Spyware found in Lenovo laptop BIOS

[cameo]

Just saw the same AP article in my local paper:

http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html

That will probably hurt their business.

[Stormin' Norman]

Post by cameo
http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html
That will probably hurt their business.

Where did you read it was incorporated into the BIOS?

[cameo]

Post by Stormin' Norman

Post by cameo
http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html
That will probably hurt their business.

Where did you read it was incorporated into the BIOS?

Shoot, I sent the wrong link. Here is the other one:

http://bits.blogs.nytimes.com/2015/02/22/lenovo-and-superfish-penetrate-the-heart-of-a-computers-security/

[Paul]

Post by cameo
http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html
That will probably hurt their business.

It's a removable program, plus a certificate that
needs to be removed from some sort of certificate store.

And Lenovo is supposed to be providing a removal tool.
But I haven't seen any comments yet as to how good
a job that is doing.

Removing Superfish from Programs and features, wouldn't
be enough. The certificate must also be removed. There are
web sites with pictures of what to do.

*******

There have also been BIOS based issues on laptops,
caused by the BIOS component of Computrace. But this
is a different issue. There were some laptops, where
the associated Windows software was not installed, but
a part of it was working anyway.

http://en.wikipedia.org/wiki/CompuTrace

http://www.computerworld.com/article/2476651/malware-vulnerabilities/your-pc-or-laptop-may-have-a-backdoor-enabled-by-default-millions-do.html

Paul

[Wolf K]

Post by Paul

Post by cameo
http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html
That will probably hurt their business.

It's a removable program, plus a certificate that
needs to be removed from some sort of certificate store.

To check if you're vulnerable (test with all installed browsers):
https://filippo.io/Badfish/

Advise on how to remove:
security.stackexchange.com/questions/82056/how-to-detect-if-i-am-vulnerable-to-superfish-and-how-to-remove-it

[...]

Post by Paul
Paul

[Boscoe]

Post by cameo
http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html
That will probably hurt their business.

Here's another, probably more sinister...


<http://www.telegraph.co.uk/news/worldnews/northamerica/usa/11416985/Millions-of-computers-may-be-compromised-by-US-spyware-report.html>

[cameo]

Post by Boscoe

Post by cameo
http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html
That will probably hurt their business.

Here's another, probably more sinister...
<http://www.telegraph.co.uk/news/worldnews/northamerica/usa/11416985/Millions-of-computers-may-be-compromised-by-US-spyware-report.html>

Well, in the above link this is a bit bothersome:

"The closely-guarded programme was discovered by Kaspersky Lab, the
Moscow-based security software maker that has exposed a series of
Western cyber-espionage operations."

Kaspersky works for Putin, so they only "discover" stuff that does not
show Moscow in bad light. I still worry less about NSA spying than about
Russian and Chinese spying.

[Shadow]

I still worry less about NSA spying than about Russian and Chinese spying.

Why ?
[]'s

[Wolf K]

I still worry less about NSA spying than about Russian and Chinese spying.

Why ?
[]'s

Team loyalty.

[cameo]

Post by Wolf K

I still worry less about NSA spying than about Russian and Chinese spying.

Why ?
[]'s

Team loyalty.

You've got it. Besides, so far I have not seen our side trying to
destroy Chinese power distribution infrastructure the way they have been
trying ours. So there is no symmetry there.

[Shadow]

Post by Wolf K

I still worry less about NSA spying than about Russian and Chinese spying.

Why ?
[]'s

Team loyalty.

That becomes moot when you can't be certain who your "team"
is.... the ones that put you on no-fly lists for a joke you posted, or
don't let you have a job because of something you said when you were a
teen, or those that just record information.
Crooks and governments are becoming very hard to distinguish
from one another.
[]'s

[(PeteCresswell)]

Post by Shadow
the ones that put you on no-fly lists for a joke you posted,

Or on the "Extended Search" list for documentary movie that you made....
as in the case of Laura Poitras.

