Hacker News

>This situation has.. no precedent as far as I can tell..

Printer, mouse, tablet and display tablet makers use this to insert their crapware since at least Windows Vista or Windows 7, I think. The last one I remember is plugging a Razer mouse just to watch it instantly pulling 1.5GB of bloated junk with "telemetry" exfiltrating the data from my gaming PC in realtime. At least it doesn't leave my mouse in a non-working state when I disconnect the internet, like it used to. Thanks, Razer!

Microsoft is to blame here, really. They have a mechanism to block any vendor (supposedly to avoid reputational risks to their brand due to buggy drivers, at least that was their excuse back in the day), but aren't even using it to block these contraptions. Entire businesses are built on this, e.g. Razer is probably more of a marketing/data company now rather than a hardware shop.

> This situation has.. no precedent as far as I can tell..

Microsoft has been allowing this sort of ludicrous behavior for decades at this point, it's not a new issue. What's new is how visible LG made their malware, compared to previous auto-installs that happen like this, where they try to make the thing not so in your face, as they know there will be a huge backlash.

I don't know what Microsoft is thinking even allowing and enabling this sort of thing, they've lost all touch when it comes to building things for users.

A few years ago, plugging in a Razer USB mouse made Windows download and run a installer from which the current user could start PowerShell with administrator privileges. Razer first tried to downplay the issue, but fixed it later. [1]

The USB protocol does not have any authentication, just a VendorID/ProductID pair: 2×16 bits that Windows uses for looking up the driver package to install. Programming a MCU to use any VendorID/ProductID is straightforward. A USB device could even appear innocuous at first but after a timer or external trigger disconnect and reconnect masquerading as another device.

1. https://arstechnica.com/information-technology/2021/08/need-...

> This situation has.. no precedent as far as I can tell..

- https://support.microsoft.com/en-us/windows/hardware/drivers...: “Windows can automatically download recommended drivers for the hardware and devices connected to a system by using Windows Update“

- eight years ago: https://www.reddit.com/r/Windows10/comments/8tlre3/why_is_it...: “I can't seem to stop it from installing device drivers, even after unchecking the 'Do you want to automatically download manufacturers' apps and custom icons available for your devices?' and saving.

I uncheck it, reboot. Uninstall all drivers except USB (so I can use mouse and keyboard) and reboot. Aproximately two minutes after the reboot, I get notification ballons telling me everything is installed again. Heck, even the super old Nvidia 388.1 driver is installed (the latest now is 393.2).”

I can only conclude that Windows is basically malware now... Thank $deity I haven't used any form of Windows for 10+ years anymore.

Perhaps no precedent in hardware, but it's basically the same as the good old Sony CD autoplay rootkit fiasco. Except this one runs in mere userland AFAICS.

If this were a person doing this, they would be in jail.

> This situation has.. no precedent as far as I can tell..

You got a lot of replies already, but there's so much precedent. Plugging a Logitech mouse installs a network capable, autolaunch capable, pop up app for at least the past 10 years. LG's thing seems grodier, but this has been common Windows-ism for a while.

> This situation has.. no precedent as far as I can tell..

depending on how you look at it it has quite a bit of precedence as this falls under a long list of MS shipping "intended behavior most security researcher would assign a CVE and require it to be fixed as min. requirement for Windows usage in any company"

other wtf. microslop cases include:

- "install arbitrary software w. admin rights hooks" in BIOS which theoretically is there to install BIOS update software but there had been cases of 1. it installing other unwanted software, 2. the updater not fulfilling most minimal security standards (i.e. similar, due to 2. maybe even worse then the monitor case)

- "on boot without password requirement boot arbitrary stuff from a USB stick if correctly named" allowing a trivial bypass of TPM based full disk encryption, yes different thing but another "MS without authentication runs potentially harmful 3rd party software"

- "init scripts on USB devices", I think they stopped doing that

- ...

given that Microsofts security researchers are definitely _not_ incompetent idiots, you can safely assume that all of this features where implemented knowing what user hostile hazards they are and against their own security teams recommendations (or bypassing that team knowing they would say "wtf. no", or similar)

most absurdly MS has in all of this cases enough means to enforce a "just drivers no ad-ware/spy-ware or you get banned" policy, and could do it in a way where they still allow non-allow-listed/ban-listed hooks to be run iff the user consented to it with appropriate warnings and "remember this decision" functionality in case they say no (which besides other aspects might be relevant from a "not steeping onto anti-trust landmines" POV, through mostly older judgements as the US kinda moved from hindering oligopoly to pushing for it).

