Hacker News Reader

Comment by consumer451 | Hacker News Reader

The following breaks my heart, as I love the ThinkPad keyboard, but it's just not worth it.

If your work is sensitive in any way, this is what you can expect from Lenovo:

> In February 2021, Bloomberg Businessweek reported that U.S. investigators found in 2008 that military units in Iraq were using Lenovo laptops in which the hardware had been altered. According to a testimony from the case in 2010, "A large amount of Lenovo laptops were sold to the U.S. military that had a chip encrypted on the motherboard that would record all the data that was being inputted into that laptop and send it back to China." [0]

How is this company still allowed to do business in the USA? There are ThinkPads in the most important of places. Not just in government, but in research...

There are apparently no adults in the room, so make your own decisions.

[0] https://en.wikipedia.org/wiki/Lenovo#Security_and_privacy_in...

View on HN

The Bloomberg story referenced in your [0] was refuted by pretty much everyone and independently confirmed by no one. See [1]. It was not retracted by the authors but the consensus seems to be it is intelligent speculation rather than confirmed fact. In particular the quote you pulled seems like a garbled and further exaggerated secondary source based on the unvalidated Bloomber article. Note the incorrect technical word usage ("encrypted" is not a correct verb to describe how a chip could be integrated into a motherboard design) and the implausible scope of the allegations (sending literally all data inputted to the laptop to China would be a large obvious datastream that would be quickly noticed and independently confirmed, which has not happened).

[1] https://pxlnv.com/blog/one-year-after-big-hack/

If that is indeed the case, you should update the Wikipedia entry which I quoted.

The article's talk page already has a request for an impartial editor to weigh in, though several months old.

I was in the general IT space for Superfish and remember only models found at big box stores were affected. Not the typical "business-grade" machines typically bought by government, industrial, and enterprise. This article confirms my memory https://www.welivesecurity.com/2015/02/20/lenovo-superfish-d...

I believe that we all suffer from normalcy bias.[0] I also just want my awesome five year old ThinkPad to be trustworthy.

However, I know that trusting the CCP is not a great idea. Everyone, including the USA and the CCP, invest so much money in Advanced Persistent Threat actors. So on the side, buying the ThinkPad line would be the equivalent of the NSA's Tailored Access Operations, wouldn't it?

Why wouldn't they take advantage of this? Why take the chance if you work on anything that is gov or commercially sensitive?

[0] https://en.wikipedia.org/wiki/Normalcy_bias

note: if anyone could correct my terminology or logic here, I would appreciate it.

If you’re the one quoting Wikipedia and have knowledge that the data you quoted is incorrect, with source and everything, it’s kind of on you to update the article.

This logic doesn't track for me.

I proposed the case where I believe the current Wikipedia entry to be true.

Wouldn't the person who believes the contrary case be the best person to update the wiki?

That refutation was written two years before Bloomberg's story, and it's in fact referencing a different Bloomberg story.

On top of that, being in the security industry, the very vocal parts were very adamant that something like this could never happen, while also starting to fubd better supply chain verification. The less vocal parts noticed that the refutations boiled down to "why wouldn't people break their NDAs to show us hardware that probably got the NSA involved" and "the NSA wouldn't lie to us".

If you don't mind: given your background, as a personal sanity check for me, would you recommend a Lenovo ThinkPad for sensitive use cases?

Not the person you’re replying to, but things like the Intel Management Engine and the AMD equivalent are very powerful software on pretty much any laptop, that people consider close to back doors.

If you really need secure hardware, a librem laptop (iirc the right name) with openboot is the best.

However if you aren’t dealing with state secrets, any average computer is likely good enough. Just steer clear of unheard brands that sometimes have shady installers (there was a recent incident but it was an unheard brand name).

Thanks, I guess I should be specific about threat modelling.

Let's say I am a sensitive US gov worker or contractor, or I work on state of the art tech/research in the USA. (all juicy targets for the CCP)

I would be correct in thinking that Intel Management Engine is likely NSA pwned, and likely not CCP pwned, correct?

Generally, yes, as Intel is a US company.

That is of course assuming that the CCP didn't reverse engineer or crack it or hack NSA and also have access.

I think you will be better served by articles/blogs by the likes of librem and amnesty (I'm thinking of the group that found pegasus, I think it was some other human rights org from Canda?)/eff. Those guys will have better suggestions to harden your device. Also - ask your IT guy, or the IT guy of the US govt dept where you're working for their best practices.

Hacking risks can either be specific (eg Bezos being personally targeted) or a catch-all (eg stuxnet) where they target your entire department. If you're just one of hundreds of contractors you're likely in the second category which is relatively easier to protect yourself from.

> had a chip encrypted on the motherboard

what does this mean?

It's typical techno-babble from fear-mongering media entities like Bloomberg and Daily Mail

I was also wondering what the heck that could possibly mean. I chalked it up to a journalist not being a true nerd.

EC (embedded controller) in thinkpads is somewhat encrypted. EC among other things takes role of keyboard controller, and has access to big flash chip. Lenovo software does stuff behind your back all the time

https://forums.lenovo.com/t5/Security-Malware/BIOS-automatic...

UEFI BIOS can also initiate OS actions thru shitty MS mechanisms. You will love WPBT (Windows Platform Binary Table)

https://www.howtogeek.com/226308/the-windows-platform-binary...

"Beginning with Windows 8, a PC manufacturer can embed a program -- a Windows .exe file, essentially -- in the PC's UEFI firmware. This is stored in the "Windows Platform Binary Table" (WPBT) section of the UEFI firmware. Whenever Windows boots, it looks at the UEFI firmware for this program, copies it from the firmware to the operating system drive, and runs it. "

" Lenovo shipped a variety of PCs with something called the "Lenovo Service Engine" (LSE) enabled. "

“Encrypted” means a set of data is processed with a password so to make it garbled, to both humans and computers. If data doesn’t involve a password of some shape or form to process, it isn’t “encrypted”, no matter how complicated of a state it might be in.

“Obfuscated” is another word, that is used to describe a thing that, while requiring no password, intentionally made complicated to achieve similar effect.

Hollywood style “the system is encrypted” is not real. That’s total technobabble, I’d say like “soft boiling a dinner plate”, nobody knows what it even amounts to.

Reply on news.ycombinator.com