Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo announces laptops using new mobile Xeon processors

arstechnica.com

Post reply on HN
Print view View original

81–90 of 103 posts

Re: Lenovo announces laptops using new mobile Xeon processors

#81

Post by hatsix »

froward wrote: post #66
SamReidHughes wrote: post #52

Earlier quoted context omitted.

> For your NVS4200M gpu, didn't Ubuntu offer you an installation of restricted drivers? I vaguely remember that when you booted on such configuration, there was an icon in upper right tray that did exactly that. Yes, I mean, I vaguely remember that, too. But often that didn't work, and when it did, you still didn't get Optimus, and multi-monitor stuff was still annoying to set up (until you learn to install some nvid…

All of the Ubuntu distros have full support for many of Nvidia's cadillac video cards and it's drop in. I was literally playing CS:GO 5 minutes ago on my Xubuntu box I built to game on. I also haven't had to install a driver for any peripheral or other component in any of machines for at least 8 years now. The very few times I do have to do tier 1-2 support for someone on a Windows machine at work, it requires some d…

It's the intel/nvidia combo that is the problem. Optimus isn't well supported yet, so we have to pick battery life or performance.

That said, I always choose performance.

Re: Lenovo announces laptops using new mobile Xeon processors

#82

Post by cfreeman »

riquito wrote: post #50
chuckup wrote: post #10

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo ser…

About thinking before buying Lenovo... I've bought a Lenovo notebook, wanted to download a copy of Windows from them (it's OEM), and searched on their forums for clues, since I didn't find anything on the site. This is what a moderator wrote > If what you wish to achieve is an OEM imaged system, the only way is to obtain official recovery media through official channels. There are no legal downloads available, theref…

I've worked in computer repair shops, and what you've described about OEM Windows is how it's worked for years. You have to either use the recovery partition that comes with the machine or order new recovery media from the manufacturer. This isn't unique to Lenovo.

Re: Lenovo announces laptops using new mobile Xeon processors

#83

Post by owenwil »

chuckup wrote: post #10

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo ser…

Does anyone have a laptop on the affected list, that's seeing this right now? If so, get in touch? owen@thenextweb.com

Re: Lenovo announces laptops using new mobile Xeon processors

#84

Post by the_ancient »

desk_rabbit wrote: post #70
chuckup wrote: post #27

Earlier quoted context omitted.

I just replied to the Ars thread - it's even stranger. Windows 8 and up have an officially Microsoft sanctioned way of letting manufacturers load software through Firmware, called "Windows Platform Binary Table". It means it is impossible to do a clean install of Windows now. I've seen zero mention of it anywhere - maybe Lenovo was the first to pull the trigger and make use of it recently.

This is unbelievable. How the hell did things get to this point? How much worse are they going to get?

>>How the hell did things get to this point?

Because people continue to make excuses for MS and continue to buy windows after they do things like this

>How much worse are they going to get?

Lots because people will whine on the Internet but will not do anything that actually matters or will make a difference;; You know like using an Operating System that respects your freedom...

Re: Lenovo announces laptops using new mobile Xeon processors

#85

Post by [deleted] »

jonorossi wrote: post #78
chuckup wrote: post #10

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo ser…

As others have said there seems to only be a single Word document Microsoft have published on the "Windows Platform Binary Table". I then found the following MSDN Forums question (with posts between 2013-07-16 and 2013-07-18) about how to implement WPBT by someone with the username "kevinwu1980". A Google search for "kevinwu1980 lenovo" gave me this (the page is now a redirect). If that MSDN Forums post is by the sam…

[deleted]

Re: Lenovo announces laptops using new mobile Xeon processors

#86

Post by minot »

cfreeman wrote: post #82
riquito wrote: post #50

Earlier quoted context omitted.

About thinking before buying Lenovo... I've bought a Lenovo notebook, wanted to download a copy of Windows from them (it's OEM), and searched on their forums for clues, since I didn't find anything on the site. This is what a moderator wrote > If what you wish to achieve is an OEM imaged system, the only way is to obtain official recovery media through official channels. There are no legal downloads available, theref…

I've worked in computer repair shops, and what you've described about OEM Windows is how it's worked for years. You have to either use the recovery partition that comes with the machine or order new recovery media from the manufacturer. This isn't unique to Lenovo.

Do manufacturers treat these DVDs as a way to make more profit?

Re: Lenovo announces laptops using new mobile Xeon processors

#87

Post by phphphph »

kozukumi wrote: post #72
chuckup wrote: post #30

Earlier quoted context omitted.