combine that with the huge f*-up of Azure in the past and their systematic mishandling of it, and no indication they will change this behavior, I really don't understand how any Company/Government agency could trust them

8. ANd this isn't specific to LG. If LG can do it, anyone can, even if they aren't right now.

Buying from companies you trust isn't a solution either. Founders sometimes get into fatal car accidents or lose some of their assets in messy divorces. THe new owners may not care about "brand reputation" and sell the company to the highest bidder.

I have a windows computer that tries to install HP Printer software automatically because it detects an HP printer on the WiFi. No physical access needed

Unprecedented? Have you installed a Dell/Alienware monitor recently? I hope you enjoy having the unsigned awcc.exe autostarting with no visible ui doing good knows what with no documentation from Dell

> OR ALREADY HAD AN OLDER LG MONITOR PLUGGED IN, BECAUSE LG APPARENTLY ROLLED THIS OUT FOR MANY OLDER MODELS TOO!!

Just think about how many times hardware manufactures told customers to buy new equipment because they can't be bothered to patch the older models.

It is the same when you plug in a Logitech mouse nowadays, no? At least they don't install McAfee

That's just living in the Windows world.

After start menu ads, I don't understand why people are being surprised anymore.

And people think macOS sandboxing is "hyperbolic"

Thanks - really got my attention. And, the video makes me sick.

I'm still looking at my 10 year-old LG monitor with suspicion, now, but I'm thinking (hoping) it's just too old...

>This situation has.. no precedent as far as I can tell..

I want to believe you, but somehow I can't, I feel like our industry has already mastered the art of installing malware on customers' devices.

As if the world needs more reasons to understand that windows is activly making your life worse. Step by step.

I understand shitty brands want to do this.

The bit I don’t understand is Microsoft making an infrastructure that allows this, lets shine the shame light here.

Thank you for the summary. As a Linux user, am I spared because of relative obscurity, or is it that Microsoft is explicitly allowing this to happen?

Logitech have been doing this for years

> This situation has.. no precedent as far as I can tell..

No, this has been going on for years. Vendors have been pushing malicious software through the Windows Update automatic driver installation since forever. MSI and Nahimic/A-Volute (this has watchdog daemon to instantly reinstall it as well as the main app protecting the daemon), the ASUS Armory Crate bullshit, the Lenovo garbage, which initially they only put into their own images, but then started force-installing via Windows Update, Gigabyte, ... the list is really long.

If you have to use Windows, you really absolutely should disable driver installation through Windows Update.

Have you been using Gentoo or FreeBSD for a long time and then suddenly remembered Windows exists on the same day this news dropped?

this has happened to me with dell monitors since years ago, also with razer peripherals.

I'm tired of everything being classified as "malware". The word has no meaning anymore. Malware can mean "zero-day state-sponsored ransomware attack" or it can mean "software was automatically installed by a trusted consumer-beloved company because they forgot to make an opt-out window" (which is what I'm guessing happened here).

USB devices can also do this now. I have a Razor microphone which is otherwise a great device and requires no software to function. At soon as you plug it in to windows it tries to install some Razor crapware.

It's not quite as bad because it's not silent and you can say no, but I'm pretty sure that's only because Razor decided not to be completely evil.

Logitech pulls (pulled?) the same shit when you connect one of their pheriferals to your PC.

But thanks to Secure Boot, your computer is secure. /s

When will people understand that malware is signed by the vendor ?

Buddy let me welcome you to the Internet where your phones and emails are literally listening to your microphone like it’s Watergate.

It’s not unprecedented at all for Microsoft or anyone to download what amounts to spyware.

The days of antivirus were replaced by advertising a long time ago. There is no privacy.

Most savvy types are hyper aware of every process running on their machine especially those using network lol

Kill the process or don’t by an LG. Everyone just uses Dell, or you’re rich and you get a Mac one. I don’t make the rules

Worth noting that gpedit.msc isn't included in Windows Home editions (although there are unsupported ways of adding it). This is also technically asking a lot for working around issues that shouldn't exist.

