top 50 comments

sorted by: hot top controversial new old
[–] 382 points 2 years ago (38 children)

When you turn on your PC and notice that there’s a huge Christmas banner on your desktop, do not panic – your device is not compromised.

Hah, well a vendor just pushed unapproved executable to the device and ran it without consent. Under any definition or other context it's definitely compromised.

  • source
  • hideshow 38 child comments
  • [–] 112 points 2 years ago (28 children)

    This is why I boycott Logitech, they started pushing the Logitech Download Assistant through Windows Update as soon as you connect a Logitech mouse/keyboard.

    It autoruns not only when it is first installed but on every startup.

    It is rather annoying to try and uninstall it, I don't get why there has been so little backlash against this....

    Microsoft permitting this is devaluing Windows Update, the driver (.inf) should be installed automatically, any executable file that WU wants to download and run on your computer should just bring up a small Windows notification saying something like this:

    The device you just installed requests to download and run the following program from Windows Update:

    Logitech Download Assistant

    Will you approve or reject this request? Approve/Reject

    It is just terrible that this is permitted

  • source
  • parent
  • hideshow 28 child comments
  • load more comments (26 replies)
  • [–] 42 points 2 years ago (8 children)

    Welp, seems ASUS motherboards also push this by default: https://www.techpowerup.com/248827/asus-z390-motherboards-automatically-push-software-into-your-windows-installation

    During testing for our Intel Core i9-9900K review we found out that new ASUS Z390 motherboards automatically install software and drivers to your Windows 10 System, without the need for network access, and without any user knowledge or confirmation. This process happens in complete network-isolation (i.e. the machine has no Internet or LAN access).

  • source
  • parent
  • hideshow 8 child comments
  • load more comments (8 replies)
  • [–] 380 points 2 years ago (25 children)

    If it's unwanted, disruptive, and (allegedly) impacts performance, that's not "malware-like". It's malware.

  • source
  • hideshow 25 child comments
  • [–] 17 points 2 years ago* (last edited 2 years ago) (4 children)

    I think the title indicates that it's like the malware known as "Christmas.exe".

    Edit: I have too much faith in humanity..

  • source
  • parent
  • hideshow 4 child comments
  • [–] 167 points 2 years ago* (last edited 2 years ago) (9 children)

    Who green lit this? I really hope that person gets fired immediately.

    The lack of any visual link to ASUS isn't even the biggest problem for me; it's that ASUS rolls out a program that (presumably) puts itself in autostart by default and just pops up without prompt at all.

    Edit: There's a fucking setting in the BIOS to auto-install ASUS' bullshit software? And it's enabled by default.... jesus fucking christ

  • source
  • hideshow 9 child comments
  • [–] 56 points 2 years ago* (1 child)

    Most computers firmware can store a Windows executable. Microsoft pushed for an addition to the ACPI tables called WPBT. That stores a Windows exectuable in the firmware. It is of course totally used for the intended purpose...

  • source
  • parent
  • hideshow 1 child comment
  • [–] 49 points 2 years ago

    I'm always dismayed but not surprised by how many people don't know about Windows Platform Binary Table, which has existed since Windows 8. It's not exactly the type of feature that Microsoft or the board vendors would want to publicize, seeing as it gives them persistent rootkit capabilities on the same level as UEFI rootkits.

    Most normal people's model of Windows security is "if something goes wrong then I wipe the disk and reinstall Windows," and WPBT completely breaks that model, and has been doing so for 12 years.

    Thankfully there are ways to disable it:

    https://github.com/Jamesits/dropWPBT

  • source
  • parent
  • load more comments (7 replies)
    [–] 137 points 2 years ago* (45 children)

    It is a part of the ASUS Armoury Crate software that is pre-installed on some ASUS PCs.

    Always flash new OS if you buy a computer.

  • source
  • hideshow 45 child comments
  • [–] 123 points 2 years ago* (12 children)

    That won’t get rid of it unless you also manually go into the BIOS and disable the install ASUS Armoury Crate setting as explained in the article.

