Incident: Lenovo BIOS Firmware Vulnerability Incident in 2015.

Published Date: 2015-08-14

Postmortem Analysis
Timeline 1. The software failure incident involving the Lenovo Service Engine (LSE) happened in late July 2015 as mentioned in the article [39350].
System 1. Lenovo laptops' firmware (BIOS) including the "Lenovo Service Engine (LSE)" [Article 39350]
Responsible Organization 1. Lenovo [39350]
Impacted Organization 1. Users of Lenovo consumer laptops [39350]
Software Causes 1. The software cause of the failure incident was the pre-installed component called the "Lenovo Service Engine (LSE)" in the firmware of Lenovo laptops, which replaced Microsoft's start-up diagnostics program and ensured the installation and reinstallation of Lenovo's own software update tools and other pre-installed programs [39350].
Non-software Causes 1. Lack of proper oversight in the manufacturing process, leading to the inclusion of the problematic software in the firmware [39350].
Impacts 1. The software failure incident involving the Lenovo Service Engine (LSE) led to security vulnerabilities, allowing potential hackers to perform a "privilege escalation" attack, gaining greater control over vulnerable computers [39350]. 2. Lenovo had to quietly release tools in late July to uninstall the LSE code from affected laptops and desktops, indicating the need for immediate action to address the security risks posed by the software [39350]. 3. Microsoft updated its guidelines on how such software should work, effectively banning Lenovo from shipping the LSE, highlighting the serious implications of the software failure incident on industry practices and standards [39350].
Preventions 1. Conducting thorough security reviews and audits of all pre-installed software components before shipping the laptops [39350]. 2. Implementing strict guidelines and standards for pre-installed software to ensure they do not pose security risks [39350]. 3. Following industry best practices for responsible disclosure of security vulnerabilities and promptly releasing tools to address any identified issues [39350]. 4. Regularly updating BIOS firmware to disable or remove any potentially risky software components [39350].
Fixes 1. Uninstalling the Lenovo Service Engine (LSE) code using the tools provided by Lenovo [39350]. 2. Updating the BIOS firmware on affected Lenovo consumer notebook and desktop systems to remove the LSE feature [39350]. 3. Following Microsoft's updated security guidelines to ensure that similar software features are not implemented in a way that poses security risks [39350].
References 1. Researcher Roel Schouwenberg [39350] 2. Lenovo company statements [39350] 3. Microsoft updated guidelines [39350]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident has happened again at one_organization: Lenovo has faced another software failure incident with the pre-installed software called the "Lenovo Service Engine (LSE)" after the Superfish malware incident. The LSE, built into the firmware of Lenovo laptops, posed security risks and led to a privilege escalation attack vulnerability [39350]. (b) The software failure incident has happened again at multiple_organization: There is no information in the provided article to suggest that this specific software failure incident involving the Lenovo Service Engine (LSE) has occurred at multiple organizations.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the case of Lenovo's pre-installed software called the "Lenovo Service Engine (LSE)." This software, built into the firmware of laptops, replaced Microsoft's start-up diagnostics program with its own, ensuring that Lenovo's software update tools remained installed on the computer. However, this software posed a security vulnerability as researcher Roel Schouwenberg discovered how to use it for a "privilege escalation" attack, allowing hackers to gain greater control over vulnerable computers. Lenovo had to release tools to uninstall the LSE code and update BIOS firmware to address this issue [39350]. (b) The software failure incident related to the operation phase can be observed in how the LSE software, deeply embedded in the system, made it very hard for users to remove it. Even if a user wanted to restore their system to a clean installation of Windows, the LSE would still be present and reinstall other Lenovo tools on the next restart. This operational aspect of the software led to inconvenience for users and potential security risks due to the difficulty in removing the software [39350].