Microsoft needs to intervene here, this cannot be a normal expectation for using their product.

Very helpful, thank you. But it does remind me of that Yzma quote in The Emperor's New Groove: "Why do we even have that lever?"

This is getting technical enough that you might as well install Linux if you figure out how to do this.

In other words, we all know that regular consumers will never find this and they’ll never understand that their LG software is spyware in the first place.

[delayed]

I had a mouse that would keep on installing its driver when plugged in, even with this setting off.

I remember Windows keeping a cache of autodownloaded drivers ("Driver Store") and reinstalling them when the device is plugged in, so the mouse bloatware kept on coming back.

Is this still the case?

> On home editions sans gpedit.msc:

I've managed to generally avoid running Windows (at home and at work) for a long time now, but if there was a situation where I needed to get a PC (at home?), is there a recommended least-sucky way of living with?

Are there editions or scripts or a setup workflow that would make it suck less?

Superior workaround:

1. Reset machine 2. Tap the BIOS setup key (often DEL) during the time before it boots. 3. Insert intallation media for a decent OS 4. ...

The issue is that most corps disable Windows Update and only allow whatever goes through the on-prem Windows Update thingy. This can, of course, fire back if they don't think to include all the updates. We had one such issue where they didn't provide an up-to-date Intel driver for the Wi-Fi cards, and the version we had was a bit broken...

But the point is that companies will probably not complain about this because they'll most likely not see it. Also, they're used to Windows being generally crappy.

Ah, the usual take. Want to sign everything before it can run, but take responsibility for nothing. And when in doubt, well, the computer did it.

When do we start calling out this crap?

Honestly yeah

MS should get all the flack (which is mostly deserved) of this

Manufacturer does whatever crap they want with "it works" and then MS gets the complaints

A driver should only be that. A driver

> A monitor cannot install software on your computer by the way.

I think everyone in the HN crowd knows that.

> the blame should be on Microsoft

No, they blame should ALSO be on Microsoft, they are the enablers.

> Autorun of malware when you plugged in a USB drive was also a Windows issue, I'd classify this as the same security problem.

Not really. AutoRun ran whatever was on the USB drive, with no oversight. This installs a driver from a company that's supposed to be reputable enough to get their driver signed by MS and pass validation. LG breached that trust here.

The blame should be on Microsoft and LG, both.

Actually it frequently can, since a modern monitor is often on USB and in a position to impersonate a keyboard and/or mouse.

I wouldn't put it past most of these companies.

Blame should be on the user for buying Windows

The monitor should absolutely take the major part of the blame by being the source of the malware and poisoning the system for everyone else.

I'm 100% certain if an individual did this, they would be in jail.

I'm wondering if we in Europe gets vastly different experience compared to Americans or elsewhere in the world. People complain about LG having ads everywhere in the monitors, displays and what not, but none of our LG products (bought and used in Spain) have any ads anywhere. I'm sitting here with a LG monitor and our main TV is a LG OLED TV, neither of them have ads anywhere, although I haven't booted Windows in a couple of days and I guess I won't, until this malware issue been fixed.

But still, is it possible Americans are receiving more ads than in other parts of the world? Certainly online sentiment gives me that impression.

From FTC website: Malware is harmful software that’s installed on your device without your knowledge.

So I think that is what we should continue to call it. LG monitors are installing malware, because they install the software silently and it harms the system by making it slower and disrupting the work of the user with advertisements.

If it's not malware then what is it called today?

I mean, nothing new there. (Mal/Ad/Spy)ware just has been more prevalent in the browser and on mobile apps the last ~15yrs instead of being installed via modified windows installers.

I would be very surprised if some random manager of some low level engineering team made this decision. It seems more likely this was a marketing or partner relations department idea that was presented to high level leadership.

I don't understand why we expect some manager somewhere to stop stuff like this.

> Blizzard Entertainment

You mean "Microsoft Xbox Activision Blizzard King Bethesda Mojang"? I wish you luck with your boycott.

You know why desktop Linux doesn't have much malware? Because ~no one uses it. That's it. Once you get users, you get malware.

The rest of your comment is just as ignorant.

The worst OS except for all the others.

