The security breach of Lenovo computers - and this, unfortunately, is not new

Do not have time for the owners of Lenovo laptops to disappear frustration from the previous puncture in the security of computers , as they suffered a new attack. IOActive, a computer security company, reports a flaw in its proprietary software update system. The hole allows hackers to install their programs on the victim’s computer instead of being updated, and to remotely execute commands on behalf of the system.

The first defect is found in the update program that downloads executable files from the Internet and launches them. For security reasons, files are electronically signed, but the update program incorrectly verifies its authenticity, not fully processing the trust chain of certification authorities. A hacker, acting as MitM somewhere in a cafe, where the user decided to update his software (there is even the term "coffee shop attack"), is able to replace the executable files with his programs, and the update will accept them as relatives, because he does not recognize a fake.

The second drawback of the update program is to check the files for a signature while they are in a directory that has write access for any user. Theoretically, a locally malicious program that is running can replace the executable files between the end of the authentication check and the launch of the executable file.
')
The third problem relates to the actual system update process. These actions require system privileges, so the process running from the user SYSTEM is responsible for updating. It accepts commands for updates from the user without privileges. And although for security reasons the update process requires authentication from the user, in fact, the identification tag is easily forged, which allows the user to execute commands on behalf of the system without privileges.

Vulnerabilities are present both in the version of the Lenovo System Update 5.6.0.27 update, and in earlier versions.