Lenovo Caught Using Rootkit to Secretly Install Unremovable Software

http://thehackernews.com/2015/08/lenovo-rootkit-malware.html

Two years ago Chinese firm Lenovo got banned from supplying equipment for networks of the intelligence and defense services various countries due to hacking and spying concerns.

Earlier this year, Lenovo was caught red-handed for selling laptops pre-installed with Superfish malware.

One of the most popular Chinese computer manufacturers ‘Lenovo’ has been caught once again using a hidden Windows feature to preinstall unwanted and unremovable rootkit software on certain Lenovo laptop and desktop systems it sells.

 

The feature is known as "Lenovo Service Engine" (LSE) – a piece of code presents into the firmware on the computer's motherboard. 

If Windows is installed, the LSE automatically downloads and installs Lenovo's own software during boot time before the Microsoft operating system is launched, overwriting Windows operating system files.

More worrisome part of the feature is that it injects software that updates drivers, firmware, and other pre-installed apps onto Windows machine – even if you wiped the system clean.

So even if you uninstall or delete the Lenovo's own software programs, the LSE hidden in the firmware will automatically bring them back as soon as you power-on or reboot your machine.

Users at a number of online forums are criticizing Lenovo for this move and suspecting that the Chinese computer maker has installed a "bootkit" that survives a full system wipe-and-reinstall.

The issue was first discovered and reported by users back in May when using new Lenovo laptops but was widely reported Tuesday.

What these Unwanted Program Does?

For Desktops:

In case of desktops, Lenovo's own description states that the software doesn't send any personally identifying information, but sends some basic information, including the system model, date, region, and system ID, to a Lenovo server. 

Moreover, the company claims that this process is done only one-time, sending the information to its server only when a machine first connects to the Internet.

For Laptops:

However, in case of Laptops, the software does rather more. LSE installs a software program called OneKey Optimizer (OKO) that bundles on many Lenovo laptops. 

According to the company, the OKO software is used for enhancing computer performance by "updating the firmware, drivers, and pre-installed apps" as well as "scanning junk files and find factors that influence system performance."

OneKey Optimizer falls under the category of "crapware". The worst part is that both LSE as well as OKO appears to be insecure. 

Back in April, security researcher Roel Schouwenberg reported some security issues, including buffer overflows and insecure network connections, to Lenovo and Microsoft.

This forced Lenovo to stop including LSE on its new systems that built since June. The company has also provided firmware updates for vulnerable laptops and issued instructions to disable the option on affected machines and clean up the LSE files.

Among others, many Flex and Yoga machines running an operating system including Windows 7, Windows 8, and Windows 8.1 are affected by this issue. You can see the full list of affected notebooks and desktops on Lenovo's website.

Lenovo has since released an official statement, which notes that the systems made from June onwards have BIOS firmware that eliminates the issue, and it's no longer installing Lenovo Service Engine on PCs. 

Expert way! How to Remove Lenovo Service Engine (Rootkit)

In order to remove LSE from your affected machines, you have to do it manually. Follow these simple steps in order to do so:

1. Know your System Type (whether it’s a 32-bit or 64-bit version of Windows)
2. Browse to the Lenovo Security Advisory, and select the link for your specific Lenovo machine.
3. Click the "Date" button for the most recent update.
4. Search for "Lenovo LSE Windows Disabler Tool" and Click the download icon next to the version that matches your version of Windows.
5. Open the program once it downloads. It will remove the LSE software.

Bokken Open Source Reverse Code Engineering

http://bokken.re/index.html

Reverse tools, penting juga untuk security

Announcing the Second FLARE On Challenge

https://www.fireeye.com/blog/threat-research/2015/07/announcing_the_secon.html

The FireEye Labs Advanced Reverse Engineering (FLARE) team is hosting its second annual CTF-style challenge for all reverse engineers, malware analysts, and security professionals.

The first FLARE On Challenge was a huge success with over 7,000 participants and 226 winners! If you missed it last year, we invite you to compete and test your skills again. The challenge runs the gamut of skills we believe are necessary to succeed on the FLARE team. We invite everyone who is interested to solve the challenge and get their just reward!

 

The puzzles were developed by many different members of the FLARE team and lead by Nick Harbour. Nick is an expert in reverse engineering and computer forensics, with a specialty in anti-disassembly techniques. Nick has created industry security tools such as Red Curtain, dcfldd, IOCe, tcpxtract, and pe-scrambler. He also wrote Chapter 15 of Practical Malware Analysis.

The puzzles start with basic skills and escalate quickly to more difficult reversing tasks. At FLARE we have to deal with whatever challenges come our way, so the challenge reflects this. If you take on the challenge you might see puzzles involving Packers, Mobile platforms, steganography, obfuscated .NET, and so on.
 

The Second FLARE On Challenge will open at July 28, 2015 20:00EDT and close on Sept. 8, 2015 20:00EDT. You can finish any time before Sept. 8 to qualify for a prize.
 

Nick is hosting a webinar on Wednesday, July 29, to help kick off your challenge experience.

After completing the final challenge, you’ll be contacted by a FLARE team member. Once you provide a mailing address we’ll ship you your prize. Last year, the prize was a coin and this year we have something new and special for the winners ;). The full details can be found at: www.flare-on.com.
 

So on behalf of the FLARE team, I say Happy Reversing!