upvote

points

by autoexec15 hours ago |
comments
upvoteby arein313 hours ago|
next
[-]
How can I be sure my lenovo laptop is safe? I have a clean install, but should I dump the motherboard firmware and ask ai to decompile it? Is there another place they could hide bloatware? Besides main storage / motherboard firmware?

Should I check network card firmware?) Maybe they added a rule to forward certain instructions to the OS embedded in the CPU

reply
upvoteby wang_li11 hours ago|
parent|
next
[-]
They can hide it in your storage firmware. Sprites Mods attached a jtag to a consumer hard drive, identified the CPUs, dumped the firmware, modified it, wrote it back. When it sees a certain string in any write to the disk, it enters evil mode. Then whenever it sees something that looks like a unix password file, it substitutes it for some known value. As in, hit your webserver with the magic string in the query string portion of the request, then ssh to the box and log in with a known password. Reinstalling your OS does nothing for you since it's in the drive firmware. Also was able to reprogram the firmware online, not requiring physical access to the drive. But literally anything can be compromised. You could have DIMMs that look for magic bits and when they see them they substitute code so the nation state can have code running on your computer anytime they want. Your cpu could do the same. Once it seems some long ass string of bytes that have a particular checksum, it switches to ring 0 or ring -1 or smm mode.

https://spritesmods.com/?art=hddhack&page=1

reply
upvoteby TheDong3 hours ago|
parent|
next
[-]
That's a cool thought experiment, but it doesn't work in practice.

> When it sees a certain string in any write to the disk

dm-crypt or zfs encryption or any other commonly used encryption will encrypt the data before it's written to disk, so the disk controller will not be able to do anything with writes or reads since it will not have the encryption key.

reply
upvoteby close041 hours ago|
parent|
next
[-]
The general point related to the topic of the article is that the many controllers running on your device (not limited to Lenovo BTW) are black boxes almost impossible to inspect. The encryption engine on a hardware encrypted USB stick is making everything even harder. It can implement something like this but it's probably made to be extremely difficult to dump the firmware or inspect the features implemented in silicon.

If I'm doing software encryption like dm-crypt or zfs encryption then I don't need to bother with hardware encryption too. It's easier to trust software encryption. We have many interoperable and even open source implementations of the same encryption methods, the output is readable in open formats, so they can be validated against each other if needed.

reply
upvoteby sandworm10148 minutes ago|
parent|
prev|
[-]
>> will encrypt the data before it's written to disk

The people buying much of these "hardware encryption" products do so because they believe it removes the need for software encryption to/from the device.

reply
upvoteby PorciiVorbesc11 hours ago|
parent|
prev|
[-]
>They can hide it in your storage firmware

Everything you wrote is not an exclusive Lenovo risk and vulnerability but applies to every piece of compute sold in the worlds.

reply
upvoteby autoexec10 hours ago|
parent|
[-]
True, but Lenovo has repeatedly demonstrated that they're willing to do it, lie to customers giving them a false sense of security while leaving them vulnerable, and will continue to put their customers at risk even after being caught several times.
reply
upvoteby daneel_w12 hours ago|
parent|
prev|
next
[-]
> How can I be sure my lenovo laptop is safe?

You cannot.

reply
upvoteby Krutonium11 hours ago|
parent|
prev|
[-]
Honestly that would be a decent way to become internet famous for a bit lol.
reply
upvoteby ksh0913 hours ago|
prev|
next
[-]
I thought lenovo is one of the most trustable laptop manufacturers, because of ThinkPad lineage.

say no more ig.

reply
upvoteby hansvm12 hours ago|
parent|
next
[-]
IIRC that changed when the company changed hands in 2010ish.
reply
upvoteby autoexec9 hours ago|
parent|
[-]
They were still pre-installing malware in people's systems in 2016. They were caught with a hardcoded password in their fingerprint scanner after that. In 2019 they still couldn't be trusted not to backdoor their devices, they released a alarm clock with a hard-coded SSH password. They are not a company any should be trusting with anything.
reply
upvoteby hansvm9 hours ago|
parent|
[-]
Sure? All of that seems post-2010ish. I think we're agreeing with each other, but placing that comment in response to mine instead of a different one gives off a different impression.
reply
upvoteby 8 hours ago|
parent|
[-]
deleted
reply
upvoteby lunar_rover10 hours ago|
parent|
prev|
next
[-]
Lenovo is still one of the big three, releasing actual verified hardware. I don't think secure hardware is a real thing in the PC world right now.
reply
upvoteby autoexec9 hours ago|
parent|
next
[-]
There's a world of difference between "we can't be sure that other companies won't backdoor our systems" and "We know for a fact that lenovo has done it multiple times and repeatedly lied to customers about it when found out and even once released a patch which they claimed fixed the problem but which actually still left their customers vulnerable."

All people are capable of being untrustworthy, but that doesn't make all people the same as those who have already demonstrated that they are.

reply
upvoteby lightedman6 hours ago|
parent|
prev|
[-]
"I don't think secure hardware is a real thing in the PC world right now."

It hasn't been in a looooooong time.

The first three layers of the OSI model are sorely neglected.

reply
upvoteby daneel_w12 hours ago|
parent|
prev|
[-]
That was sort of the case when the Thinkpad brand was owned by IBM up until the late 2000s, but Lenovo is a chinese company.
reply
upvoteby xbar7 hours ago|
prev|
next
[-]
Precisely. They gave up integrity so early after acquiring the ThinkPad brand as to be immediately unusable.
reply
upvoteby aucisson_masque12 hours ago|
prev|
[-]
Which company would you trust more tho ?
reply
upvoteby FranOntanaya12 hours ago|
parent|
next
[-]
Maybe Clevo, since they are more of an OEM producer for other brands meaning they don't control all the eyes on the hardware all the way to the sale point, i.e. to sneak things in.
reply
upvoteby Titan218912 hours ago|
parent|
[-]
Clev-who?
reply
upvoteby Krutonium11 hours ago|
parent|
[-]
White box OEM, they make like 80% of the laptops you can buy.
reply
upvoteby autoexec9 hours ago|
parent|
prev|
next
[-]
At this I can't think of anyone I'd trust less. People have their complaints about every manufacture, but as far as I know, none of them have a track record as bad and as consistent as levono. Personally, I'm looking at system76 and Framework for my next laptop.
reply
upvoteby skrtskrt7 hours ago|
parent|
[-]
System76 does not make their own laptops, it's all rebadged.

They said like 2 years ago they were working on one, but I have not heard much since.

reply
upvoteby solyin12 hours ago|
parent|
prev|
[-]
Who do you have to trust the least? The other two choices are Chromebooks and Macbooks, or some homegrown Linux solution. Of those, only Chromebooks are locked down to the point that you can't do anything with it unless you intentionally unlock it. Which means it's safe for some kinds of things but not others, depending on your threat model.
reply
upvoteby wormius8 hours ago|
parent|
[-]
Dell wept.
reply
upvoteby ahartmetz1 hours ago|
parent|
[-]
Dell is the one that may break, but their service is great. Next business day on site repair.

Maybe HP business stuff as well? HP are inconsistent, but some of their stuff is good. I've had an HP ZR24w screen with great picture quality that still works like new after 15 years and 30k hours. The ZBook G1a laptop ("mobile workstation in ultrabook form factor") also seems great so far, after a little under a year. Almost everything about it is very good, including the touchpad.

reply