Technoglitch
Core Member
The flaws were first detected in February, with the patch released in April; however IOActive’s findings weren’t released until this week.
They include a vulnerability which would allow both attackers to “bypass signature validation checks and replace trusted Lenovo applications with malicious applications”.
This would put users at risk of ‘drive-by’ attacks, which often target users connected to unsecured public Wi-Fi networks.
The attacker could “exploit this to swap Lenovo’s executables with a malicious executable”, the researchers wrote, as Lenovo does not ‘completely verify’ all the files it downloads as part of any system update.
This “high”-rated flaw affects all ThinkPad, ThinkCenter, and ThinkStation products, along with V, B, K, and E-series machines.
Lenovo Laptops Found To Have More Major Security Flaws
They include a vulnerability which would allow both attackers to “bypass signature validation checks and replace trusted Lenovo applications with malicious applications”.
This would put users at risk of ‘drive-by’ attacks, which often target users connected to unsecured public Wi-Fi networks.
The attacker could “exploit this to swap Lenovo’s executables with a malicious executable”, the researchers wrote, as Lenovo does not ‘completely verify’ all the files it downloads as part of any system update.
This “high”-rated flaw affects all ThinkPad, ThinkCenter, and ThinkStation products, along with V, B, K, and E-series machines.
Lenovo Laptops Found To Have More Major Security Flaws
