We purchased a machine from China and it came with malware preinstalled

Re:We purchased a machine from China and it came with malwar... by southerntofu on Tuesday January 25, 2022 @08:34AM (#30071594)

I'm a little bothered by the article title because it implies it's related to the manufacturer being from China, despite ample evidence that pretend-reputable software vendors like Google, Amazon and Microsoft all bundle universal backdoors with their systems.

Google infamously pushed settings changes on their phone lines without user consent via the Google Play Services backdoor. Amazon removed the (bought) book 1984 from all Kindles. Microsoft proudly bragged about their remote app "kill switch".

Let's not even talk about about CPU vendors embedding "anti-theft" solutions which are nothing more than RCE-as-a-service on a hardware/firmware level. Or hardware vendors bundling rootkits like Lenovo on some laptop series, and most phone manufacturers on all their devices.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by 692 on Tuesday January 25, 2022 @10:06AM (#30072563)

I was royally pissed off when I suspected my brand new Lenovo laptop was acting strange. The only in the end to stop it was to reinstall the OS, I then later found out it was the superfish issue

https://slate.com/technology/2015/02/lenovo-superfish-scanda...

I will never buy Lenovo again

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by southerntofu on Tuesday January 25, 2022 @02:20PM (#30076636)

The problem is more or less all hardware manufacturers do that. There's variations: some bundle only the Windows backdoor, some bundle Superfish, some bundle Intel/AMD's anti-theft and ME/PSP features. That society is ok with that is a huge problem to say the least.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by 692 on Wednesday January 26, 2022 @04:15AM (#30083401)

I doubt you can compare superfish against bloatware antitheft "feature"

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by southerntofu on Thursday January 27, 2022 @04:29AM (#30098212)

And yet my CPU runs its own operating system (Minix) behind my back and reacts to undocumented secret commands i'm unaware of. Is the comparison that irrelevant?

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by 692 on Friday January 28, 2022 @01:57PM (#30118857)

I'm not defending ME/PSP at all, i would happily burn the CPUs off, if I could. I totally agree completely on your statement

> That society is ok with that is a huge problem to say the least.

but you could compare any bad actor actions to ME/PSP and say it's the same or not as bad

it's bordering on Whataboutery

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by southerntofu on Sunday January 30, 2022 @06:33AM (#30136092)

I personally find the two questions awfully related: i'm buying hardware that performs operations without my knowledge/consent and answers to someone else's commands. Now one may genuinely believe there are valid usecases for this (i don't), but it's not exactly "whataboutism" as i'm definitely not trying to refute the original argument that pre-bundled malware is bad.

Although i personally consider hardware/firmware-level malware more troubling than OS-level malware which you can just wipe away by setting up a fresh system (which i recommend anyone to do when they receive a new machine, for related reasons).

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by the_dripper on Tuesday January 25, 2022 @08:50AM (#30071727)

Do you perhaps have a link about the story of amazon removing the 1984 book on all kindles? It sounds very interesting, partly because it seems so absurd.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by CrazyStat on Tuesday January 25, 2022 @08:56AM (#30071787)

Here's a writeup [1]. A third party started selling kindle editions of 1984 and Animal Farm through Amazon despite not having any rights to do so. When they found out (presumably the rights holders complained), Amazon deleted the unauthorized editions.

[1] https://gizmodo.com/amazon-secretly-removes-1984-from-the-ki...

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by dec0dedab0de on Tuesday January 25, 2022 @08:53AM (#30071761)

https://www.pcworld.com/article/519855/amazon_kindle_1984_la...

That story is about a lawsuit from one of the people they took it from.

Amazon sold 1984 on the Kindle store without permission, and when they realized their error they deleted it from everyone's kindle and refunded their money.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by tgv on Tuesday January 25, 2022 @09:01AM (#30071843)

That's really something entirely different than malware. You know that Amazon books on kindle are subject to that. It's not malware on the Kindle, it's their whole schtick.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by dec0dedab0de on Tuesday January 25, 2022 @05:12PM (#30078862)

That's really something entirely different than malware. You know that Amazon books on kindle are subject to that. It's not malware on the Kindle, it's their whole schtick.

At the time it was suspected, but unknown. I remember the outrage, I'm not sure If I was lurking on here before I made an account, or I read it on slashdot or digg or something. Here are the HN comments from the time. https://news.ycombinator.com/item?id=710506

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by tgv on Wednesday January 26, 2022 @01:21PM (#30089472)

Interesting, but at least some people seem to have been aware.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by southerntofu on Tuesday January 25, 2022 @02:37PM (#30076889)

> You know that Amazon books on kindle are subject to that.

Most people don't. And the few that do only know because of this scandal.

There's something profoundly unintuitive about it. When you buy 5$ a book in the bookstore, you can't wake up some day with the door open, 5$ on your table and the book gone from your library.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by pessimizer on Tuesday January 25, 2022 @09:12AM (#30071961)

The best way to fix malware is to refer to it as your business model.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by jacknews on Tuesday January 25, 2022 @09:47AM (#30072316)

Do any of them steal IP, as is alleged here, and has certainly happened in other cases involving Chinese, often state-controlled, companies?

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by southerntofu on Tuesday January 25, 2022 @02:18PM (#30076617)

Do western artists and corporations borrow stuff from other cultures and competitors? All 20th century rock & roll, most of hollywood, and pretty much all of pre-90s Silicon Valley is based on that premise.

That you think it's theft is a debatable/controversial point of view on Internet forums, but if that is to be the case, many more people/corporations from USA should feel threatened, not just a few chinese scapegoats which help avoid the elephant in the room: why would anyone own ideas in the first place? Ideas are born out of other ideas and every one benefits from that. Restricting knowledge sharing can lead to disastrous outcomes as Jonathan Blow brilliantly argued in a talk called Preventing the collapse of Civilization which appears to pop up on HN every so often: https://www.youtube.com/watch?v=pW-SOdj4Kkk

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by jacknews on Tuesday January 25, 2022 @11:41PM (#30081796)

Um, no, there's a very clear difference between 'borrowing' ideas, building on other people's achievements etc, and outright theft, when you copy someone's detailed designs wholesale, especially from secret proprietary plans obtained through illegal espionage.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by southerntofu on Sunday January 30, 2022 @06:37AM (#30136114)

This "very clear difference" is the center of many trials in Hollywood / Silicon Valley history so i wouldn't say it's that clearcut. I personally don't see copyright in any way as a mechanism to bring retribution to the creative minds (instead it serves to capture value into big corps and let the artists starve), but as long as we have to deal with it i'll keep publishing stuff as copyleft so that the capitalist vampires think twice before "borrowing" my code.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by Scoundreller on Tuesday January 25, 2022 @02:05PM (#30076421)

Do companies hire/recruit (ex-)employees from competitors to re-implement the same features?

Yes.

Lots of IP between your ears. No point in the code/manuals/docs when you wrote them yourself. You’ll know they’re not exactly correct and may appreciate being able rewrite from the ground-up now knowing what you now know.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by jacknews on Wednesday January 26, 2022 @06:20AM (#30084177)

Sure, but if the employee brings along the architecture documents or the source code, that's theft. What's alleged here is that a CHinese company is exfiltrating actual PCB designs via PnP machine malware.

[ Parent | on HN ]

Re:We purchased a machine from China and it came with malwar... by natch on Tuesday January 25, 2022 @09:31AM (#30072137)

China is next level though. If that bothers anyone, that’s understandable; it should.

[ Parent | on HN ]