Live data from Hacker News

LG monitors silently install software through Windows Update without consent

videocardz.com

51–60 of 671 posts

Re: LG monitors silently install software through Windows Update without consent

#51

we finally cracked self-installing software, it just turns out the payload is McAfee and the installer is an HDMI cable

We had autorun.inf in the past installing automatically from any random USB drive[1]. The fun days where you always feared contracting malware if you so happened to plug a random USB drive in :)

[1] https://en.wikipedia.org/wiki/Autorun.inf

Re: LG monitors silently install software through Windows Update without consent

#52

Earlier quoted context omitted.

But this assumes you plug in USBC .... Right? HDMI and display port can't....install over right?

I don't see any details in any of the texts I came across, but in theory the implementation could be that Windows sees the ID of the monitor once connected through any sort of connection, then when matching ID is found it installs the malware. Rather than the installer is sent from the monitor to the computer. Would make updates a lot easier, and if they really want to spread this malware, can activate it for a lot m…

Most commercial solutions are Windows-based and use the Windows API. HDMI and DP also have two-way communication channels. This is something you learn when you do hardware coding.(Of course you already know this, but this is for the other people reading this comment.)

Typically, the Windows update server downloads packages mapped to hardware IDs in the background. Since LG's business in Korea has been failing and their AI efforts are stagnating, they exploited their McAfee partnership marketing as a pipeline. Windows' Plug and Play does make development convenient. The DX experience is good.

Linux is quite fragmented. That's good from a 'my computer' perspective, but not from a 'product' perspective. And then there's the jitter issue. Windows has stable paid solutions, while Linux has version discrepancies.

In fact, the reason Linux is considered secure is simply because hardware vendors haven't standardized enough to build automatic deployment pipelines.

In programming terms, we all know singleton is bad, but for Plug and Play, it's overwhelmingly convenient.

Re: LG monitors silently install software through Windows Update without consent

#53
post #13

Why do people even install 'drivers' for things like monitors. (Or usb devices running 'standard' protocols). The OS handles these just fine by itself.

In this case, they aren't. I woke up the other day to a notification that my LG monitor driver was installed, with a little window on how to use the on-screen crap. Absolutely useless, since the buttons for the monitor are right there on the bottom of it, and probably easier to use than the software.

Indeed, our Windows 11 offline Steam box also needed to disable LG & Switch App in taskmanager, and set LG apps to manual start in Services.

Apparently the 3 applications have some sort of screen partitioning/sharing capabilities, but it is still unclear if the LG App was remote access or not.

So far, LG is earning a lot of justified bad press. Should have returned it when I had to turn off the screens power-save mode to get it to stop fading out randomly. =3

Re: LG monitors silently install software through Windows Update without consent

#54

[Laughs in Linux/BSD]

I don't know about the BSDs but in Linux the reason is that a volunteer (in principle it could be a paid employee, I guess maybe it is for RHEL etc?) decides what gets installed

It is absolutely possible that when you plug in an LG display it installs and runs software on your Linux system†, just that rather than "Somebody at LG who earned a bonus" the decision maker was Sara in Portugal who fat fingered a change when trying to make a Python script for a PCI digital TV receiver work properly on 32-bit.

It does feel more like an amusing mistake in that case whereas even if LG tells us it's a mistake we know it was to earn $$$.

† Obviously YMMV but such "plug and play" features are commonplace because they're useful

Re: LG monitors silently install software through Windows Update without consent

#56
post #18

And Razer, Logitech, nvidia and everyone else who has it's driver package accepted into WU. No, you can't have a "(o) just the driver" checkbox because... honestly there are a lot of reasons and the device manufacturers are the guys who demand that in the first place.

With the quality of that software, it wouldn’t surprise me if the driver didn’t work without the userspace app at all. The GeForce experience at least you can disable, but if you have any branded components getting all of their management software off your PC is incredibly difficult

Logitech M720 Triathlon is currently listed €64,99 at their site.

