Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LG monitors silently install software through Windows Update without consent

videocardz.com

Post reply on HN
Print view View original

271–280 of 671 posts

Re: LG monitors silently install software through Windows Update without consent

#271

Post by clickety_clack »

yndoendo wrote: post #265
orbital-decay wrote: post #128

Earlier quoted context omitted.

>This situation has.. no precedent as far as I can tell.. Printer, mouse, tablet and display tablet makers use this to insert their crapware since at least Windows Vista or Windows 7, I think. The last one I remember is plugging a Razer mouse just to watch it instantly pulling 1.5GB of bloated junk with "telemetry" exfiltrating the data from my gaming PC in realtime. At least it doesn't leave my mouse in a non-workin…

Back in my Window days. I would start the driver installation and let it sit. Open the temp folder and copy content the install extracted to a new directory. Cancel the installation. Open Device Manager and install the drivers from there so non of the excessive bloat was installed. This worked greater with being an IT consultant. The client's machine to run smoother and drivers installed fast since they would buy mul…

These days, even a window gets updates.

Re: LG monitors silently install software through Windows Update without consent

#273

Post by r1ch »

MaxL93 wrote: post #250
rkourdis wrote: post #219

Earlier quoted context omitted.

I had a mouse that would keep on installing its driver when plugged in, even with this setting off. I remember Windows keeping a cache of autodownloaded drivers ("Driver Store") and reinstalling them when the device is plugged in, so the mouse bloatware kept on coming back. Is this still the case?

You have to add keys under: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions The keys I have right now are all REG_SZ (strings), and in order of "1" through "5", are: --- 1. SWC\VEN_DELL&DEV_AWCC 2. SWC\VID_DELL&PID_AWCC 3. SWC\Alienware_Command_Center 4. SWC\AWCC 5. SWC\VID001&PID0001&AWCCWINUI3APP --- Nothing short of this prevented "Alienware Command Center" (AWCC.exe) fro…

Even that isn't sufficient - I've been using this for years and every so often AWCC still manages to get through. The only 100% protection from it is to use Image File Execution Options to match on the installer name to prevent it from ever running.

Re: LG monitors silently install software through Windows Update without consent

#274

Post by Findecanor »

globalnode wrote: post #194
Findecanor wrote: post #81

Earlier quoted context omitted.

A few years ago, plugging in a Razer USB mouse made Windows download and run a installer from which the current user could start PowerShell with administrator privileges. Razer first tried to downplay the issue, but fixed it later. [1] The USB protocol does not have any authentication, just a VendorID/ProductID pair: 2×16 bits that Windows uses for looking up the driver package to install. Programming a MCU to use an…

not a usb programmer, but are you saying i can buy any old usb chip and program it with any vendors ID and spoof windows into giving me admin? if so, gj micrcosoft.

You could use any programmable microcontroller with a USB interface. Consumer products tend to have fuses set to they can't be programmed again.

The latest driver registered with Microsoft for the product you're going to spoof would need to have a vulnerability to exploit. You can't supply any driver.

Re: LG monitors silently install software through Windows Update without consent

#275

Post by [deleted] »

devttyeu wrote: post #20

This is so much worse that the title makes it out to be: 1. Your OS installs malware (technically manufacturers software) from a 3rd party vendor in background, zero user interaction 2. Happens as soon as you or anyone with physical access plug in a device into the HDMI port 3. That malware has internet and full system access, no sandboxing 4. It starts with every system boot 5. This software gets installed when you…

[deleted]

Re: LG monitors silently install software through Windows Update without consent

#276

Post by warshinder »

phikappa wrote: post #182
Geezus_42 wrote: post #125

Earlier quoted context omitted.

Much like your own, and this one!

I wonder if this ritual of meta-self-policing serves some particular purpose or if it's just a case of the brain drawing comfort from going through a familiar ritual. "This comment adds nothing" is like the reverse amen in church of our days.

Another example of context collapse. Meta-meta commenting always adds something if only unironically.

Re: LG monitors silently install software through Windows Update without consent

#277

Post by tosti »

MatejKafka wrote: post #243
globalnode wrote: post #194

Earlier quoted context omitted.

not a usb programmer, but are you saying i can buy any old usb chip and program it with any vendors ID and spoof windows into giving me admin? if so, gj micrcosoft.

You can "spoof" any system where you can load older drivers into giving you admin/root, you just need to find a vulnerable driver. Nothing Windows-specific in that.

Also, disabling drivers from windows update is enforceable with group policy (iirc).

The BSDs have config, Linux can run without module support.

Re: LG monitors silently install software through Windows Update without consent

#278

Post by orblivion »

devttyeu wrote: post #20

This is so much worse that the title makes it out to be: 1. Your OS installs malware (technically manufacturers software) from a 3rd party vendor in background, zero user interaction 2. Happens as soon as you or anyone with physical access plug in a device into the HDMI port 3. That malware has internet and full system access, no sandboxing 4. It starts with every system boot 5. This software gets installed when you…

Thank you for the summary. As a Linux user, am I spared because of relative obscurity, or is it that Microsoft is explicitly allowing this to happen?

Re: LG monitors silently install software through Windows Update without consent

#279

Post by xahrepap »

devttyeu wrote: post #20

This is so much worse that the title makes it out to be: 1. Your OS installs malware (technically manufacturers software) from a 3rd party vendor in background, zero user interaction 2. Happens as soon as you or anyone with physical access plug in a device into the HDMI port 3. That malware has internet and full system access, no sandboxing 4. It starts with every system boot 5. This software gets installed when you…

I have a windows computer that tries to install HP Printer software automatically because it detects an HP printer on the WiFi. No physical access needed

Re: LG monitors silently install software through Windows Update without consent

#280

Post by warshinder »

delta_p_delta_x wrote: post #251
ikidd wrote: post #229

Earlier quoted context omitted.

I've gotten to the point that if you're trying to show me something and I see you're using Windows, I just assume you're an unserious person and it's worthless. All the major tools for advanced work are Linux-based, and there's maybe a Windows version, but it's probably a kludge like Docker Desktop.

> All the major tools for advanced work are Linux-based No, they aren't. Linux hasn't yet got anything remotely close to PDB symbol servers and WinDbg's record-replay debugging. perf is... an attempt. Source: worked on Windows and Linux drivers and user-mode applications. Windows tooling blows the competition out of the water in actually advanced developer experience. Vim is cool to the ricing hackerman types but not…

I know you’re joking, but there is a very small sliver of truth in there somewhere. There are some tools on windows that stand shoulder to shoulder with better os’s.
Post reply on HN