No - see my reply to the Ars thread. Windows 8 introduced an "official" way to do this called "Windows Platform Binary Table". Every time Windows boots, it checks your ACPI table for an entry called "WPBT", writes that to disk as "wpbbin.exe", and executes it. There does not seem to be any way to disable this behavior in Windows. Truecrypt would not help in this case because it happens after boot.

Another [very valid!] reason not to run Windows IMHO. This kind of thing is totally unacceptable.

To be fair, the guidelines for this feature include

> The authenticated device owner should have the ability to disable or remove this functionality if desired.

Re: Lenovo announces laptops using new mobile Xeon processors

#88

Post by chuckup »

chuckup wrote: post #10

Lenovo is now using rootkit-like techniques to install their software on CLEAN Windows installs, by having the BIOS overwrite windows system files on bootup. Someone detailed this here: http://arstechnica.com/civis/viewtopic.php?p=29497693&sid=dd... I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo ser…

tl;dr version (since this blew up on Reddit and there's lots of stuff to digest)

* in Windows 8+ any PC vendor can include an .EXE in Firmware/BIOS, and Windows will look for this on each boot, and run it right before you log in. This is called "Windows Platform Binary Table". This is something Windows does, and there is no way to turn this off. To me, this is the bigger story, because vendors may now start to use this method to install anything, making a clean windows install impossible.

* Lenovo uses this method if you try to install Windows 8, but if you install Windows 7, it does the sketchy "overwrite your system file (autochk.exe)" method instead.

* Either way, Lenovo installs a service on your PC. It was found to have security bugs. I can't find the link, but they said this was placed on some laptops/PC's from late 2014 to Summer 2015. They've released a new firmware 2 weeks ago that turns this off.

I would like to know if any non-Lenovo pc's have used this "Windows Platform Binary" method to run software from the firmware, because when I searched for it, I saw people with Dell's and HP's who thought they might have a virus, posting scan logs that contained the text "wpbbin.exe" (which would only be there if Windows found it in the BIOS and put it there) For example see https://www.google.com/search?q="wpbbin.exe"+site%3Aforums.m...

Check your PC:

Windows 8 and up: Check your event log for "Microsoft-Windows-Subsys-SMSS" and if you see "A platform binary was successfully executed." your PC vendor is doing this. Or, look for a file called wpbbin.exe in windows\system32. (This file would ONLY exist if Windows found it in your firmware and ran it.)

Windows 7: Verify your autochk.exe is legit. I think you could simply do: "sfc /VERIFYONLY" in cmd.exe (as Admin) but I did not test it. My autochk.exe was signed by Lenovo in 2014 (which tipped me off it didn't come from the Windows 7 DVD I got in 2010!).

Re: Lenovo announces laptops using new mobile Xeon processors

#89

Post by RaitoBezarius »

cbd3 wrote: post #77
Teknoman117 wrote: post #74

Earlier quoted context omitted.

You'd be safe. First thing is that they are probably uninterested in we Linux & BSD users to begin with, but, entertaining the notion, I have a few thoughts. The two methods of how this works could be blocked. For systems without support for WPBT, where the firmware attempts to overwrite system files, one could use whole drive encryption (like LUKS) on Linux to prevent the firmware from being able to write directly o…

Linux' boot process is at its core designed around mechanisms that allow the bootloader to control binary execution: they're called the kernel command line (init=) and the initramfs. Granted, the bootloader is not the firmware, but since everyone is using GRUB these days it wouldn't be too hard for firmware to locate the right configuration pieces to overwrite. And since initramfs is by design unencrypted because you…

And for now, there is no report about a ThinkPad getting an unknown kernel module or any config tamper attempt from an unknown source?

The problem with coreboot/libreboot capable machine is they can't longer be shipped with Intel newer stuff. (thanks to Intel bastards).

I feel we are kind of stuck in eating proprietary and evil software until we die.

Re: Lenovo announces laptops using new mobile Xeon processors

#90

Post by BystanderX »

phphphph wrote: post #87
kozukumi wrote: post #72

Earlier quoted context omitted.

Another [very valid!] reason not to run Windows IMHO. This kind of thing is totally unacceptable.

To be fair, the guidelines for this feature include > The authenticated device owner should have the ability to disable or remove this functionality if desired.

"Guidelines"

The feature shouldn't exist in the first place. If a backdoor is hidden, this is an unlocked door with a "Please don't enter" sign on it.

Post reply on HN