Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LG monitors silently install software through Windows Update without consent

videocardz.com

Post reply on HN
Print view View original

61–70 of 671 posts

Re: LG monitors silently install software through Windows Update without consent

#61

Post by zahlman »

jdw64 wrote: post #52
embedding-shape wrote: post #43

Earlier quoted context omitted.

I don't see any details in any of the texts I came across, but in theory the implementation could be that Windows sees the ID of the monitor once connected through any sort of connection, then when matching ID is found it installs the malware. Rather than the installer is sent from the monitor to the computer. Would make updates a lot easier, and if they really want to spread this malware, can activate it for a lot m…

Most commercial solutions are Windows-based and use the Windows API. HDMI and DP also have two-way communication channels. This is something you learn when you do hardware coding.(Of course you already know this, but this is for the other people reading this comment.) Typically, the Windows update server downloads packages mapped to hardware IDs in the background. Since LG's business in Korea has been failing and the…

> simply because hardware vendors haven't standardized enough to build automatic deployment pipelines

Wouldn't it require cooperation from the distros anyway? You say "HDMI and DP also have two-way communication channels", but that doesn't force the OS to communicate over those channels. And it also doesn't force the "mapping of packages to hardware IDs" to be what the hardware manufacturer wants it to be.

Re: LG monitors silently install software through Windows Update without consent

#62

Post by ptx »

Gualdrapo wrote: post #46
dhash wrote: post #12

it's worth noting that the price of these monitors got cut in half due to this news -- great for the linux users out there

I don't feel like spending my money on some horrible corpo pulling out stuff like this, even if I've been using linux since 2006. Who can tell if they will do this to other OS in the future?

My understanding is that the monitor doesn't do anything by itself - it's just Windows detecting the device and automatically downloading and installing LG:s proprietary add-on software. The monitor itself isn't attacking the machine by exploiting vulnerabilities or spoofing user input or anything like that.

So you won't have this problem if you're running Linux and other Free Software under your own control. The problem in this case is just another example of why proprietary software can't be trusted.

Re: LG monitors silently install software through Windows Update without consent

#64

Post by Someone1234 »

delta_p_delta_x wrote: post #6

Workaround: gpedit.msc Computer Configuration > Administrative Templates > System > Device Installation Prevent automatic download of applications associated with device metadata Set to enabled OK On home editions sans gpedit.msc: sysdm.cpl Hardware tab Click Device Installation Settings Under 'Do you want to automatically download manufacturers' apps for your devices?', select 'No' Save Changes

Worth noting that gpedit.msc isn't included in Windows Home editions (although there are unsupported ways of adding it). This is also technically asking a lot for working around issues that shouldn't exist.

Microsoft needs to intervene here, this cannot be a normal expectation for using their product.

Re: LG monitors silently install software through Windows Update without consent

#65

Post by rbanffy »

raverbashing wrote: post #37
tialaramex wrote: post #30

Assuming they don't get a revenue cut, pushing back on Microsoft can in principle be effective here. Microsoft decides what happens here, and presumably today they just take it on trust that hardware makers know what software to install. New driver? Sure. McSpam installer? OK. Maybe they have a guideline saying "Don't ship unrelated garbage" but today it's not enforced because why would you do that? If the Microsoft…

Honestly yeah MS should get all the flack (which is mostly deserved) of this Manufacturer does whatever crap they want with "it works" and then MS gets the complaints A driver should only be that. A driver

> A driver should only be that. A driver

I still remember the massive amounts of crapware installed with video cards, printers (hello, HP), and just about anything where the manufacturer can squeeze some money from.

Re: LG monitors silently install software through Windows Update without consent

#66

Post by throwa356262 »

embedding-shape wrote: post #48
throwa356262 wrote: post #35

Earlier quoted context omitted.

In general, yes. But in case of LG TVs, they record your activities in EU too. You can opt out, but the settings has a very non-descriptive name ("live plus") and resets by itself when you are not looking. https://www.consumerreports.org/electronics/privacy/how-to-t...

