tl;dr version (since this blew up on Reddit and there's lots of stuff to digest)
* in Windows 8+ any PC vendor can include an .EXE in Firmware/BIOS, and Windows will look for this on each boot, and run it right before you log in. This is called "Windows Platform Binary Table". This is something Windows does, and there is no way to turn this off. To me, this is the bigger story, because vendors may now start to use this method to install anything, making a clean windows install impossible.
* Lenovo uses this method if you try to install Windows 8, but if you install Windows 7, it does the sketchy "overwrite your system file (autochk.exe)" method instead.
* Either way, Lenovo installs a service on your PC. It was found to have security bugs. I can't find the link, but they said this was placed on some laptops/PC's from late 2014 to Summer 2015. They've released a new firmware 2 weeks ago that turns this off.
I would like to know if any non-Lenovo pc's have used this "Windows Platform Binary" method to run software from the firmware, because when I searched for it, I saw people with Dell's and HP's who thought they might have a virus, posting scan logs that contained the text "wpbbin.exe" (which would only be there if Windows found it in the BIOS and put it there) For example see https://www.google.com/search?q="wpbbin.exe"+site%3Aforums.m...
Check your PC:
Windows 8 and up: Check your event log for "Microsoft-Windows-Subsys-SMSS" and if you see "A platform binary was successfully executed." your PC vendor is doing this. Or, look for a file called wpbbin.exe in windows\system32. (This file would ONLY exist if Windows found it in your firmware and ran it.)
Windows 7: Verify your autochk.exe is legit. I think you could simply do: "sfc /VERIFYONLY" in cmd.exe (as Admin) but I did not test it. My autochk.exe was signed by Lenovo in 2014 (which tipped me off it didn't come from the Windows 7 DVD I got in 2010!).
"a security vulnerability that was discovered ..by an independent security researcher, Roel Schouwenberg... As a result of these findings, Microsoft recently released updated security guidelines...on how to best implement this Windows BIOS feature."
I would be interested to see if any other manufacturers are doing this as well.
You can easily check: if a file called wpbbin.exe is in your windows\system32 directory, that means Windows found and executed code that was in your firmware.
Or, see if your autochk.exe hash isn't from Microsoft (paste the hash into virustotal) If OK, virustotal would say, "Trusted source! This file belongs to the Microsoft Corporation software catalogue."
I ask because last month, when I searched for "wpbbin.exe" I found lots of people who thought they had viruses, posting scan logs to various sites, and the scan logs mentioned this file as well as things that looked like Dell and HP stuff. "Wpbbin.exe" is a file that would only exist in your system32 if Windows found it in your firmware.
"If LSE is not enabled, it will not be shown under the “Security” tab in the system BIOS and the user is not affected"
FYI, This was not true for me - there was no option in the BIOS regarding this. So I'd say, the lack of this in your BIOS setup screen does NOT mean it is not there!
No - see my reply to the Ars thread. Windows 8 introduced an "official" way to do this called "Windows Platform Binary Table". Every time Windows boots, it checks your ACPI table for an entry called "WPBT", writes that to disk as "wpbbin.exe", and executes it. There does not seem to be any way to disable this behavior in Windows. Truecrypt would not help in this case because it happens after boot.
I just replied to the Ars thread - it's even stranger. Windows 8 and up have an officially Microsoft sanctioned way of letting manufacturers load software through Firmware, called "Windows Platform Binary Table". It means it is impossible to do a clean install of Windows now. I've seen zero mention of it anywhere - maybe Lenovo was the first to pull the trigger and make use of it recently.
There is no setting I can see to opt-out of what the Lenovo is doing. It's not an anti-theft software, it's software that makes popups appear, asking you to install their software.
I had this happen to me a few weeks ago, on a new Lenovo laptop, doing a clean install with a new SSD, Win 8 DVD + wifi turned off. I couldn't understand how a Lenovo service was installed and running! Delete the file and it reappears on reboot. I've never seen anything like this before.
Something to think about before buying Lenovo. I searched and found almost nothing about this, so it may be something they started doing in the last few months...
> every civilization must regard every other civilization as an existential threat
I've wondered about this! If "the singularity" is something that really can happen, then perhaps it IS wise to fear any civilization that has developed basic computing, as it could quickly spawn an incredibly advanced, immortal being in a very short amount of time.
And if it can happen, then I'm sure at some point in history, an AI did take hold somewhere. Realizing how dangerous this whole singularity thing can be, it sought out the destruction of any biological life that could someday create their own singularity.
I've wondered if the Fermi paradox is simply that a few AI's developed long ago, and decided not to take any chances.
I don't think you need to buy them (unless you want to gamble on their value going up) - just be willing to accept them as payment in the future. As more people see they can easily spend bitcoin, they become more willing to accept it as payment, and the userbase grows (bringing more price stability, hopefully)
Speaking of large gaps between primes - There is a Bitcoin clone recently released called "Gapcoin" which replaces the SHA256 hash-breaking with finding large prime gaps. It seems completely unknown and has very few people mining it, yet it already broke a few hundred records, and is one spot away from breaking Donald Knuth's record in the "top 20 highest merit gaps"
I am curious if there is any scientific use for finding these high-merit gaps? Or is it the same usefulness as finding a slightly longer expansion of PI?
This might sound corny, but you are my favorite gadfly. I've seen many posts from you over the years on slashdot and HN pointing out flaws with things I love such as python, and now lately bitcoin. I don't always agree with you, but I'm glad you're around.
I think even more interesting is the idea of "colored coins" that represent actual items.
I'd start playing Magic: The Gathering again if the digital cards I bought were colored coins or counterparty-style tokens that I controlled, and could trade outside of the game.
If the game itself was open source and p2p, even better - there would be no worry of the company shutting down the servers/abandoning the game. The community could take over and make improvements to the client if needed. The initial creation of the game would be funded by selling the digital cards.
http://thenextweb.com/insider/2015/08/12/lenovo-used-a-hidde...