    If you don’t do this it will automatically reinstall even on a fresh install of Windows. Some of these bloatware programs will even install without an internet connection! This absolutely ludicrously stupid feature is called WPBT and is used by lots of manufacturers. Luckily it doesn’t work on Linux (at least for now…).

  • source
  • parent
  • hideshow 12 child comments
  • load more comments (5 replies)
  • [–] 69 points 2 years ago (15 children)

    That's in the bios, it's a pcie device that windows allows to inject root level code into your environement, you have to turn it off and hope nothing ever spoofs that pcie id because that's a permanent hardware rootkit into your pc like EFI

  • source
  • parent
  • hideshow 15 child comments
  • load more comments (2 replies)
  • load more comments (13 replies)
    [–] 66 points 2 years ago (2 children)

    I'd love to know if this was just some guy who went 'let's ship it to all our customers!' or if this was a C-level 300 hours of meetings type of thing which concluded that spreading christmas malware cheer was the right move.

  • source
  • hideshow 2 child comments
  • [–] 59 points 2 years ago (5 children)

    You just cant make this shit up. Truly is year of the linux desktop.

  • source
  • hideshow 5 child comments
  • [–] 19 points 2 years ago (3 children)
  • load more comments (1 reply)
    [–] 58 points 2 years ago (5 children)

    "do not panic – your device is not compromised."

    meme(always has been)

  • source
  • hideshow 5 child comments
  • [–] 23 points 2 years ago (3 children)

    There is nothing wrong with your device. Do not attempt to adjust the picture. We control the horizontal. We control the vertical.

  • source
  • parent
  • hideshow 3 child comments
  • load more comments (1 reply)
  • [–] 45 points 2 years ago* (4 children)

    Why don't every vendor with an installed app make a similar banner?
    It would be so festive, and I bet people would love it, to have 20 or 30 such occurrences every time you need to use your computer during holidays.
    It would of course be optimal if each has an animation and a tune, that need to finish before you can escape.
    Weird that only Asus had this brilliant idea? It's so awesome when you are not in control of what happens on your computer.
    /s

    If you want to take back control, Linux is your best option.

  • source
  • hideshow 4 child comments
  • load more comments (1 reply)
    [–] 40 points 2 years ago

    The manager who approved this need to be fired. Programs need to ask permission to the user before installing, especially when they're not device drivers.

    This is literal malware and there's also a chance that it might be exploited (example: a mitm Attack exchanges the file that armory crate is downloading)

    This kind of Easter egg is not funny at all, developers must avoid undocumented time bombs. I still remember that day 15 years ago when I turned on my Wii and it said that the system files were corrupted. After hours of reverting a full nand backup via bootmii (and losing 2 years of game saves) it turned out that it was a funny April's fool by crediar, which put a fake system corruption message when you run his program on April 1st. Problem is that his program was a loader for the system menu so it was unavoidable if you didn't know that.

    Like me, there must be someone paranoid that saw that black bar on the screen, saw a weird Christmas.exe running on their system, and starting wiping or restoring old images to "clean" that.

  • source
  • [–] 39 points 2 years ago* (last edited 2 years ago)

    everyone submit a help desk ticket to Asus asking wtf is going on

  • source
  • [–] 31 points 2 years ago

    WDYM "malware like"? It is malware.

  • source
  • [–] 30 points 2 years ago

    Somebody should create a windows executable to be placed in the WPBT that silently install Linux on first windows boot....

  • source
  • [–] 29 points 2 years ago (1 child)

    the wreath has a memory leak

    modern app design and its consequences

  • source
  • hideshow 1 child comment
  • load more comments (1 reply)
    [–] 22 points 2 years ago

    An unsolicited Christmas card through a letterbox would have at least been less worrying.

  • source
  • [–] 19 points 2 years ago (1 child)

    Now ask the non-Christians need to do a class action lawsuit lol

  • source
  • hideshow 1 child comment
  • load more comments (1 reply)
    [–] 17 points 2 years ago* (last edited 2 years ago)

    Another reason to not buy any Asus stuff.

  • source
  • [–] 16 points 2 years ago

    How was this even approved for deployment?

  • source
  • [–] 15 points 2 years ago

    awesome, merry christmas

  • source
  • load more comments
    view more: next ›