Lenovo Has Backdoors in its Computers

By 

 

  •  
  • 0

Lenovo logo

Lenovo engineers have discovered a backdoor in the firmware of RackSwitch and BladeCenter networking switches. The company released firmware updates earlier this week.

The Chinese company said it found the backdoor after an internal security audit of firmware for products added to its portfolio following the acquisitions of other companies.

Backdoor added in 2004

Lenovo says the backdoor affects only RackSwitch and BladeCenter switches running ENOS (Enterprise Network Operating System).

The backdoor was added to ENOS in 2004 when ENOS was maintained by Nortel's Blade Server Switch Business Unit (BSSBU).

Lenovo claims Nortel appears to have authorized the addition of the backdoor "at the request of a BSSBU OEM customer." In a security advisory regarding this issue, Lenovo refers to the backdoor under the name of "HP backdoor."

The backdoor code appears to have remained in the firmware even after Nortel spun BSSBU off in 2006 as BLADE Network Technologies (BNT).

The backdoor also remained in the code even after IBM acquired BNT in 2010. Lenovo bought IBM's BNT portfolio in 2014.

Updates released for Lenovo and IBM switches

"The existence of mechanisms that bypass authentication or authorization are unacceptable to Lenovo and do not follow Lenovo product security or industry practices," Lenovo said. "Lenovo has removed this mechanism from the ENOS source code and has released updated firmware for affected products."

Updates are available for both newer switches wearing the Lenovo branding, but also for older IBM-branded switches still in circulation and running ENOS. A list of switches that received firmware updates, along with download links for the firmware, are available in a Lenovo security advisory.

Lenovo said the backdoor is not found in the CNOS (Cloud Network Operating System), so switches running this OS are safe.

Backdoor is hard to exploit

The so-called "HP backdoor" is not a hidden account, but an authentication bypass mechanism that occurs under very strict conditions.

RackSwitch and BladeCenter switches support various authentication methods, via SSH, Telnet, a web-based interface, and a serial console.

An attacker can exploit this backdoor and bypass authentication when affected switches have various authentication mechanisms and security features turned on or off. Lenovo describes the various configurations in which the backdoor becomes active in the aforementioned security advisory.

If customers using these switches can't update right away, there are mitigations they can apply and prevent the backdoor from activating.

This issue is tracked under the CVE-2017-3765 identifier.

  •  

Spy agencies shun Lenovo, finding backdoors built into the ...

Recent news revealing that spy agencies in the US, Britain, Canada, Australia, and New Zealand have prohibitions against using the company's products seem to be based ...

https://www.geek.com/chips/spy-agencies-shun-lenovo-finding-ba...

Lenovo Discovers and Removes Backdoor in Networking Switches

Lenovo engineers have discovered a backdoor in the firmware of RackSwitch and BladeCenter networking switches. The company released firmware updates earlier this week.

https://www.bleepingcomputer.com/news/security/lenovo-discovers-and-remove...

Lenovo PCs and Laptops seem to have a BIOS level backdoor

The Chinese computer and laptop maker, Lenovo is once again in the eye of the storm after users have found that their PCs/Laptops are shipped with a hidden backdoor ...

https://www.techworm.net/2015/08/lenovo-pcs-and-laptops-seem-to-ha...

Lenovo Installs Backdoor Malware on Its PCs Usable by Anyone ...

Computer maker Lenovo has been caught shipping computers installed with software that gives it, or a malicious hacker, backdoor access to the PC. Lenovo claims the ...

https://www.macobserver.com/tmo/article/lenovo-installs-backdoor-malw...

Lenovo spotted and fixed a backdoor in networking ...

Lenovo discovered a firmware backdoor in RackSwitch and BladeCenter networking switch families during an internal security audit.

https://securityaffairs.co/wordpress/67729/hacking/lenovo-backdoor-n...

Lenovo issues patch for backdoored networking switches ...

Lenovo blames defunct Nortel for long-standing backdoor in Lenovo network switches

https://www.computing.co.uk/ctg/news/3024396/lenovo-issues-patch-for-...

Lenovo caught with another backdoor (BIOS level) : linux

use the following search parameters to narrow your results: subreddit:subreddit find submissions in "subreddit" author:username find submissions by "username"

https://www.reddit.com/r/linux/comments/3gpahq/lenovo_caught_wit...

Lenovo : removes backdoor present in networking switches ...

Engineers at Chinese firm Lenovo have identified a backdoor in the networking switched namely Rackswitch and BladeCenter firmware. The company stated that the ...

4-traders.com/LENOVO-GROUP-LIMITED-1412726/news/Lenovo-...

Lenovo Caught (3rd Time) Pre-Installing Spyware on its Laptops

Lenovo has once again been caught installing spyware on its laptops and workstations without the user's permission or knowledge. One of the most popular computer ...

https://thehackernews.com/2015/09/lenovo-laptop-virus.html

Lenovo Backdoor Malware | Hacking | Cyber Security

Learn What is Lenovo Backdoor Malware? Read more in-depth articles about Lenovo BackdoorMalware, the hacker news, hacker news, cyber security news, the fappening ...

https://thehackernews.com/search/label/Lenovo Backdoor Malware

Lenovo Support - Home Global Support

Lenovo Global Support Home. Lenovo Global Support Home ...

support.lenovo.com

Military Warns Lenovo Poses Cyber Spy Threat

The Pentagon's Joint Staff recently warned against using equipment made by China's Lenovocomputer manufacturer.

freebeacon.com/national-security/military-warns-chinese-...

