Lenovo advises users to remove a vulnerable, pre-installed support tool

Lenovo Accelerator Application contains a high-risk vulnerability that allows remote code execution

Levnovo recommends users remove an updater app shipped with some of its PCs.
A booth sign at Mobile World Congress 2016 shows the logo of hardware manufacturer Lenovo in a file image captured on Feb. 25, 2016. Credit: Stephen Lawson

PC maker Lenovo is recommending that users remove an application preloaded on their computers because it contains a high-severity flaw that could allow attackers to take over their systems.

The vulnerable tool is called Lenovo Accelerator Application and is designed to speed up the launch of other Lenovo applications. It was preinstalled on more than 100 laptop and desktop models shipped with Windows 10, but not those from the ThinkPad and ThinkStation lines.

The flaw was discovered by researchers from security firm Duo Security as part of an analysis of OEM software update tools from five PC manufacturers. The company found that a process called LiveAgent, apparently the update component of the Lenovo Accelerator Application, does not use encrypted connections when checking and downloading updates. LiveAgent also does not validate the digital signatures of the downloaded files before running them, the researchers said.

This allows man-in-the-middle attackers who can intercept a user's traffic -- for example, on an insecure Wi-Fi network or through a compromised router -- to trick LiveAgent into downloading and executing malware.

LiveAgent was one of the worst software updaters Duo Security identified, but the company found flaws in update tools from all five vendors it looked at: Acer, ASUSTeK Computer, Lenovo, Dell and HP.

"Lenovo recommends customers uninstall Lenovo Accelerator Application by going to the 'Apps and Features' application in Windows 10, selecting Lenovo Accelerator Application and clicking on 'Uninstall'," Lenovo said in an advisory Tuesday.

The company plans to release a System Update removal utility soon, a Lenovo representative said in an emailed statement.

This is not the first time serious vulnerabilities have been found in the support tools and third-party applications preloaded by PC manufacturers on computers. The Duo Security researchers recommend installing a clean version of Windows on newly purchased systems.

To express your thoughts on Computerworld content, visit Computerworld's Facebook page, LinkedIn page and Twitter stream.
Windows 10 annoyances and solutions
Shop Tech Products at Amazon
Notice to our Readers
We're now using social media to take your comments and feedback. Learn more about this here.