CAUGHT: Lenovo crams unremovable crapware into Windows laptops – by hiding it in the BIOS

@thames Re: When is a BIOS not a BIOS?

"It is open source, it's GPL so vendors can't add some proprietary "extra sauce" without releasing the source ..."

In an ideal world, that is true. We live in a less than ideal one though. Nowadays I'd only feel 'safe' if I could strip and analyse it myself or rely on a trusted review by an independent organisation.

Re: When is a BIOS not a BIOS?

"We need a WPBT table viewer - anyone?"

http://rweverything.com/download/

i use the above to get the win 8 key from the bios, but it has lots of other features. i dont know if it does what you want, but try it and see....i dont have a win 8 laptop at the mo to check...

Re: When is a BIOS not a BIOS?

That would require someone in Government who even understands what the problem is... no hope in UK then.... they are just a bunch of ignorant oldies who's kids use the internet... and who themselves think that IT is something to do with Candy Crush (played on ipads during work time).

And the Police are all stupid.....

Generalising like that is incredibly dangerous, as it leads to deliberately underestimating a potential enemy/adversary. Yes, there are a lot of people in Politics and the Civil service that don't understand computers, just as the private sector is full of the same types of people, but working on the assumption that there's noone who understands is a bad idea.

You can be reasonably sure that the types employed by GCHQ do understand this, and the potential risks/benefits it presents (depending on what your aim is...), and if CESG or similar make a recommendation against using such kit, most departments will likely (at least half) bear that in mind.

"they are just a bunch of ignorant oldies"

My experience is that it is the oldies in government IT who understand the problems, or at least are suspicious of the possible problems, while the youngsters are too gung ho and enthusiastic about new stuff to even think of the risks.

Re: Windows only though

@Dr Paul Taylor The rookit code would still be in the BIOS, but without the corresponding rootkit calling code in Microsoft Windows to execute it, it would lay dormant there.

Re: Windows only though

Replying to my reply, that seems to be true for the Windows 7 autochk.exe method where the file is overwritten by the BIOS.

The Windows 8 and 10 wpbbin.exe method can't be disabled and gets past BitLocker but as it's Windows 8/10 itself which gets the file from the BIOS and runs it. So it seems if you must use Windows 8/10 there's nothing you can do to stop it.

The article seems to say the autochk.exe method and the wpbbin.exe method are part of one rootkit, but the autochk.exe method would be used by the BIOS if Windows 7 is detected and the wpbbin.exe method would be used by Windows 8/10 it checks the BIOS to see if this file is stored in it and if so writes it to the filesystem itself and runs it.

Re: Windows only though

Well it'll understand be confused it's not NTFS and not do anything or it'll corrupt the drive. Same for BitLocker partitions too I would have thought.

This is more likely.

Re: Windows only though

It could misunderstand ext4 as it tries to read it as NTFS and corrupt the filesystem if it's badly written.

Re: Windows only though

I guess the probability s that most people who will buy a windows PC for a Linux install, will probably want to try and dual boot. Certainly this was what i had in mind when I tried to install Linux variants (e.g. Ubuntu) on a some budget Lenovo E50 desktops. No amount of tweak and configuration/boot repair would allow Linux to boot....the UEFI boot order would always revert to Windows boot first, unless I crippled the windows boot altogether.

Re: Windows only though

Of course, there'd be nothing to stop lenovo or whoever adding an ext4 driver and a linux executable to their UEFI image so that they could compromise more than just windows. Just because it can't affect linux right now doesn't mean it won't eventually be co-opted by your friendly local UEFI supplier...

Be interesting if anyone out there knows how easy it is to modify a UEFI image to shoehorn this stuff in. Are all UEFI images typically cryptographically signed?

Re: Windows only though

It's complimentary to the process that allows you to install windows onto major vendor laptops without a key (the vendor authorization keys are stored in the bios in a similar manner).

Sounds like a well-intentioned feature that wasn't quite thought through properly. Another possible attack vector if you have physical access to the machine, and a really poor use of it by Lenovo.

@thames - Re: Windows only though

Nothing is hidden from the OS, with a rootkit stuff is hidden from the end-user.

Re: Windows only though

> I think the feature was a bit of a bad idea by Microsoft to begin with.

I suspect it's also the first step in Microsoft trying to provide the facility that Mac machines have - the ability for a bare-metal machine to do a full install from Apple via the Internet.

Of course, Apple has much tighter control over the hardware and firmware - Microsoft would have to trust that the OEM does a good job of making sure that all the relevent h/w drivers are also present to allow the machine to connect. And we all know how fully trustable the OEMs are eh?

Re: Windows only though

So is there a patch for WinX to stop the BIOS being tested and executed?

Then could install Win with the machine internet-free, patch it, then connect and do the post-install upgrades.

Re: Windows only though

The interesting question is.....how were Lenovo going to install any future driver or software updates? Presumably any subsequent updates would be overwritten and rolled back by the BIOS injection