At this point, very little surprises me, but this really does.

PC makers (yes, even the big ones – Acer, Asus, Dell, HP and Lenovo) install crap/bloatware on your brand new device, to profit from both ends. They install programs of little value to you, but plenty to them as they are paid to install them by the programs’ makers in the hope you’ll subscribe, after a “trial period”.

Well, when you try the programs for the first time, and subsequently, their “automatic updaters” go to work, to make sure you’re “up to date”.

They download binary files which then execute.

"…top-tier software updaters, like those operated by Microsoft and Apple, aggressively secure the process. The most important components of that lock-down, said Duo: Encrypting the device-to-server-and-back traffic using the TLS (transport layer security) protocol, the successor to SSL (secure sockets layer); and digitally signing every update's "manifest," or list of files, so that it can't be changed.

Too bad no one told the OEM updaters' programmers that.

It's a combination of these two things," said Manzuik, referring to encryptionand signing being omitted.

But the lack of manifest signing was the key, according to Darren Kemp, a Duo security researcher. "The manifest drives the updates," Kemp said. "[Only one] was signed at all. If the OEMs had implemented this properly, it would have stopped almost every attack. 'Egregious' really is the word to describe [the OEMs' failures.]"

Duo found security flaws in every one of the updaters it looked at, and with the lack of encryption and manifest signing, judged exploiting those vulnerabilities as trivial, or in the words the company used in a supporting blog post written by Kemp, "The level of sophistication required to exploit most of the vulnerabilities we found is somewhere between that possessed by a coffee stain on the Duo lunch room floor and your average potted plant." – Computerworld

My best recommendation? Uninstall every program you do not need and actively use. If there’s nothing to update, there’s no vulnerability. In fact, with any device you own, uninstall what you don’t need/use, clean the registry (after making a registry backup) and then defrag your disk.

Then, make an external backup.

You might even see a little improvement in speed.

Have a good weekend!

Source:

http://www.computerworld.com/article/3078778/windows-pcs/windows-pc-makers-hang-customers-out-to-dry-with-flawed-crapware-updaters.html