Lenovo on international security blacklist for firmware backdoors

[Feathers McGraw]

Hi all,

I was considering buying a Lenovo laptop, but I've just read this:

http://www.crn.com.au/News/351508,le...blacklist.aspx

and this (linked to in first article):

http://www.afr.com/p/technology/spy_...4bIA4ulCPqC7SL

I appeal to your superior intellect and experience:

The article(s) say that the backdoors are hardware/firmware based, "in lenovo chips". Does that makes it a problem regardless of OS? I was planning on using it as a Linux-only laptop.

I know I'm not exactly a high profile target, and if a security agency wanted to hack into my computer then they would almost certainly find a way, but the idea of doing this knowing that the computer would be vulnerable just doesn't sit well.

Feathers

[woodsmoke]

although I am sure that those who are more knowledgeable will chime in!

woodgrrsmoke

[Feathers McGraw]

although I am sure that those who are more knowledgeable will chime in!

woodgrrsmoke

Thanks

[SteveRiley]

The breathless reporting implies that there were some slow news days a few months ago, I guess.

My T520 was made in Taiwan; my wife's in Singapore. Sure, they have Chinese-sourced parts, but so does nearly every laptop made, including those from Dell and HP (which the article would lead a reader to believe are "safe" brands). If you want to avoid this "threat," limit your choices to brands that originate from South Korea (e.g. Samsung, LG) and Japan (e.g. Fujitsu).

I'm reminded of the similar negative opinions about Huawei. People love to write scareifying tripe about Huawei backdoors that connect directly to the Central Committee. Yet, mysteriously, no one has ever been able to supply a single gram of proof. Meanwhile, does it occur to anyone that the many cozy relationships between American corporations and the various $TLAs in our government may result in similar backdoors? Sure it does, we've discussed such things here at KFN multiple times.

[Feathers McGraw]

Thanks Steve.

I'm not quite sure what the "firmware" they're referring to is. Most Lenovo laptops I've looked at use Intel chips, and presumably anything embedded in the chip would affect loads of other laptops too. I can't think of any "chip" that's particularly Lenovo-specific. Perhaps they were talking about a vulnerability in the BIOS?

Then again, like you said, maybe they were just turning the rumour mill to fill space.

Might get one after all.

[SteveRiley]

Intel builds the CPU, the PCH, and the ICH. On BIOS machines, the firmware resides in the ICH. On UEFI, machines, the firmware resides in a separate firmware chip that may or may not be manufactured by Intel. The firmware chip is programmed by the laptop manufacturer at the factory.

Buy that Lenovo you want. They're the best laptops on the planet, IM(NS)HO.

[woodsmoke]

Thanks Steve. presumably anything embedded in the chip would affect loads of other laptops too. I can't think of any "chip" that's particularly Lenovo-specific.

ummm nope! lol............

I have had what appeared to be exactly the same "mother board", one in the left hand, and one in the right, and upon close inspection...........

found the same numbers with........"Mark 1 - mod 2, ver 3" sprayed in a VERY UNobtrusive place on the mobo!

Now, in almost all cases, and that is ALL cases, bar none, the mobos act .............almost........exactly the same way....

Now, the "difference" that I saw was in the ability to interact MAINLY with video cards.....

AND....yes this was what..... five years ago, and the stuff was items that the JohnnieMan grabbed for me from the beltways, but yeah they do that all the time!

woodliveswaytoofarinthepastandfuturesmoke

[Feathers McGraw]

Intel builds the CPU, the PCH, and the ICH. On BIOS machines, the firmware resides in the ICH. On UEFI, machines, the firmware resides in a separate firmware chip that may or may not be manufactured by Intel. The firmware chip is programmed by the laptop manufacturer at the factory.

Buy that Lenovo you want. They're the best laptops on the planet, IM(NS)HO.

Yessir!

Will be fun purging windows and setting it all up the way I want it

I have an external thinkpad keyboard as it is, and love it. So much nicer to type on than your average laptop keyboard.

[SteveRiley]

I opened up the Thinkpad and a guy on the other side of the table remarked 'boy that must be an old laptop you got there'.

ME: "Well, I'm a rocket surgeon, and my work requires calculating trajectories with respect to moving targets while modeling synthetic protein folding. I also need to have a background process compiling a Python optimizer, and another performing static analysis and kernel bisections. This here portable workstation has moar powar than your skimpy little fruit slice. Now buzz off, I'm sure your Facebook friends are waiting to hear about your next trip to the crapper."

[richb]

ME: "Well, I'm a rocket surgeon, and my work requires calculating trajectories with respect to moving targets while modeling synthetic protein folding. I also need to have a background process compiling a Python optimizer, and another performing static analysis and kernel bisections. This here portable workstation has moar powar than your skimpy little fruit slice. Now buzz off, I'm sure your Facebook friends are waiting to hear about your next trip to the crapper."

Hmmmmm

rocket surgeryword of the day: June 11, 2010
(n.) a play on words which mixes two common metaphors: "rocket science" and "brain surgery"
A line in a hilarious Chris Rock comedy act states that one shouldn't eat green meat. No kidding. It doesn't take a degree in rocket surgery to figure out something like that!

[Feathers McGraw]

Half a year ago ago I wrote some tips on setting up Thinkpads and others added good stuff, have a read:
https://www.kubuntuforums.net/showth...configurations

Awesome, thanks!

[GreyGeek]

Snappy comeback rating: #1 World Championship!

SR, where are you when I need you! My comebacks aren't snappy at all. In fact, I can only think of them several hours after the situation!

[vinnywright]

Yes I could have.
As a matter of fact the place was also the waiting lounge for helicopter flights and right next to the flight control room so this truth might have been misunderstood
You know, a black screen with lots of scrolling white text...

OMG ,,,,look at the screen on that laptop their ,,,,shhhhh get security he must be one of those black hat hacker cracker tarorest types ,,,,,he's going to take down the next heliocoptor their ,,,,,,,,SECURITY get that man!!!


VINNY

[tek_heretik]

I build my own stuff, no spyrmware in mine, lol. ;-D

[SteveRiley]

Next time I'm at an airport, I'm going to open a bunch of console windows, cat the entire Linux source tree in each of them, and then walk away from the computer for while to observe people's reactions