Hacker News Reader

Comment by charles_f | Hacker News Reader

I'm not sure what codex helped with for the Lenovo case, if all that was required was open the stick and stick the sdcard into a computer.

It's crazy that Lenovo will still be trusted to build secured hardware after that. It's not even a vulnerability at this point, I'm not sure how this could pass any form of security review, let alone having anyone review the design and approve it. They must have known it was nothing they pretended and still decide to sell it.

View on HN

> It's crazy that Lenovo will still be trusted to build secured hardware after that.

Lenovo already has an history of backdooring the devices they sell, sometimes in exchange for money. It's insane that anyone trusts them for anything. https://en.wikipedia.org/wiki/Levono#Security_and_privacy_in...

How can I be sure my lenovo laptop is safe? I have a clean install, but should I dump the motherboard firmware and ask ai to decompile it? Is there another place they could hide bloatware? Besides main storage / motherboard firmware?

Should I check network card firmware?) Maybe they added a rule to forward certain instructions to the OS embedded in the CPU

> How can I be sure my lenovo laptop is safe?

You cannot.

Honestly that would be a decent way to become internet famous for a bit lol.

They can hide it in your storage firmware. Sprites Mods attached a jtag to a consumer hard drive, identified the CPUs, dumped the firmware, modified it, wrote it back. When it sees a certain string in any write to the disk, it enters evil mode. Then whenever it sees something that looks like a unix password file, it substitutes it for some known value. As in, hit your webserver with the magic string in the query string portion of the request, then ssh to the box and log in with a known password. Reinstalling your OS does nothing for you since it's in the drive firmware. Also was able to reprogram the firmware online, not requiring physical access to the drive. But literally anything can be compromised. You could have DIMMs that look for magic bits and when they see them they substitute code so the nation state can have code running on your computer anytime they want. Your cpu could do the same. Once it seems some long ass string of bytes that have a particular checksum, it switches to ring 0 or ring -1 or smm mode.

https://spritesmods.com/?art=hddhack&page=1

>They can hide it in your storage firmware

Everything you wrote is not an exclusive Lenovo risk and vulnerability but applies to every piece of compute sold in the worlds.

True, but Lenovo has repeatedly demonstrated that they're willing to do it, lie to customers giving them a false sense of security while leaving them vulnerable, and will continue to put their customers at risk even after being caught several times.

That's a cool thought experiment, but it doesn't work in practice.

> When it sees a certain string in any write to the disk

dm-crypt or zfs encryption or any other commonly used encryption will encrypt the data before it's written to disk, so the disk controller will not be able to do anything with writes or reads since it will not have the encryption key.

The general point related to the topic of the article is that the many controllers running on your device (not limited to Lenovo BTW) are black boxes almost impossible to inspect. The encryption engine on a hardware encrypted USB stick is making everything even harder. It can implement something like this but it's probably made to be extremely difficult to dump the firmware or inspect the features implemented in silicon.

If I'm doing software encryption like dm-crypt or zfs encryption then I don't need to bother with hardware encryption too. It's easier to trust software encryption. We have many interoperable and even open source implementations of the same encryption methods, the output is readable in open formats, so they can be validated against each other if needed.

>> will encrypt the data before it's written to disk

The people buying much of these "hardware encryption" products do so because they believe it removes the need for software encryption to/from the device.

I thought lenovo is one of the most trustable laptop manufacturers, because of ThinkPad lineage.

say no more ig.

IIRC that changed when the company changed hands in 2010ish.

They were still pre-installing malware in people's systems in 2016. They were caught with a hardcoded password in their fingerprint scanner after that. In 2019 they still couldn't be trusted not to backdoor their devices, they released a alarm clock with a hard-coded SSH password. They are not a company any should be trusting with anything.

Sure? All of that seems post-2010ish. I think we're agreeing with each other, but placing that comment in response to mine instead of a different one gives off a different impression.

That was sort of the case when the Thinkpad brand was owned by IBM up until the late 2000s, but Lenovo is a chinese company.

Lenovo is still one of the big three, releasing actual verified hardware. I don't think secure hardware is a real thing in the PC world right now.

There's a world of difference between "we can't be sure that other companies won't backdoor our systems" and "We know for a fact that lenovo has done it multiple times and repeatedly lied to customers about it when found out and even once released a patch which they claimed fixed the problem but which actually still left their customers vulnerable."

All people are capable of being untrustworthy, but that doesn't make all people the same as those who have already demonstrated that they are.

"I don't think secure hardware is a real thing in the PC world right now."

It hasn't been in a looooooong time.

The first three layers of the OSI model are sorely neglected.

ThinkPad is still a decently "trustable" brand (at a price, if buying new), but that indeed doesn't extend to their other product lines!

And of course even pedigreed ThinkPads have changed a lot from the X201/T410/T510 age (that's the first generation Intel i-series) in subjective but generally criticized ways :) :(

Which company would you trust more tho ?

Maybe Clevo, since they are more of an OEM producer for other brands meaning they don't control all the eyes on the hardware all the way to the sale point, i.e. to sneak things in.

Clev-who?

White box OEM, they make like 80% of the laptops you can buy.

Who do you have to trust the least? The other two choices are Chromebooks and Macbooks, or some homegrown Linux solution. Of those, only Chromebooks are locked down to the point that you can't do anything with it unless you intentionally unlock it. Which means it's safe for some kinds of things but not others, depending on your threat model.

Dell wept.

Dell is the one that may break, but their service is great. Next business day on site repair.

Maybe HP business stuff as well? HP are inconsistent, but some of their stuff is good. I've had an HP ZR24w screen with great picture quality that still works like new after 15 years and 30k hours. The ZBook G1a laptop ("mobile workstation in ultrabook form factor") also seems great so far, after a little under a year. Almost everything about it is very good, including the touchpad.

At this I can't think of anyone I'd trust less. People have their complaints about every manufacture, but as far as I know, none of them have a track record as bad and as consistent as levono. Personally, I'm looking at system76 and Framework for my next laptop.

System76 does not make their own laptops, it's all rebadged.

They said like 2 years ago they were working on one, but I have not heard much since.

one could web search for the US OEM. I forget the name but there in the SF North Bay Area maybe Santa Rosa

https://www.reddit.com/r/System76/comments/f2xakl/system76_u...

Precisely. They gave up integrity so early after acquiring the ThinkPad brand as to be immediately unusable.

He used codex on other devices. He just opened the Lenovo USB case no AI needed because the sd card can be read by using a reader. The USB connection is disabled/enabled by the fingerprint reader.

So, technically, it’s a fingerprint-protected USB adapter. That’s pretty cool. Useless, but cool.

So many boxes to tick, and with a company culture that leans towards box ticking and apathy (regulatory checklists without the extra checkbox “is that last checkbox a real checkbox" then you have to talk to the nerd department who's too busy for your stupid questions... Etc. Etc.) What can we expect? I'm disappointed in Lenovo for this, but my own apathy expects no one will be held accountable!

Reply on news.ycombinator.com