesktop/en-U...

Re: Lenovo announces laptops using new mobile Xeon processors

#79

Post by naner » Wed, Aug 12, 2015, 6:17 AM UTC

chuckup wrote: post #10

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo ser…

Edit: I was wrong on all counts, see chuckup comment below. This happens after boot in cooperation with the OS. Encryption and secure boot are irrelevant.

I presume this type of firmware enabled OS modification will not be able to work with drive encryption enabled, but does secure boot help at all in this situation? Presumably Lenovo includes their own signing key in their firmware so their signed executables would also be trusted. Or is this not something secure boot would verify?

Re: Lenovo announces laptops using new mobile Xeon processors

#80

Post by chuckup » Wed, Aug 12, 2015, 6:23 AM UTC

jonorossi wrote: post #78

chuckup wrote: post #10

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo ser…

As others have said there seems to only be a single Word document Microsoft have published on the "Windows Platform Binary Table". I then found the following MSDN Forums question (with posts between 2013-07-16 and 2013-07-18) about how to implement WPBT by someone with the username "kevinwu1980". A Google search for "kevinwu1980 lenovo" gave me this (the page is now a redirect). If that MSDN Forums post is by the sam…

Wow, nice find!

Also, I see Microsoft has updated that document in the last two weeks, apparently due to Lenovo's use of it.

http://news.lenovo.com/article_display.cfm?article_id=2013

"a security vulnerability that was discovered ..by an independent security researcher, Roel Schouwenberg... As a result of these findings, Microsoft recently released updated security guidelines...on how to best implement this Windows BIOS feature."