[Jason]

Post by cameo
http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html
That will probably hurt their business.

The articles I read on this didn't give me a very good feeling about
their authors... Some said it was an infected BIOS but others reported
HD microcode infections. Which is it?

[Shadow]

Post by Jason

Post by cameo
http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html
That will probably hurt their business.

The articles I read on this didn't give me a very good feeling about
their authors... Some said it was an infected BIOS but others reported
HD microcode infections. Which is it?

Same thing. The HD has firmware (call it a "bios") made of
microcode. Some manufacturers offer updates to the codes (i.e. you can
flash your HD to a new version). Check out the Seagate site and read
all about it.
[]'s

[Paul]

Post by Jason

Post by cameo
http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html
That will probably hurt their business.

The articles I read on this didn't give me a very good feeling about
their authors... Some said it was an infected BIOS but others reported
HD microcode infections. Which is it?

You're mixing up your articles.

There are three that come to mind.

1) Computrace/Lojack for laptops. There is a BIOS component, which
is part of tracking stolen laptops. On the affected machines,
it is "accidently activated", even though the customer did not
pay for the Windows portion of the installation. This added code
in the BIOS, is able to "call home" and infect the Windows installation
each time (so that even if you re-install Windows on a clean hard drive),
the BIOS feature can still get in.

If that had been working properly, the BIOS portion wouldn't be
doing anything, unless the customer had installed the Windows
portion of it.

2) NSA and hard drives. NSA was discovered hijacking shipments of
hard drives, and changing the firmware in the hard drive. This
allows the hard drive to alter or offer additional code when
Windows is booting.

Firmware on a hard drive can be "flashed", but there is a good
chance the actual code is stored on the platter itself. The hard
drive firmware is in two pieces - bootstrap code inside the
controller chip (no external PROM), plus the main operational
code stored on the platter.

Shipments of hard drives not intercepted by the NSA, don't
have that code on them. They did not enter the hard drive
factory, and cause all the hard drives to be infected. Only
the drives headed to certain countries.

3) Lenovo and Superfish program (cruftware) plus Superfish
SSL certificate. The Superfish program should be removed,
as well as the bogus certificate. There is a list of
affected laptops or tablets. If you didn't trust Lenovo,
simply reinstalling the OS (nuke and pave) from a Microsoft DVD,
removes all trace of the problem.

(1) and (2) are going to be harder to deal with.

The Lenovo one (3), calls into question Lenovo technical skills
(clueless).

Paul

[Jason]

Post by Paul

Post by Jason

Post by cameo
http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html
That will probably hurt their business.

The articles I read on this didn't give me a very good feeling about
their authors... Some said it was an infected BIOS but others reported
HD microcode infections. Which is it?

You're mixing up your articles.

Not the first time... Thanks.

I have to wonder, what happens if all trust in the integrity of our
computing platforms is suspect?

[Paul]

Post by Jason
I have to wonder, what happens if all trust in the integrity of our
computing platforms is suspect?

Um, we lost that a long time ago.

Have you read the case of the security researcher, who
keeps getting infected over and over again ? He can't
figure out how it is getting in, but there are some
pretty wild theories as to how machines are communicating
with one another. When you read that thread,
you'll lose all hope.

They can mess these machines up bad enough, that they
can't be disinfected. Computers have lots of firmware
devices (NAND flash), so there are plenty of places for
stuff to get in. That security researcher could add
a new computer to his network, and it would be
infected in minutes. And he's not even sure if
someone did this on purpose (targeted attack),
or he is just collateral damage.

And that's really the only protection we have,
is the actors doing these things, don't want
to "waste their ammunition" on everybody. The
serious attacks are more targeted. Script kiddies
don't usually have the "good stuff" that
governments have. The government malware
likely calls home, so the control server
can tell it to politely exit, or tell
it to take over.