Boundary (Internal/External) within_system, outside_system (a) The software failure incident related to the Lenovo Service Engine (LSE) can be categorized as within_system. The LSE software was built into the firmware of Lenovo laptops themselves, in the BIOS, which is a low-level operating system invisible to Windows. It replaced Microsoft's start-up diagnostics program and ensured that Lenovo's own software update tools were installed on the computer. The LSE was deeply embedded into the system, making it hard to remove and had the capability to reinstall Lenovo tools even after a clean installation of Windows. Additionally, the LSE was found to have security vulnerabilities that could be exploited for privilege escalation attacks [39350]. (b) The software failure incident can also be considered as outside_system to some extent. After the vulnerability of the LSE was discovered, Microsoft updated its guidelines on how such software should work, effectively banning Lenovo from shipping it. This external action by Microsoft influenced Lenovo's decision to no longer install the LSE on their systems. The updated security guidelines from Microsoft played a role in shaping Lenovo's response to the software failure incident [39350].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in Article 39350 occurred due to non-human actions. The failure was related to the pre-installed software called the "Lenovo Service Engine (LSE)" built into the firmware of Lenovo laptops. This software, embedded in the BIOS, was designed to launch when the computer is turned on and replace Microsoft's start-up diagnostics program. The LSE was responsible for ensuring Lenovo's software update tools remained installed on the computer and re-installing them if necessary. Additionally, the LSE was discovered to have security vulnerabilities that could be exploited for a "privilege escalation" attack, allowing hackers to gain control over vulnerable computers. Lenovo released tools to uninstall the LSE code and updated its BIOS firmware to address the issue [39350]. (b) The software failure incident in Article 39350 was also influenced by human actions. Lenovo, as the manufacturer, made the decision to include the LSE software in the BIOS of their laptops. This decision was made despite the software providing minimal benefits to users and posing security risks. Additionally, Lenovo's actions in response to the discovery of the LSE vulnerability, such as quietly releasing tools to uninstall the software and updating BIOS firmware, were driven by human decisions within the company. Microsoft also updated its guidelines in response to the incident, effectively banning Lenovo from shipping similar software in the future [39350].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The article mentions that the problematic software, Lenovo Service Engine (LSE), is built into the firmware of the laptops themselves, specifically in the BIOS, which is a low-level operating system running before Windows loads [39350]. - The LSE software, embedded in the BIOS, replaces Microsoft's start-up diagnostics program and ensures that Lenovo's own software update tools are still installed on the computer [39350]. (b) The software failure incident related to software: - The Lenovo Service Engine (LSE) software, which was the cause of the security vulnerability, goes beyond annoyance into a pure security vulnerability as it was discovered to allow a "privilege escalation" attack by a hacker [39350]. - Microsoft updated its guidelines on how software like LSE should work, effectively banning Lenovo from shipping it, indicating a software-related issue [39350].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident related to the Lenovo Service Engine (LSE) can be categorized as malicious. The LSE software, built into the firmware of Lenovo laptops, was discovered to have a security vulnerability that could be exploited by hackers to perform a "privilege escalation" attack, allowing them to gain greater control over a vulnerable computer [39350]. This indicates that the software was designed in a way that could potentially harm the system and compromise user security, making it a malicious software failure incident.
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident related to poor decisions can be inferred from the article. Lenovo's decision to pre-install the "Lenovo Service Engine (LSE)" software into the firmware of their laptops, which went beyond providing benefits to the end user and instead introduced security vulnerabilities, can be considered a poor decision [39350]. This decision led to a situation where a hacker could gain greater control over a vulnerable computer through a privilege escalation attack using the LSE tool. Additionally, Microsoft updated its guidelines on how such software should work, effectively banning Lenovo from shipping it, indicating that Lenovo's use of LSE was not consistent with industry standards [39350].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to the Lenovo Service Engine (LSE) can be attributed to development incompetence. The LSE, which was built into the firmware of Lenovo laptops, introduced security vulnerabilities that could be exploited by hackers for privilege escalation attacks. This indicates a lack of professional competence in ensuring the security and integrity of the software being pre-installed on Lenovo devices [39350]. (b) Additionally, the incident can also be categorized as accidental, as Lenovo had to remove the pre-installed component, the LSE, from its laptops due to security fears. The presence of the LSE in the BIOS of the laptops was not intentional for the benefit of the users but rather an accidental inclusion that posed significant security risks [39350].