Excellent hardware and software support (especially for Snapdragon/ARM64 CPUs and Microsoft Office) and best in class multitasking/window management are the top 2 reasons for me. Like someone else said, it's the worst OS, except for all the others :)

Gaming

IMHO it's the best OS as a games developer, Visual Studio just doesn't have anything remotely close. And all console toolchains are windows only. But genuinely as a C++ dev I much much much prefer it over MacOS or even Linux for work.

Linux is great if you win the hardware support lottery.

I've had several laptops where audio just doesn't work even on rolling releases. Or the screen freezing up constantly.

This was all with relatively new hardware within the last year or so.

My issue with the Linux community is if you bring this up it's all of a sudden the fault of everyone but Linux.

The end user should of picked better hardware.

The hardware OEMs should of shipped Linux support.

The end user is lazy for not installing an RC kernel.

Macs are great, but my current workhorse computer has a 2TB SSD, and only cost 550$ with the SSD upgrade.

Vs 2000$ for the cheapest MacBook with a 2TB SSD

Your OS is malware, if it's Windows.

When preinstalled (as multiple major OEMs do), or when bundled in unrelated installers in these sorts of ways, it matches the definitions of scam excellently, and protection racket not badly.

When you uninstall, they give you an opportunity to type a reason. I wonder if anyone actually reads my accusations of them being scammers and bad people. I have uninstalled McAfee from more people’s computers than I care to remember.

If a software package can't be uninstalled through the normal process and needs a separate uninstaller program, it is similar to malware. Many anti-virus suites and anti-cheat software require this. Take from that what you will.

10 Years ago. Complete garbage spyware.

Still seeing them for ~600 everywhere, which is completely in line with historic pricing: https://tweakers.net/pricewatch/2246090/lg-ultragear-oled-34...

I don't feel like spending my money on some horrible corpo pulling out stuff like this, even if I've been using linux since 2006. Who can tell if they will do this to other OS in the future?

In this case, they aren't.

I woke up the other day to a notification that my LG monitor driver was installed, with a little window on how to use the on-screen crap.

Absolutely useless, since the buttons for the monitor are right there on the bottom of it, and probably easier to use than the software.

The article is about people NOT installing it but getting it installed anyway :)

As to why people do install such software? It sometimes provides additional features, controls and settings. For example with touchpad you could set the sensitivity, hot corners, set the scroll behaviour the way you like it, etc.

With monitors you might get a better colour profile (P3 instead of just sRGB), I don't know. I don't use monitors like this.

the OS handles these now by installing the malware. Zero click.

Sounds like this malware gets installed even if you don't manually install anything.

> Connecting some LG monitors to a Windows PC may automatically install software that promotes McAfee subscriptions

I too have a LG monitor, but haven't booted Windows in some days, guess I'll stay put in my Arch environment until they've fixed this shitshow.

We have a smart TV on the way. We do not plan to run the setup, it won't have Internet access. We plan to do what we've done for over a decade now, connect our Kubuntu laptop in the entertainment center to it and select it as the default input device. And occasionally watch OTA TV shows. So we will use it as ... a monitor and plain TV, that happens to have far better video and sound quality than our old TV.

linkedin EW

It's pretty rare nowadays to need drivers for specific hardware that ordinary people are going to plug in. Maybe printers are the unfortunate exception.

Windows already ships with gigabytes of drivers. This is why you can plug most popular hardware on an offline Windows and it will work.

I’m on team blame both.

Update firmware.

Turn off LIVE PLUS

block internet for the tv from router

Enjoy.

That's what I have been doing for years.

I have a pihole in front of my LG TV blocking nearly every DNS query it tries. I only allow a couple streaming apps I do use and see zero ads.

LG TV’s are really really good. If you never connect them to the internet. And that rule should be applied to all TV’s. Use an external device like an Apple TV or a self-crafted solution (Roku, Amzn stick, etc all garbage phoning home and listening with Alexa crap)

Treat your TV like a computer monitor (ironic here in this context lol)

this is the only valid, reasonably sound and grounded comment in this entire discussion, bravo.

p.s. not being sarcastic

As long as you don't need some Windows-only software, Linux is a viable alternative now. KDE Plasma is a great desktop environment and even most games run flawlessly on Steam. And if you do need Windows occasionally, you can put it into a VM.