I'm not particularly surprised by the "NSA and
hard drive story". It could just as easily
be done with motherboard BIOS, without too much
trouble. And the Computrace product (whitehat)
doesn't really seem that much different than
a blackhat effort. It's pretty hard to tell the
good guys from the bad guys, when the all use
the same techniques. For example, that AV software
you use, is in many ways a "root kit". But it's
a root kit invented by a White Hat.

Oh. I see that I'm being port scanned, so I have to go...

Paul

[Jason]

Post by Paul
Oh. I see that I'm being port scanned, so I have to go...
Paul

LOL!

[Shadow]

Post by Paul
Oh. I see that I'm being port scanned, so I have to go...

;)
Port knocked or port scanned ?
there is a difference...
[]'s

[Paul]

Post by Shadow

Post by Paul
Oh. I see that I'm being port scanned, so I have to go...

;)
Port knocked or port scanned ?
there is a difference...
[]'s

It's an activity that leaves a log entry in the
router, but I can't be certain that the classification
features of the router are that good.

Whatever the activity is, if one packet is sent every
twenty seconds, the router might not make a log entry.
Whereas, if there are twenty packets a second, I
see a report of a "twinge attack". But whether it is
actually a twinge attack, I don't really know. It's
pretty hard to judge how good of a design is done
for $39.95 routers.

One other poster who used my previous ISP, used to
see unsolicited Google traffic, and for relatively
long periods of time (he was apparently logging WAN
traffic somehow). You'd think if they were
looking for web servers, it wouldn't take that
many packets before they could "move on".

One other correlation data-point. When the router
was set up for NTP from pool.org, I was seeing more
of this activity, than with NTP disabled. Suggesting
that contacting a pool.org machine (a large collection
of "donated" NTP services), I would start getting
unsolicited packets back from them (whatever machine
answered). Again, I don't know what they're sending,
but presumably it has nothing to do with NTP.

Paul

[Shadow]

Post by Paul

Post by Shadow

Post by Paul
Oh. I see that I'm being port scanned, so I have to go...

;)
Port knocked or port scanned ?
there is a difference...
[]'s

It's an activity that leaves a log entry in the
router, but I can't be certain that the classification
features of the router are that good.
Whatever the activity is, if one packet is sent every
twenty seconds, the router might not make a log entry.
Whereas, if there are twenty packets a second, I
see a report of a "twinge attack". But whether it is
actually a twinge attack, I don't really know. It's
pretty hard to judge how good of a design is done
for $39.95 routers.
One other poster who used my previous ISP, used to
see unsolicited Google traffic, and for relatively
long periods of time (he was apparently logging WAN
traffic somehow). You'd think if they were
looking for web servers, it wouldn't take that
many packets before they could "move on".
One other correlation data-point. When the router
was set up for NTP from pool.org, I was seeing more
of this activity, than with NTP disabled. Suggesting
that contacting a pool.org machine (a large collection
of "donated" NTP services), I would start getting
unsolicited packets back from them (whatever machine
answered). Again, I don't know what they're sending,
but presumably it has nothing to do with NTP.

I meant port knocking as in "syn port 23, then syn port 115,
then port 223 then port 65 with an interval of 300 milliseconds, and
the backdoor opens on port 2000". (number made up). I call it knocking
because it's a "secret knock".
You're describing a nmap script kiddy's scan. Most firewalls
will drop and log them. You can adjust nmap's timings so the firewall
will not detect the activity. But I'm rambling. Nothing to do with
BIOS, unless it has a built-in backdoor.
[]'s

[Wolf K]

Post by Jason

Post by Paul

Post by Jason

Post by cameo
http://www.dispatch.com/content/stories/business/2015/02/20/0220-Spyware-Found-Installed-on-PCs-Made-by-Lenovo.html
That will probably hurt their business.

The articles I read on this didn't give me a very good feeling about
their authors... Some said it was an infected BIOS but others reported
HD microcode infections. Which is it?

You're mixing up your articles.

Not the first time... Thanks.
I have to wonder, what happens if all trust in the integrity of our
computing platforms is suspect?

Paranoia will reach self-destructive levels.