The "programmable buttons" on it works through the user space app which is needs to be running in order to intercept and replace the button actions.

No app running? No replace.

App is stalling because the CPU was busy? No replace. (EDIT: or no action at all, lol)

Is €65 mouse could store the less than a 1 kilobyte of the settings on itself? Of course not.

On a third day I just turned it off and went for the other vendor altogether.

To add an insult to an injury I knew the software would be mess so I installed it on a notebook relegated for the 2nd line duties. Less than a year later the notebook started to cry what there is no space left on the disk - which was quite strange because there was nothing what would fill up quite a plenty of a free space.

Well, every month or two the Logi software (which I no longer even used because I didn't use the mouse) downloaded ~1GB update, stored the update, installed the update. Never cleaning up nor the updates nor the previous versions. Tens of GBs of a useless software just for the sake of the process.

Re: LG monitors silently install software through Windows Update without consent

#57
post #12

it's worth noting that the price of these monitors got cut in half due to this news -- great for the linux users out there

I don't feel like spending my money on some horrible corpo pulling out stuff like this, even if I've been using linux since 2006. Who can tell if they will do this to other OS in the future?

This is probably Windows pulling LG software through Windows Update bases in EDID. Linux won't ever do this BS.

Re: LG monitors silently install software through Windows Update without consent

#58

Earlier quoted context omitted.

Sounds like this malware gets installed even if you don't manually install anything. > Connecting some LG monitors to a Windows PC may automatically install software that promotes McAfee subscriptions I too have a LG monitor, but haven't booted Windows in some days, guess I'll stay put in my Arch environment until they've fixed this shitshow.

But this assumes you plug in USBC .... Right? HDMI and display port can't....install over right?

We have an offline account Windows 11 Steam box, and the stupid popup still hit our machine a few days back. It did ask for screen access (said no), but there is no obvious button to opt out of the adware popups (select don't show, and click X to close).

Disabled LG & Switch App in taskmanager auto start, and set to Manual for all 3 LG process names in Services.

A lot of bad karma, for such an buggy monitor that doesn't even work properly till you turn off the silly power-saver auto-dim mode. =3

Re: LG monitors silently install software through Windows Update without consent

#59
post #34

Earlier quoted context omitted.

> Americans are receiving more ads than in other parts of the world Ads aren't free, so yes, it would stand to reason that people in the largest consumer market in the world might garner more ad spend.

So because the US is the largest consumer market in the world, the TVs LG sell in the US has more ads in the UIs than TVs sold in Europe? Why would it be like that? If that theory is true, does that mean TVs sold in the European Union then have more ads than TVs sold in China, as the EU consumer market is larger than the China one?

> Why would it be like that?

Ads aren't free - this isn't a "theory," it's basic economics. Cost can be political (you cause the entire EU government to outlaw the practice) or monetary.

> If that theory is true, does that mean TVs sold in the European Union then have more ads than TVs sold in China

Probably? The markets have little overlap, but again, this is a function of cost. Where people have more money to spend, I have more money to spend on ads, or more money to spend on campaigning to be allowed to show ads.

Re: LG monitors silently install software through Windows Update without consent

#60
post #18

Earlier quoted context omitted.

With the quality of that software, it wouldn’t surprise me if the driver didn’t work without the userspace app at all. The GeForce experience at least you can disable, but if you have any branded components getting all of their management software off your PC is incredibly difficult

Logitech M720 Triathlon is currently listed €64,99 at their site. The "programmable buttons" on it works through the user space app which is needs to be running in order to intercept and replace the button actions. No app running? No replace. App is stalling because the CPU was busy? No replace. (EDIT: or no action at all, lol) Is €65 mouse could store the less than a 1 kilobyte of the settings on itself? Of course n…

I am very happy with my Triathlon, but I use the 3rd-party Linux software Solaar https://github.com/pwr-Solaar/Solaar
Post reply on HN