Shoot the breeze, anything goes.
User avatar
!
30%
Posts: 3259
Joined: 2013-02-25 18:36

2015-09-22 23:02 »

:sick: :sick: :sick:

Lenovo collects usage data on ThinkPad, ThinkCentre and ThinkStation PCs.

http://yro.slashdot.org/story/15/09/22/193232/lenovo-collects-usage-data-on-thinkpad-thinkcentre-and-thinkstation-pcs.

Lenovo seems to be testing the boundaries of trust.

First came the Superfish scandal where they were found to be pre-loading ad software that was so poorly implemented that it left victims/customers vulnerable to serious security flaws.

Then, Lenovo software was discovered on a fresh install of the retail edition of Windows. Lenovo had been modifying the BIOS, to insure that, no matter what a customer did, their software got installed. And, this was software that both The Register and ExtremeTech referred to as "crapware". That the software (the Lenovo Service Engine) was buggy, just made a bad situation worse. In the end, Lenovo updated the BIOS not to muck around with the installed copy of Windows.

Both cases involved consumer machines. In their statement about the Lenovo Service Engine software, the company noted that "The software does not come loaded on any Think-branded PCs."

On a recent edition of the Security Now podcast, Steve Gibson read a note from a listener saying that while Lenovo was corrupting their consumer PCs, they have kept their hands off the ThinkPad line. Both Gibson and the show host, Leo Laporte, proceeded to sing the praises of ThinkPads.

But there's more to the story.

Back in October 2014, I purchased a refurbished ThinkPad T520 laptop from IBM. In June of this year, I purchased a refurbished T420 ThinkPad, again from IBM. Both shipped with fresh copies of Windows 7 Professional.

When I examined the task scheduler database on these machines I found a troubling entry in each.

Thanks to the TaskSchedulerView program, that I wrote about last month, it's easy to see the scheduled tasks in Windows. TaskSchedulerView is free, portable and comes from Nir Sofer, whom I consider a reliable source. The program provides a simple spreadsheet like interface to the Task Scheduler database.
Lenovo scheduled task

The task that gave me pause is called "Lenovo Customer Feedback Program 64". It was running daily. According to the description in the task scheduler: "This task uploads Customer Feedback Program data to Lenovo".

I have setup my fair share of new Lenovo machines and can't recall ever being asked about a Customer Feedback program.

The program that runs daily is Lenovo.TVT.CustomerFeedback.Agent.exe and it resides in folder C:Program Files (x86)LenovoCustomer Feedback Program.

Other files in this folder are Lenovo.TVT.CustomerFeedback.Agent.exe.config, Lenovo.TVT.CustomerFeedback.InnovApps.dll and Lenovo.TVT.CustomerFeedback.OmnitureSiteCatalyst.dll.

According to Wikipedia, Omniture is an online marketing and web analytics firm, and SiteCatalyst (since renamed) is their software as a service application for client-side web analytics.

So, while there may not be extra ads on ThinkPads, there is some monitoring and tracking.

On the one hand this is surprising because the machines were refurbished and sold by IBM. On the other hand, considering Lenovo's recent history, it's not surprising at all.

Poking around the Lenovo directory, I found that folder

C:Program Files (x86)LenovoMetricCollectionSDKlicenses

contained RTF files in different languages. The English version is file ILAENG.rtf and it starts off with

Lenovo License Agreement
L505-0009-05 10/2013
This Lenovo License Agreement (the "Agreement") applies to each Lenovo Software Product that You acquire, whether it is preinstalled on or included with a Lenovo hardware product, acquired separately ... Lenovo will license the Software Product to You only if You accept this Agreement. You agree to the terms of this Agreement by clicking to accept it or by installing, downloading, or using the Software Product.

Seems like it only applies to Lenovo software.

Later, the License Agreement says:

Lenovo will collect basic information about what applications, services, and offers you choose during system setup. In order to make your experience more useful and enjoyable we may also collect information on how you use Lenovo applications. If you decide at any time you'd like us to stop collecting information on how you use Lenovo applications, you may open Settings and turn off Usage statistics. These processes do not involve the collection of any personally identifiable information.

OK, so you can disable it in "Settings". What settings? Where? It doesn't say.

Whatever it was designed to do, it's not doing it any more on my laptops. On each machine I used TaskSchedulerView to disable the task and for good luck, I also renamed the C:Program Files (x86)Lenovo folder.

