Another day, another security flaw, and this time yet again, it’s Lenovo who is at the center of the problem, although for once, it appears that the blame may fall more at Intel’s feet than that of the notebook maker.
Security researcher Dymtro “Cr4sh” Oleksiuk has shared details of a security flaw that he found in Lenovo PCs as well as at least one made by HP. The flaw itself could theoretically allow attackers to find their way around basic security systems built into Microsoft’s Windows operating system, with the issue itself being caused by a firmware driver that was created by copying code created by Intel. It’s for this reason that Intel may be on the hook here.
For its part, Lenovo says that the firmware was not created by itself, but rather a third-party. Yet to name or specifically blame that third-party, Lenovo says that it tried to contact Oleksiuk directly before he made the information public, but was unable to. Lenovo does, however, go on to say that it is going to work to correct the issue, involving its partners along the way. You can bet your bottom dollar that one of those partners will be Intel.
While there hasn’t been a huge suggestion that the flaw could potentially have been placed there on purpose to allow a backdoor into its systems, Lenovo has already said that it will investigate what the vulnerable code’s original purpose was, suggesting that a conversation surrounding the possibility has been had within the company.
The package of code with the SMM vulnerability was developed on top of a common code base provided to the IBV by Intel. Importantly, because Lenovo did not develop the vulnerable SMM code and is still in the process of determining the identity of the original author, it does not know its originally intended purpose. But, as part of the ongoing investigation, Lenovo is engaging all of its IBVs as well as Intel to identify or rule out any additional instances of the vulnerability’s presence in the BIOS provided to Lenovo by other IBVs, as well as the original purpose of the vulnerable code.
This isn’t the first time that Lenovo has been caught shipping machines with suspect apps and code installed, so we expect it to pull out all the stops in order to put things right this time around.
(Source: Cr4sh [GitHub])
You may also like to check out:
You can follow us on Twitter, add us to your circle on Google+ or like our Facebook page to keep yourself updated on all the latest from Microsoft, Google, Apple and the web.