Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LG monitors silently install software through Windows Update without consent

videocardz.com

Post reply on HN
Print view View original

81–90 of 671 posts

Re: LG monitors silently install software through Windows Update without consent

#81

Post by Findecanor »

devttyeu wrote: post #20

This is so much worse that the title makes it out to be: 1. Your OS installs malware (technically manufacturers software) from a 3rd party vendor in background, zero user interaction 2. Happens as soon as you or anyone with physical access plug in a device into the HDMI port 3. That malware has internet and full system access, no sandboxing 4. It starts with every system boot 5. This software gets installed when you…

A few years ago, plugging in a Razer USB mouse made Windows download and run a installer from which the current user could start PowerShell with administrator privileges. Razer first tried to downplay the issue, but fixed it later. [1]

The USB protocol does not have any authentication, just a VendorID/ProductID pair: 2×16 bits that Windows uses for looking up the driver package to install. Programming a MCU to use any VendorID/ProductID is straightforward. A USB device could even appear innocuous at first but after a timer or external trigger disconnect and reconnect masquerading as another device.

1. https://arstechnica.com/information-technology/2021/08/need-...

Re: LG monitors silently install software through Windows Update without consent

#82

Post by delusional »

motbus3 wrote: post #41

I am tired of this. LG is now on my blacklist alongside EA and Blizzard Entertainment for their anti consumer practices. I can't change them, I can't change policies about it. I can choose to not buy.

> Blizzard Entertainment

You mean "Microsoft Xbox Activision Blizzard King Bethesda Mojang"? I wish you luck with your boycott.

Re: LG monitors silently install software through Windows Update without consent

#83

Post by vladvasiliu »

Kelteseth wrote: post #29
devttyeu wrote: post #20

This is so much worse that the title makes it out to be: 1. Your OS installs malware (technically manufacturers software) from a 3rd party vendor in background, zero user interaction 2. Happens as soon as you or anyone with physical access plug in a device into the HDMI port 3. That malware has internet and full system access, no sandboxing 4. It starts with every system boot 5. This software gets installed when you…

It is the same when you plug in a Logitech mouse nowadays, no? At least they don't install McAfee

I have a logitech mouse and I'm pretty sure I was asked whether to install the logitech app, it didn't do it automatically. Same for the dell mouse I have at work, it asked to install dell somethingorother, which I declined, and it left me alone.

Re: LG monitors silently install software through Windows Update without consent

#84

Post by delta_p_delta_x »

Someone1234 wrote: post #64
delta_p_delta_x wrote: post #6

Workaround: gpedit.msc Computer Configuration > Administrative Templates > System > Device Installation Prevent automatic download of applications associated with device metadata Set to enabled OK On home editions sans gpedit.msc: sysdm.cpl Hardware tab Click Device Installation Settings Under 'Do you want to automatically download manufacturers' apps for your devices?', select 'No' Save Changes

Worth noting that gpedit.msc isn't included in Windows Home editions (although there are unsupported ways of adding it). This is also technically asking a lot for working around issues that shouldn't exist. Microsoft needs to intervene here, this cannot be a normal expectation for using their product.

Edited with another method.

Re: LG monitors silently install software through Windows Update without consent

#85

Post by sys_64738 »

kingleopold wrote: post #7

They used to call this spyware/malware. Now it's a regular practice by eng. teams and managers inside these big corp. Well played guys :) Congrats with new type of tricks

If it's not malware then what is it called today?

Re: LG monitors silently install software through Windows Update without consent

#86

Post by 15155 »

embedding-shape wrote: post #73
15155 wrote: post #59

Earlier quoted context omitted.

> Why would it be like that? Ads aren't free - this isn't a "theory," it's basic economics. Cost can be political (you cause the entire EU government to outlaw the practice) or monetary. > If that theory is true, does that mean TVs sold in the European Union then have more ads than TVs sold in China Probably? The markets have little overlap, but again, this is a function of cost. Where people have more money to spend…

> Probably? Spoiler: LG TVs sold in China also seem to have more ads than the LG TV we end up buying in Europe. Seemingly ( https://news.ycombinator.com/item?id=48957229 ) with Samsung it's the same. Even though EU is a larger consumer market than China, so obviously your theory doesn't hold, it's something else than "Bigger consumer markets === more ads in UIs in TVs".