Right, I'm wondering about the amount of ads though.

No, I think the ads are limited to own services and third party apps right now. Same goes for Samsung in EU.

Re: LG monitors silently install software through Windows Update without consent

#67

Post by microtonal »

throwa356262 wrote: post #49
BoingBoomTschak wrote: post #8

[Laughs in Linux/BSD]

HN doesn't like your tone and you are being down voted. But in general you are correct, Linux and bsd users are less affected by such shenanigans. Short personal story: I had a win10 machine were HP kept installing some "analytics" service. This happened even on a clean windows install so I guess they used the same delivery mechanism LG is using here. After having read the HP ToS (where they basically gave themselves…

But in general you are correct, Linux and bsd users are less affected by such shenanigans.

Mac users too (at least for now).

Re: LG monitors silently install software through Windows Update without consent

#68

Post by Someone1234 »

onaclov2000 wrote: post #38
embedding-shape wrote: post #17

Earlier quoted context omitted.

Sounds like this malware gets installed even if you don't manually install anything. > Connecting some LG monitors to a Windows PC may automatically install software that promotes McAfee subscriptions I too have a LG monitor, but haven't booted Windows in some days, guess I'll stay put in my Arch environment until they've fixed this shitshow.

But this assumes you plug in USBC .... Right? HDMI and display port can't....install over right?

The monitor itself isn't installing anything, Windows detects the device by unique ID, and uses Windows Update to get the driver which itself triggers a Windows Store application (malware) to install.

The monitor only sends a unique device ID, everything else is handled by Windows.

Re: LG monitors silently install software through Windows Update without consent

#69

Post by maccard »

justsomehnguy wrote: post #56
maccard wrote: post #18

Earlier quoted context omitted.

With the quality of that software, it wouldn’t surprise me if the driver didn’t work without the userspace app at all. The GeForce experience at least you can disable, but if you have any branded components getting all of their management software off your PC is incredibly difficult

Logitech M720 Triathlon is currently listed €64,99 at their site. The "programmable buttons" on it works through the user space app which is needs to be running in order to intercept and replace the button actions. No app running? No replace. App is stalling because the CPU was busy? No replace. (EDIT: or no action at all, lol) Is €65 mouse could store the less than a 1 kilobyte of the settings on itself? Of course n…

The logitech software is absolutely awful. All of the functionality is on device, but you can manage it with https://logiwebconnect.com/ instead. I’ve used Logitech mice as my daily driver for years with this.

Re: LG monitors silently install software through Windows Update without consent

#70

Post by jdw64 »

zahlman wrote: post #61
jdw64 wrote: post #52

Earlier quoted context omitted.

Most commercial solutions are Windows-based and use the Windows API. HDMI and DP also have two-way communication channels. This is something you learn when you do hardware coding.(Of course you already know this, but this is for the other people reading this comment.) Typically, the Windows update server downloads packages mapped to hardware IDs in the background. Since LG's business in Korea has been failing and the…

> simply because hardware vendors haven't standardized enough to build automatic deployment pipelines Wouldn't it require cooperation from the distros anyway? You say "HDMI and DP also have two-way communication channels", but that doesn't force the OS to communicate over those channels. And it also doesn't force the "mapping of packages to hardware IDs" to be what the hardware manufacturer wants it to be.

Your point is idealistically correct, but realistically it's not. Because when people install Windows, they don't want to go through the process of installing drivers for other hardware devices. And usually the driver versions depend on the OS version too.

Right away, with numerous distributions like Ubuntu and Arch, it's hard to account for all the possible cases from a production standpoint. But Windows has very few versions. As long as you pass Microsoft's standard specification, it just runs on Windows. That difference is huge. What you're saying is ideal, but when selling a product, time is money.

In other words, to summarize our conversation:

'As you said, separating them is the right thing to do. But UX Uesrs basically wanted that kind of deployment authority, and in the process, the problem of abusing it arose.'

It's a beginner level problem, but at the same time, it's also a difficult one.

Post reply on HN