Duration permanent, temporary (a) The software failure incident related to the Lenovo Service Engine (LSE) can be considered as a permanent failure. The LSE software was built into the firmware of Lenovo laptops, making it difficult to remove completely. It was deeply embedded in the system, launching before Windows loaded, and replacing Microsoft's start-up diagnostics program. Even if a user wanted to restore their system to a clean installation of Windows, the LSE would still be present and reinstall other Lenovo tools on the next restart. This indicates that the failure was permanent in nature [39350]. (b) On the other hand, the temporary aspect of the software failure incident can be seen in the actions taken by Lenovo to address the security vulnerability caused by the LSE. Lenovo released tools in late July to uninstall the LSE code, one for laptops and one for desktops. Additionally, the company issued Lenovo Product Security Advisories and updated the BIOS firmware on newly manufactured systems to disable and remove the LSE feature. Microsoft also updated its guidelines, effectively banning Lenovo from shipping the LSE. These actions suggest that while the initial failure was permanent, steps were taken to mitigate and address the issue, making it a temporary situation [39350].
Behaviour value, other (a) crash: The software failure incident did not involve a crash where the system loses state and does not perform any of its intended functions. The issue with the Lenovo Service Engine (LSE) was related to security vulnerabilities and unauthorized behavior rather than a complete system failure [39350]. (b) omission: The incident did not involve the system omitting to perform its intended functions at an instance(s). The LSE software was actually performing additional functions beyond what was intended, such as ensuring Lenovo's software tools were installed and reinstalling them if necessary [39350]. (c) timing: The failure was not related to the system performing its intended functions correctly but too late or too early. The issue with the LSE software was more about unauthorized actions and security vulnerabilities rather than timing-related failures [39350]. (d) value: The software failure incident was related to the system performing its intended functions incorrectly. The LSE software was found to have security vulnerabilities that could be exploited for privilege escalation attacks, leading to unauthorized control over the computer [39350]. (e) byzantine: The incident did not involve the system behaving erroneously with inconsistent responses and interactions. The behavior of the LSE software was consistent in its unauthorized actions and security vulnerabilities once discovered by researchers [39350]. (f) other: The behavior of the software failure incident can be categorized as unauthorized and potentially harmful. The LSE software was designed to perform functions beyond what was disclosed to users, leading to security vulnerabilities and the potential for privilege escalation attacks [39350].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) death: There is no mention of any deaths resulting from the software failure incident in the provided article [39350]. (b) harm: The software failure incident did not result in physical harm to individuals as per the article [39350]. (c) basic: The incident did not impact people's access to food or shelter [39350]. (d) property: People's material goods, money, or data were impacted due to the software failure incident. The software vulnerability could potentially allow a hacker to gain greater control over a vulnerable computer, posing a security risk [39350]. (e) delay: There is no mention of any activities being postponed due to the software failure incident in the article [39350]. (f) non-human: The software failure incident impacted non-human entities, specifically computers and laptops, as the vulnerable software was pre-installed on Lenovo devices [39350]. (g) no_consequence: The software failure incident had real observed consequences, particularly related to security vulnerabilities and potential risks [39350]. (h) theoretical_consequence: The article discusses potential consequences of the software failure incident, such as security vulnerabilities and the debate over PC manufacturers including features that may go against customers' best interests [39350]. (i) other: There are no other consequences described in the article beyond the security vulnerabilities and potential risks associated with the software failure incident [39350].
Domain information (a) The failed system was related to the information industry as it involved security vulnerabilities in Lenovo laptops due to pre-installed software like Superfish and Lenovo Service Engine (LSE) [39350]. These vulnerabilities could potentially compromise user data and security, highlighting the importance of cybersecurity in the information sector.

Sources

Back to List