Lenovo used third 'worst password' in file-sharing backdoor ...

Lenovo used third 'worst password' in file-sharing backdoor flaw. You would think the tech giant would know better than to use one of the most obvious, lazy passwords ...

zdnet.com/article/lenovo-used-third-worst-password-...

Types of password for ThinkPad - Lenovo Support

As many as four passwords may be needed for any ThinkPad computer: the power-on password, the hard-drive password, and the supervisor password. This document explains ...

https://support.lenovo.com/us/en/solutions/ht036206

Western spooks banned Lenovo PCs after finding back doors ...

Chinese PC giant Lenovo has been banned from supplying kit for the top secret networks of western intelligence agencies after security concerns emerged when backdoor ...

https://www.theregister.co.uk/2013/07/29/lenovo_accused_backdoors_intel...

Spy agencies ban on Lenovo PCs due to backdoor ...

Spy agencies reportedly have a long-standing ban on Lenovo PCs due to backdoor vulnerabilities that could allow attacker to remotely access to the computers

https://securityaffairs.co/wordpress/16748/hacking/spy-agencies-ban-...

Lenovo Discovered a Backdoor in Network Switches Which Allows ...

Lenovo discovered a backdoor in network switches that powered by Enterprise Network Operating System firmware during the security audit by ...

https://www.secnews24.com/2018/01/14/lenovo-discovered-a-backdoor-i...

Lenovo Discovers and Removes Backdoor in Networking Switches ...

Lenovo engineers have discovered a backdoor in the firmware of RackSwitch and BladeCenter networking switches. The company released firmware updates earlier this week.

https://pcnutsandbolts.com/cybercrime/security/lenovo-discovers-and-...

Lenovo Discovered a Backdoor in Network Switches that perform ...

Lenovo discovered a backdoor in network switches that powered by Enterprise Network Operating System firmware during the security audit by Lenovo

https://gbhackers.com/lenovo-discovered-backdoor/

Lenovo Discovers and Removes Backdoor in Networking Switches ...

Lenovo engineers have discovered a backdoor in the firmware of RackSwitch and BladeCenter networking switches. The company released firmware updates

https://forums.lenovo.com/t5/Security-Malware/Lenovo-Discovers-and-...

Lenovo's instructions for removal - forums.lenovo.com

LENOVO STATEMENT ON SUPERFISH At Lenovo, we make every effort to provide a great user experience for our customers. We know that

https://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-Instru...

Backdoor Found in Lenovo, IBM Switches | SecurityWeek.Com

Vulnerability described as a backdoor patched in Flex System, RackSwitch and BladeCenter switches from Lenovo and IBM

securityweek.com/backdoor-found-lenovo-ibm-switches

Lenovo finds and removes backdoor from two switch models - iTWire

Lenovo has found a backdoor in two of its switches that could give an attacker access to the switch management interface and allow settings to be chan...

https://www.itwire.com/security/81401-lenovo-finds-and-removes-b...

Spy Agencies Found Back-Door Vulnerabilities in Lenovo PCs

Spy agencies in the UK, Australia and the US have banned use of Lenovo PCs because of remote access vulnerabilities that were discovered during testing.

https://thenextweb.com/asia/2013/07/26/spy-agencies-reportedly-h...

Report: Pentagon Warns Against Use of Lenovo Computers over ...

The Pentagon has warned against the use of Lenovo technology over concerns that the Chinese computer manufacturer is spying on government officials.

breitbart.com/tech/2016/10/24/report-pentagon-warns-aga...

Corporate espionage or fearmongering? The facts about ...

The facts about hardware-level backdoors. ... aren't made by Lenovo, there are few opportunities for Lenovo to introduce a hardware-level backdoor in a way that ...

https://www.techrepublic.com/blog/it-security/corporate-espionage-or-f...

In Lenovo and IBM switches detected a backdoor - CybersNews.net

Lenovo reported on the discovery of a backdoor (CVE-2017-3765) in the ENOS (Enterprise Network Operating System) operating system, which is supplied on some models of ...

https://cybersnews.net/in-lenovo-and-ibm-switches-detected-a-bac...

Security: Lenovo-Switches hatten seit 2004 Backdoor ...

Lenovo musste eingestehen, dass mehrere Netzwerkswitches seit 2004 mit einer Backdoorversehen waren.

https://www.notebookcheck.com/Security-Lenovo-Switches-hatten-seit-2004...

Critical security flaw found in Lenovo PCs... again

If you are sick of hearing about how Lenovo Machines are riddled with ... Critical security flaw found in Lenovo PCs ... but placed there as a backdoor.

  •  
  •  
  •  
  •  
  •  

 

  •  
  •  
  •  
CATALIN CIMPANU  

Catalin Cimpanu is the Security News Editor for Bleeping Computer, where he covers topics such as malware, breaches, vulnerabilities, exploits, hacking news, the Dark Web, and a few more. Catalin previously covered Web & Security news for Softpedia between May 2015 and October 2016. The easiest way to reach Catalin is via his XMPP/Jabber address at campuscodi@xmpp.is. For other contact methods, please visit Catalin's author page.