Laptop Vendor Bloatware Confirmed As Security Nightmare

Everyone is familiar with all of that unwanted software that manufacturers are paid to install on laptops that they sell.  For many people, when they get a new computer, they spend the first many hours installing patches and deleting all of those unwanted applications, which many people lovingly call crapware.  Researchers have confirmed that in addition to being unwanted, that crapware also makes your computer completely compromised from a security standpoint.

Many businesses will take that new laptop, format the disk and install a ‘clean’ version of the OS that they use –  that is actually easier, in most cases, than uninstalling all that crap.

 Duo Security analyzed the ‘driver updater software’ packaged with Acer, Asus, Dell, HP and Lenovo.  Their analysis?

“  We broke all of them (some worse than others). Every single vendor had at least one vulnerability that could allow for a man-in-the-middle (MITM) attacker to execute arbitrary code as SYSTEM. We’d like to pat ourselves on the back for all the great bugs we found, but the reality is, it’s far too easy.[…]The level of sophistication required to exploit most of the vulnerabilities we found is somewhere between that possessed by a coffee stain on the Duo lunch room floor and your average potted plant – meaning, trivial.  ”

Duo said that every laptop vendor’s driver updating software included at least one security flaw that allowed the hacker to remote execute code as ‘System’ and take over the device.

The table below (click to enlarge) provides a summary of the underlying design and implementation errors for each of the tested manufacturers.

For consumer users, this confirms my recommendation of uninstalling any applications that you do not expressly need.  My motto is “if in doubt, throw it out!” (meaning uninstall it).  While previously, I had not considered the vendor’s driver updating software to fall in that category, I think that is now something to consider.

For business users, you should have  “gold disk”, which is an image of a brand new, fully patched operating systems with all the application that you use, already installed.   That way, you format the disk, install your version of the (Windows) OS along with all of the applications that you use, make a few tweaks, install the last few patches and you are good to go.  Every business that has more than a few computers should be doing this.

Information for this post came from Softpedia.

by