Then, turning to my favorite search engine, I found another explanation of this tracking in Lenovo support document HT102023: Lenovo systems may include software components that communicate with servers on the internet - All ThinkCentre, All ThinkStation, All ThinkPad.

Interestingly, this document was last updated February 27, 2015, just after the Superfish fiasco.

Lenovo says here that all ThinkPad, ThinkCentre and ThinkStation PCs, running Windows 7 and 8.1, may upload "non-personal and non-identifying information about Lenovo software application usage" to 112.2o7.net.

This functionality is implemented in two programs: Lenovo.TVT.CustomerFeedback.Agent.exe and LenovoExperienceImprovement.exe.

Here too, Lenovo points out that "The behavior is documented in the End User License Agreement that all users must read and accept prior to using their Lenovo system for the first time".

Want to see that EULA now? The document says that it can be found in the C:windowssystem32oobeinfo folder. The folder contains 39 files. Which is the EULA? It doesn't say.

Apparently, the reason I only ran across one of the two phone-home EXEs is that the Lenovo Experience Improvement system un-installs itself after 90 days. The document mentions that it can also be manually un-installed from the Control Panel "Programs and Features" where it is listed as "Lenovo Experience Improvement".

Lenovo repeatedly mentions, in document HT102023, that the data they collect is not "personally identifiable information". They also state that the only apps for which they collect data are their own. And, Lenovo.TVT.CustomerFeedback.Agent.exe gets a clean bill of health at Virus Total where it was first seen in May of 2014.

User avatar
PROBLEMCHYLD
VIP
Posts: 989
Joined: 2013-03-22 12:55

2015-09-23 00:36 »

The first thing I do when I get a new computer, is wipe the fucker clean. Set up my firewall and block anything suspicious. I'm starting to hate new technology more and more.

User avatar
!
30%
Posts: 3259
Joined: 2013-02-25 18:36

2015-09-23 00:44 »

PROBLEMCHYLD wrote:...I'm starting to hate new technology more and more.

We are sitting in the same boat for sure.

Any new "technology" these days seem to be equal to which corporations can do the best surveillance in your own home and spy on people. Totally creepy disgusting. I used to be excited every time I read the technology news Web sites. These days, it's just all about where to buy the best spyware. :neutral: When the FUCK did we start living in a prison anyway? What's wrong with people? :sick:

0212.jpg
0212.jpg (99.9 KiB) Viewed 5047 times

User avatar
Steven W
VIP
Posts: 2862
Joined: 2013-08-10 22:40

2015-09-23 01:42 »

whiff_it_good.jpeg
whiff_it_good.jpeg (34.17 KiB) Viewed 5044 times

User avatar
Steven W
VIP
Posts: 2862
Joined: 2013-08-10 22:40

2015-09-26 21:56 »

I was thinking of starting a new post for this, but this one seems somewhat relevant to my thoughts. I was checking out some news online and ran across the stories of folks standing in long lines to get the new iPhone 6s. Along with the stories are the inevitable photos of people holding their new electronic device toward the heavens in victory stances and others in the background applauding. I can understand a bit of excitement, but iTards and the press take the bullshit to an extreme. When did standing in lines to buy manufactured goods become an accomplishment? :???:

I've started taking the approach of waiting until the stuff is a cheap commodity, I purchased my first tablet around Christmas for 30 dollars. The big issue I have with the thing is its battery life. I have a few ideas for an ideal tablet, but will save those for another post...

Has anyone noticed how much people want for vintage electronics on eBay. Talk about extreme. But I guess, as we all know, electronics, much like a fine wine, improve with age. :lol:

User avatar
!
30%
Posts: 3259
Joined: 2013-02-25 18:36

2015-09-27 03:32 »

Oh God, tell me about it. It's a sick culture! And it isn't only in US of A. All countries, even in the middle east, people seem to have gone completely insane. Buying "stuff" they don't really need. "Stuff" that are really spyware devices which at best case, only corporations use to sell them more "stuff".

We have already so much food and so much automation that basically, I would guess almost 90% of the world don't really even have to work! We could all get a standard basic food and shelter. Maybe someday people will wake up and stop being slaves to all of these uselss "stuff".

Frankly, I think lots and lots of people are like me. If they didn't have to do useless junk as "work" just to eat and have a roof over their heads, they would have done great things for humanity. If only I had food and roof secured, I would have been able to do so much good. I'm a great engineer after all! :neutral: :eh:

Post Reply