LG monitors silently install software through Windows Update without consent

Article URL: https://videocardz.com/newz/lg-monitors-silently-install-software-through-windows-update-without-user-consent

Comments URL: https://news.ycombinator.com/item?id=48956688

Points: 469

# Comments: 239

Hacker News 讨论

479 points · 246 comments · 查看原帖

devttyeu
This is so much worse that the title makes it out to be: 1. Your OS installs malware (technically manufacturers software) from a 3rd party vendor in background, zero user interaction 2. Happens as soon as you or anyone with physical access plug in a device into the HDMI port 3. That malware has internet and full system access, no sandboxing 4. It starts with every system boot 5. This software gets installed when you plug in a new LG monitor 6. OR ALREADY HAD AN OLDER LG MONITOR PLUGGED IN, BECAUSE LG APPARENTLY ROLLED THIS OUT FOR MANY OLDER MODELS TOO!! 7. And yes, if you think that's horrendous, as mentioned in the video below, that also applies to 'Professional' LG monitors! This situation has.. no precedent as far as I can tell.. GamersNexus has a video diving deeper into what LG did here - https://www.youtube.com/watch?v=Q9uefFYe6bM
delta_p_delta_x
Workaround: gpedit.msc Computer Configuration > Administrative Templates > System > Device Installation Prevent automatic download of applications associated with device metadata Set to enabled OK On home editions sans gpedit.msc: sysdm.cpl Hardware tab Click Device Installation Settings Under 'Do you want to automatically download manufacturers' apps for your devices?', select 'No' Save Changes
tialaramex
Assuming they don't get a revenue cut, pushing back on Microsoft can in principle be effective here. Microsoft decides what happens here, and presumably today they just take it on trust that hardware makers know what software to install. New driver? Sure. McSpam installer? OK. Maybe they have a guideline saying "Don't ship unrelated garbage" but today it's not enforced because why would you do that? If the Microsoft customers (particularly larger corporate customers) tell Microsoft they hate this that policy will get tightened or if there isn't a policy one is introduced, and outfits like LG get told if you do this again we're taking away your update privileges, 'cos our customers hated this. Because (as I said assuming MS don't get a taste) this is all downside for Microsoft. Pushing back on LG will be less likely to work because you already bought their product, so at most you can insi
gkbrk
A monitor cannot install software on your computer by the way. It's Windows installing this software automatically (for some reason), so the blame should be on Microsoft. Autorun of malware when you plugged in a USB drive was also a Windows issue, I'd classify this as the same security problem.
GaProgMan
Gamers Nexus have a video about this. Definitely worth a watch. https://www.youtube.com/watch?v=Q9uefFYe6bM
throwatdem12311
Installing drivers and software for connected hardware is just something Windows has done through Windows update for a long time. Is this a good practice? I don’t really know. We used to get drivers on CDs, but barely anyone has a drive on their computer anymore. You could download them from the vendor website but these are usually a mess and very difficult to navigate to find the right thing — impossible for your grandma. Could do like Linux and just build trusted software right into the kernel - but then people will complain about bloat. So we are where we are. I guess.
kingleopold
They used to call this spyware/malware. Now it's a regular practice by eng. teams and managers inside these big corp. Well played guys :) Congrats with new type of tricks
motbus3
I am tired of this. LG is now on my blacklist alongside EA and Blizzard Entertainment for their anti consumer practices. I can't change them, I can't change policies about it. I can choose to not buy.