> obviously your theory doesn't hold

Cost is my "theory." A larger market can sustain larger ad spend, and in some areas it's cheaper to make larger ad buys. Both are true.

Also, "larger market" obviously implies a category-specific qualifier. People in the United States might have more of an appetite for televisions than people without running water - news at 11.

> Spoiler: LG TVs sold in China also seem to have more ads than the LG TV we end up buying in Europe.

"Spoiler:" is an unnecessarily cunty way to lead a declaration of fact with zero objective accompanying evidence. Any citation you care to provide?

"More ads" is already a pretty subjective, ill-defined thing. More screen time? More individual advertisers? More unique advertisements? Larger screen area?

Re: LG monitors silently install software through Windows Update without consent

#87

Post by onaclov2000 »

embedding-shape wrote: post #43
onaclov2000 wrote: post #38

Earlier quoted context omitted.

But this assumes you plug in USBC .... Right? HDMI and display port can't....install over right?

I don't see any details in any of the texts I came across, but in theory the implementation could be that Windows sees the ID of the monitor once connected through any sort of connection, then when matching ID is found it installs the malware. Rather than the installer is sent from the monitor to the computer. Would make updates a lot easier, and if they really want to spread this malware, can activate it for a lot m…

That makes some sense to me, I think for some reason my brain assumed they were like actively controlling the PC to download things other than updates, (and low key assumed part of this update was supposed to be for software on the monitor not the desktop)

Re: LG monitors silently install software through Windows Update without consent

#88

Post by delusional »

leni536 wrote: post #57
Gualdrapo wrote: post #46

Earlier quoted context omitted.

I don't feel like spending my money on some horrible corpo pulling out stuff like this, even if I've been using linux since 2006. Who can tell if they will do this to other OS in the future?

This is probably Windows pulling LG software through Windows Update bases in EDID. Linux won't ever do this BS.

I wouldn't be so categorical. This isn't really a kernel concern, and I could completely believe that there are some distros out there that pull in random packages based on hardware detection.

The saving grace of linux currently is that volunteers package most of the software, and they don't generally package malware. There is no structural guarantee there, and if we invite corporate interests to package at some point (like flatpack and snap wants to) this is 100% going to happen eventually.

Re: LG monitors silently install software through Windows Update without consent

#89

Post by vladvasiliu »

tialaramex wrote: post #30

Assuming they don't get a revenue cut, pushing back on Microsoft can in principle be effective here. Microsoft decides what happens here, and presumably today they just take it on trust that hardware makers know what software to install. New driver? Sure. McSpam installer? OK. Maybe they have a guideline saying "Don't ship unrelated garbage" but today it's not enforced because why would you do that? If the Microsoft…

The issue is that most corps disable Windows Update and only allow whatever goes through the on-prem Windows Update thingy. This can, of course, fire back if they don't think to include all the updates. We had one such issue where they didn't provide an up-to-date Intel driver for the Wi-Fi cards, and the version we had was a bit broken...

But the point is that companies will probably not complain about this because they'll most likely not see it. Also, they're used to Windows being generally crappy.

Re: LG monitors silently install software through Windows Update without consent

#90

Post by sys_64738 »

justsomehnguy wrote: post #4

And Razer, Logitech, nvidia and everyone else who has it's driver package accepted into WU. No, you can't have a "(o) just the driver" checkbox because... honestly there are a lot of reasons and the device manufacturers are the guys who demand that in the first place.

I avoid installing Logitech spyware on my Mac but there are FLOSS apps to do the equivalent. There's even a pairing FLOSS app for Linux to avoid installing Logitech spyware. FLOSS is amazing. LinearMouse is the Mac app.
Post reply on HN