Would be willing to buy something else. Anything else. But most other laptops out there have even worse keyboards (which I deeply care about), terrible form factors, specs that are stuck in 2010, awful support/warranty, no Linux support, or all of the above!
If someone builds something I'm happy with, I'll buy it. Price is not an issue. My laptop is my toolbox. I want it to work the way I like it. If it breaks, I need to have fixed preferably today, but tomorrow or the day after can be acceptable as well. That basically leaves Lenovo & Dell.
This thread has more information from someone who works at System76.
I do understanding that it's entirely feasible for them to rootkit Linux from the BIOS and install malware onto their Thinkpads but I just haven't seen it happen yet
It’s not actually, because the mechanism which allows a vendor to provide “drivers” via UEFI is used by Windows only and nobody else. Windows exclusively is the target of such UEFI abuse.
Lenovo can put as much garbage and bloatware they want in the relevant UEFI firmware-sections, and Linux will simply ignore it, like it always have. No root-kit will be triggered.
As a Linux-user you are actually 100% immune against this abuse. As a ThinkPad-owner doubly so, since this major fuck-up only affected budget/non-Thinkpad product-lines.
I know that's not feasible for their newer lines, which I also own
https://thehackernews.com/2015/09/lenovo-laptop-virus.html?m...
Show me one example - any example - of Lenovo installing any of this kind of stuff on a factory fresh ThinkPad, and then we'll have something to talk about.
Until then, I suggest ignoring biased and axe-grinding sources like "thehackernews".
What is the threat model? They will not be using the rootkit for hiding useland malware. Are they extracting my documents and misuing them? Are they performing MITM on my connections and doing something harmful? While the capability is there, I don't see the software being used in a way that will inconvenience me.
It is a weak point in the system, maybe someone else exploits it, but I have so much software that I can say that about. When looking at threats the question for me is what is most likely to get me owned. It will probably be phishing or a malicious document. That's not going to change based on the manufacturer I buy from.
If I do get owned by some targeted malware that uses a Lenovo driver for priv esc, well they were probably going to get me with or without that. As good as it would feel to boycott a company with poor security practices, I'm over running unrefined System76 laptops.
https://www.cnet.com/news/superfish-torments-lenovo-owners-w...
It did MITM to inject ads, including adding their cert to the trust store to MITM SSL connections.
Of course the software needed the private key to work, which they shipped to every laptop and was quickly put online.
All of the sudden banking at coffee shops on a lot of Lenovo models was no longer private.
I'm not sure if captured traffic could be retroactively decrypted, but I wouldn't doubt it. PFS support probably wasn't high on Superfish's priorities.
Not to excuse Lenovo - they fucked up big.
https://thehackernews.com/2015/09/lenovo-laptop-virus.html?m...
The firmware rootkit, to my knowledge, has never been found on ThinkPads.
Have you configured your browser(s) to "fail closed" when it comes to OCSP queries? CRL and OCSP behavior has been, well, "not ideal" since basically forever.
in the case of a starbucks, the AP itself is not necessarily secure (under a counter somewhere?) so it's possible users are connecting to a malicious AP.
the threat model depends on the level of risk: the convenience may outweigh those risks, it may not. for myself it is one of a few tasks i wouldn't engage in on a network i don't have more trust in, but in retrospect this advice was indeed probably too strong for most.
Again, what’s the threat model here? Exploiting a browser vulnerability? Maybe?
Please explain this further.
Not snark, genuinely curious.
Maybe Lenovo will include a sketchy driver, but I trust Lenovo to not use that driver to drop ransomware on my machine. In the same sense I trust Google with my location and emails. You may trust an AV company that can upload any file on your machine to not grab your tax returns and open a new credit card in your name.
Even if Lenovo starts intercepting my private web traffic or placing files on my machine there is only so much damage they can do. They are not about to frame me by dropping plans to overthrow the government in my downloads folder then blackmailing me to design more secure drivers for no pay.
There are threats I'm afraid of and a computer manufacturer, no matter how negligent, is not one of them. Is OP avoiding Intel too? Meh.
edit: "some Lenovo products"
Writing off a company for adding root kits to their machines out of the box seems to be perfectly reasonable.
Regardless, a lot of people would say no to either, acetomenephen and ibuprofen have largely replaced Asprin for most uses.
Or, copy trackpoints from outside of the patent window. A 20 year old trackpoint won't be as good as a modern one (probably, I'm not a trackpoint user), but it's better than no trackpoint?
https://www.howtogeek.com/226308/the-windows-platform-binary...
What in the actual fuck... this seems straight off a dystopian graphic novel
https://www.techpowerup.com/248827/asus-z390-motherboards-au...
When I play movies I've paid for on my iPad I've paid for, if I want to screenshot frames from them to share or reference or meme, the screenshots come out as black rectangles.
No fair use for you!
Re-imaging the OS would not help in this case, so you would only be protected if Lenovo did not, in fact, put the rootkit on the Thinkpad line.
And then you just don’t care about stuff like that, because it honestly doesn’t affect you the slightest.
I think it's best to always start from clean slate because even 'good' manufacturers put a tonne of shit in there. So in that sense, it doesn't really matter what the manufacturer does, apart from the terrible decision making that they should learn from.
Consider using OpenBSD instead. The barrier to entry is higher, but worth it. Hell I'd be surprised if they could get that to run on linux without exploiting a 0day. Windows tries to be too helpful, and that's where the problems arises.
Your point is valid though; why trust them? If you follow that train of thought all the way down you'll be forced to live naked on a deserted island.
The person you replied to also suggested running Linux instead, in which case you are not affected.
Honestly, I would not be surprised if one of them, at some point, tried something like this with Linux, too.
---
[0]: https://fwupd.org
The only thing this does, is enable you to update your UEFI BIOS and other machine-firmware from Linux, without having to have a separate dual-boot OS like Windows (or bootable USB sticks) to do that one task, and it frees you from having to download and obtain proprietary firmware-installers/checks per device you want updated etc.
I consider it apt-get for firmware and use it all the time. Everything in one place, easy to keep up to date etc. It's great!
And very importantly: It does in no way enable the UEFI-abuse with bloatware "drivers" as outlined earlier, which is still a Windows-only phenomena, because Linux does not check for nor use these drivers.
Edit: Oh hey there Jeremy. Long time no see! Where did my good ol' IRC buddy go these days? :D
Please, ffs, learn the difference.
When I was last in the market they were offering HP, so that’s what I got.
That Lenovo fucked up at some point in the past is immaterial to my purchasing decisions.
And I consider myself a fairly reasonable person.
Do you wait like a year or three? five? Do you never buy Lenovo again? What's reasonable? This isn't rhetoric: I'm legitimately asking for a figure, as well as a rationale, because I don't know the answer.
Personally I'm in the market for a high end laptop for running Linux, and I just couldn't see myself buying something from them ever, no matter how good their machines are, because I just don't trust the people in the organization who develop products to take system integrity seriously enough.