Lenovo PCs and Laptops seem to have a BIOS level backdoor

The Chinese computer and laptop maker, Lenovo is once again in the eye of the storm after users have found that their PCs/Laptops are shipped with a hidden backdoor at the BIOS level. Earlier in the year, it was found that all Lenovo PCs/Laptops are shipped with a spyware called Superfish.

Source: TechWorm

Well, that certainly looks like a nasty one. This is strike two for Lenovo this year. I would say that at this point they've lost all credibility... no way to pretend that this was just an unfortunate accident.

Yes, Lenovo certainly seem to know how to shoot themselves in the foot, a trait that is becoming all too common for many producers, who seem to have little or no respect for the intelligence of their customers.

Turns out this is not only a nuisance but a security hole as well. Lenovo calls this BIOS "feature" Lenovo Service Engine (LSE) and they released a BIOS update to remove or disable it due to security vulnerabilities that were found.

As a result of these findings, Microsoft recently released updated security guidelines (see page 10 of this linked PDF) on how to best implement this Windows BIOS feature. Lenovo’s use of LSE was not consistent with these new guidelines. As a result, LSE is no longer being installed on Lenovo systems. It is strongly recommended that customers update their systems with the new BIOS firmware which disables and or removes this feature.

Source: Lenovo News Releases

The security advisories (Notebook / Desktop) for this vulnerability were released at the end of July.

Because this update isn't pushed out automatically, Lenovo users should check either the news release or the relevant security advisory to see if they are vulnerable, and if so update their BIOS (the security advisories have instructions how to do so). Note that Think-branded PC's do not have the LSE software installed in the BIOS.

Funny quote from the Notebook advisory:

Lenovo Service Engine (LSE) is a utility in the BIOS that helps users download a program called OneKey Optimizer (http://support.lenovo.com/us/en/downloads/ds101321) on certain Lenovo Notebook systems.

Very helpful indeed.

It beggars belief that any producer could be as irresponsible as to provide an easy way into the BIOS.

For years malware writers have looked for a way into a system that would not get removed by a reformat, ie a BIOS level attack. However, because of strict BIOS security they have not been able to find a reliable way to perform one. Now the idiots at Lenovo do the work for them.

It would appear that there is no shortage of stupidity at Lenovo these days. Pity... they used to make a nice laptop. Now I wouldn't touch one with the proverbial 10-foot pole.
Will they never learn?

I certainly wouldn't buy a Lenovo machine, and I'd definitely steer any friends or family away from one if they were thinking of purchasing it.

No doubt the conspiracists will believe this backdoor was put in place at behest of the Chinese Government, and who knows they may be right, but it's more likely to be just stupidity, since so few manufacturers ever think about the security implications of anything they do to "make things easier" for themselves.

"NonSuch" wrote:This is strike two for Lenovo this year.

I would call it strike three but it depends on if you are counting security screw ups or just shady business practices. Around the same times as the Superfish debacle the Android community was upset with Motorola for violating the GPL and not releasing kernel sources. The GPL violations started shortly after Motorola was acquired by Lenovo.

"Gary R" wrote:I certainly wouldn't buy a Lenovo machine, and I'd definitely steer any friends or family away from one if they were thinking of purchasing it.

My mom and sister recently bought new laptops and when they asked what brand was best I told them anything but Lenovo.

I recently bought a little Notebook for my son, for school and it was NOT a Lenova.

I think I see a pattern developing here.

LeNOva... they put the NO in laptops!

In franglais a crude interpretation of LeNoVa might be considered to be ... the no goto ... which is also pretty appropriate.