Bloatware from 5 Major PC Firms 'A Security Risk'

A security firm says that laptops from five major PC manufacturers have inherent security flaws which make the systems open to attack the very first time they are used. The problem deals with the automatic update tools installed by the manufacturer.

Duo Labs explored the pre-installed manufacturer software on laptops from Acer, Asus, Dell, HP and Lenovo. In total, they found 12 vulnerabilities which they described as being ridiculously simple to exploit. (Source: duo.com)

The software is what's officially known as Original Equipment Manufacturer (OEM) software, but commonly referred to by critics as "bloatware" or "crapware". Among the examples are software that automatically registers a computer for support services, software that checks for outdated drivers, and limited-time free trials of security software. Such software often slows down computers by needlessly using memory or automatically starting at bootup.

Updater Tools A Particular Problem

One of the big security concerns identified by Duo Labs was that all five companies preinstalled 'updater tools' which had at least one security vulnerability. The most common problem was that these tools did not properly check whether or not they were were connecting to the intended target server to find and download new software, similar to the exploit discovered in November 2015 with Dell machines. In many cases, they were also failing to check that the downloaded software was authentic before installing.

To make things worse, many of these tools are setup to run code as the SYSTEM user. That means they have complete access to the entire computer and operating system, in turn meaning the potential damage from any breach is much more serious.

Another problem was that the preinstalled software was often set up and added to the machine in an inconsistent and illogical manner. In some cases, multiple pieces of bloatware on the same machine were set up in different ways, making it harder to track and fix any vulnerabilities.

Microsoft Anti-Bloatware Program Flawed

The researchers also found that a Microsoft program called Microsoft Signature Edition, which is designed to show a computer has a "clean" version of Windows without any bloatware, is no guarantee that this will be the case.

According to the researchers, users have two main options to mitigate these risks. One is to disable or uninstall any preinstalled software that doesn't appear to be genuinely necessary and useful. Another is to completely wipe the hard drive and reinstall a fresh copy of Windows obtained directly from Microsoft. (Source: cnet.com)

What's Your Opinion?

Have you encountered problems with bloatware on a new laptop? If so, what's your strategy for dealing with it? Can such preinstalled programs have enough benefit to outweigh the risks?