Lenovo does it again as LSE component removed after security fears

Six months after apologising to users for pre-installing security-busting malware Superfish on its consumer laptops, Chinese PC manufacturer Lenovo has again had to remove another pre-installed component from its laptops over security fears.

But this time, the problem software, called the “Lenovo Service Engine (LSE)”, is built into the firmware of the laptops themselves, in a low-level operating system called the BIOS, invisible even to Windows. (The BIOS is what is running the screens of white-on-black text seen on many computers as they start up). It launches when the computer is turned on, before Windows loads, and then replaces Microsoft’s start-up diagnostics program (which ensures that the system was shut down properly, that the disk isn’t corrupted, and that it’s safe to launch Windows) with its own.

Lenovo’s version does all the same things as Microsoft’s, but two more: it ensures that Lenovo’s own software update tools are still installed on the computer, and if they aren’t, it re-installs them.

Those tools then run to download and install drivers, keeping the computer up to date; but they also install and update the various other programs that come preinstalled on Lenovo computers, the so-called “crapware”.

As with Superfish, the LSE provides scant benefits to the end user. It’s buried so deeply into the system that it’s very hard to remove, meaning that if a user wants to restore their system to a “clean” installation of Windows, with no superfluous programmes, the LSE will still be there, and will reinstall the other Lenovo tools on the next restart.

But, again like Superfish, LSE goes beyond annoyance, into pure security vulnerability, after researcher Roel Schouwenberg discovered how to use the tool to perform a “privilege escalation” attack, which would let a hacker gain greater control over a vulnerable computer.

As a result, Lenovo quietly released two tools in late July to uninstall the LSE code, one for laptops and one for desktops.

The company says: “In coordination with Mr Schouwenberg and in line with industry responsible disclosure best practice, on 31 July 2015, we issued Lenovo Product Security Advisories, that highlighted the new BIOS firmware – specifically for consumer notebook and desktop. Lenovo always strongly recommends that users update their systems with the latest BIOS firmware. Starting in June, the new BIOS firmware has been installed on all newly manufactured Lenovo consumer notebook and desktop systems.”

It also released a list of the affected models, which did not include any of the company’s ThinkPad range of business machines.

Shortly after the news broke that LSE was insecure, Microsoft updated its guidelines on how software like it should work, effectively banning Lenovo from shipping it. The company says: “As a result of these findings, Microsoft recently released updated security guidelines on how to best implement this Windows BIOS feature. Lenovo’s use of LSE was not consistent with these new guidelines. As a result, LSE is no longer being installed on Lenovo systems. It is strongly recommended that customers update their systems with the new BIOS firmware which disables and or removes this feature.”

The news is likely to restart the debate that began when the Superfish vulnerability was revealed, over the extent to which PC manufacturers are forced by ultra-slim margins to include features that go against their customers’ best interests. After Superfish, the company promised to install no more bloatware – but as the LSE problem shows, definitions of what exactly that entails are slippery to pin down.