That's the second time, probably more, you've been saying this in the thread. Blaming users for "buying" Windows is ridiculous too.

I agree, this isn't news, just flame bait to smoke out the lurking FOSS enthusiasts on a Saturday morning.

Same, also bought an LG TV to replace our aging 2 decade old TV. Nothing says you have to run the TV's setup. Use an external device for streaming, preferably running Linux and you have full control and no Ads or telemetry.

With the quality of that software, it wouldn’t surprise me if the driver didn’t work without the userspace app at all. The GeForce experience at least you can disable, but if you have any branded components getting all of their management software off your PC is incredibly difficult

I avoid installing Logitech spyware on my Mac but there are FLOSS apps to do the equivalent. There's even a pairing FLOSS app for Linux to avoid installing Logitech spyware. FLOSS is amazing. LinearMouse is the Mac app.

Razer mice are the worst because they are just HIDs and could work without any special driver at all! Also I don't need their whole suite on every Windows computer I plug my mouse in. I think most people would just configure their Razer mouse on one PC, save the settings in the firmware of the mouse itself (I guess, I've actually never used their driver suite) and then never touch their software again.

It's just crazy to me that a lot of keyboard manufacturers have basically standardized on VIA as their firmware which can be configured via WebUSB without installing any additional driver. But my mouse somehow needs a gigantic driver suite just to configure and save some settings? It's just madness.

I like Razer mice and their headsets, but I will never install any of their drivers. Ironically I feel more comfortable using Razer hardware on non-Windows devices than on Windows precisely because they don't support other operating systems.

…Do these devices just not work on Linux or something?

Panel? Not really since Panasonic exited the market.

For complete monitors, the sole make I trust is Eizo but they only make professional (business or photography) products these days, and I'm _not_ going back to 60 Hz. Dell doesn't deserve trust but their UltraSharp line usually is "okay" even if my U2724D has uniformity issues near the bottom. Iiyama also remains a good one in my books.

But if you want OLED, abandon all hope. The technology is so compromised and the market so monopolized by the collective Market for Lemons style race to the bottom targeting gaymers that I intentionally went for IPS black (yes, LG.display, I know...) instead.

We had autorun.inf in the past installing automatically from any random USB drive[1]. The fun days where you always feared contracting malware if you so happened to plug a random USB drive in :)

[1] https://en.wikipedia.org/wiki/Autorun.inf

> Do. Not. Buy. LG.

> There are a lot of decent alternatives.

Can you name them? Dell and Samsung are the main competitors for displays as far as I'm aware, Dell tends to be hit-or-miss when it comes to monitor features and quality, Samsung's high end displays come preloaded with a whole OS. The monitor market is really in the toilet.

This is also true outside of Korea.

HN doesn't like your tone and you are being down voted. But in general you are correct, Linux and bsd users are less affected by such shenanigans.

Short personal story:

I had a win10 machine were HP kept installing some "analytics" service. This happened even on a clean windows install so I guess they used the same delivery mechanism LG is using here. After having read the HP ToS (where they basically gave themselves unlimited rights to monitor anything I did on that machine), I decided to wipe the disk and install Linux.

But I guess it is just a matter of time before EU or US make spywares mandatory on Linux too. Chat control and age verification seems to be the first step towards that.

I don't know about the BSDs but in Linux the reason is that a volunteer (in principle it could be a paid employee, I guess maybe it is for RHEL etc?) decides what gets installed

It is absolutely possible that when you plug in an LG display it installs and runs software on your Linux system†, just that rather than "Somebody at LG who earned a bonus" the decision maker was Sara in Portugal who fat fingered a change when trying to make a Python script for a PCI digital TV receiver work properly on 32-bit.

It does feel more like an amusing mistake in that case whereas even if LG tells us it's a mistake we know it was to earn $$$.

† Obviously YMMV but such "plug and play" features are commonplace because they're useful

Not only Linux/BSD, but MacOS. Not that Apple isn't annoying either, but it tends to avoid the windows bloatware stuff.

https://www.youtube.com/watch?v=2Fbt1fVfi-g

> excellent use of agentic AI

you run claude code unsanboxed on your machine and give it privileged access?

Giving the data to Anthropic instead of giving it to LG and McAffee, fascinating

"Prevent this software having unfettered access to your machine by giving some other software unfettered access to your machine"