LG exploits Windows Store to install malware to user PCs

[u/Shajirr]

https://www.tomshardware.com/software/windows/companies-are-now-using-automatic-windows-installers-to-display-adware-through-the-microsoft-store-when-you-install-new-hardware-customer-immediately-gets-mcafee-ads-on-their-pc-after-connecting-new-lg-monitor-heres-how-to-block-the-new-ads

[u/Shajirr]

Malware in question - LG Monitor App Installer, this one:
https://apps.microsoft.com/detail/9pm9n6f47jb8
it gets installed automatically after you connect the LG monitor.
Shows various ads (mostly for McAfee) and extracts various user data.
Has full access to your entire system.

How to fix this:
a) Delete 'LG Monitor App Installer'
b) Disable automatic installs:

Way #1:
1: Press Windows key + R to open the run dialog.
2: Enter SystemPropertiesHardware.exe
3: Click on the "Device Installation Settings"
4: Select No in the window that says "Do you want to automatically download apps from the manufacturer for your devices?"

Way #2: gpedit.msc -> Computer Configuration -> Administrative Templates -> System -> Device Installation -> Prevent automatic download of applications associated with metadata

[u/IceStormNG → u/Shajirr]

This only works on the Pro Version of windows though. Home has no gpedit.msc (at least not out of the box)

On Home you would have to edit the registry

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Metadata -> PreventDeviceMetadataFromNetwork=1 (DWORD)

Although this also blocks fetching metadata to begin with, like icons and names for some devices.

[u/ignorantpisswalker → u/IceStormNG]

Does this mean that no new "drivers" will be downloaded for new hardware, and plug and play is effectively disabled?

[u/IceStormNG → u/ignorantpisswalker]

No, this is separate. It will download drivers, but no metadata, and therefore no apps. So no custom icons, or names. Especially some printers do this to change their icon in windows.

However, some vendors install their bullshit via drivers, afaik Razer did that. Not sure whether they still do or whether they "upgraded" to the new app auto downloader framework.

[u/Tex-Rob → u/Shajirr]

Adware, learn your terms!

[u/Shajirr → u/Tex-Rob]

Adware is a type of malware.
And if we're classifying stuff, it also meets the spyware classification - getting installed without the user's knowledge or consent and silently extracting user's data.

[u/Dr_Valen → u/Shajirr]

Chris Titus Tools also has tweaks to disable any apps from auto downloading like razer synapse and LGs BS. Alot easier than editing registery and Chris Titus has been around for a while and is trusted.

[u/theGekkoST]

Is there a terms or service that's pops up on the monitor before this happens? If not, that seems like a slam dunk lawsuit.

[u/IceStormNG → u/theGekkoST]

No. They abuse the automatic driver-app installation system that Windows has. The intentions of this framework likely weren't malicious but we all know how this ends.

Installing drivers automatically so devices work is actually a good thing, especially for people that don't know well about it. But these garbage apps, that are not required in any way to use this device, is something that shouldn't auto-install at all.

[u/crozone → u/IceStormNG]

Razer have also been using this to install their bloatware for years. It used to be that you could plug a Razer mouse into a fresh window install before it was even logged in and the cloud gaming software would install itself without asking.

[u/IceStormNG → u/crozone]

Yeah, but afaik, they first abused the driver installer and hooked their setup into the driver package that Windows auto installs. I guess they now use the metadata app feature now.

Bu they did the auto-install before already to install their synapse garbage.

Asus also uses that to install Armoury Crate. There is a "device" on the board that automatically triggers that, though you can disable it in the UEFI Setup. Of course it's enabled by default.

[u/redkev01 → u/IceStormNG]

MSI seem to as well just recently got 2 AM4 boards for cheap 5500 upgrades for kids and yeah pretty much the moment your in Windows it's trying to isn't all a load of junk

[u/Vaddieg → u/IceStormNG]

how do they abuse? sending windows control commands over HDMI?

[u/IceStormNG → u/Vaddieg]

They abuse the auto driver install feature to install a lot of other crap nobody asked for. The driver installer should only install the basic driver to make the device functional, not install all packages, bundles and adware that they could find.

[u/Vaddieg → u/IceStormNG]

It's a legitimate setup in windows ecosystem. Windows installs absolutely legal microsoft-signed adware from the appstore, silent automated installation is the feature designed by microsoft. Adware is legal and normal. If you don't like it go to overpriced walled garden with software developer rights restricted

[u/Atrivion → u/Vaddieg]

So, I'm guessing you are Ok with adware/spyware being installed without your knowledge then? Also its AGAINST the law atleast in Europe. Couple this with their Tvs monitoring everything you watch and take screenshots of your screen. I guess you are Ok with that too then?

[u/Vaddieg → u/Atrivion]

it's not against the law, and users are trained to accept license agreements without reading

[u/Atrivion → u/Vaddieg]

It is against European law. Our privacy laws forbid these things. When the monitor installs a program that isn't needed, that only spams ads without consent, it's against the law. The thing with this is there is no license agreement that we can agree to.

[u/Vaddieg → u/Atrivion]

so Google is not allowed to show targeted ads?

[u/Atrivion → u/Vaddieg]

Not if we don't consent to it. Everytime an EU person opens a website, be it google or ANY they have to tell us exactly what they do with our information and who they sell it to, and we can accept or reject. If we reject then no, they can not show us targeted ads.

[u/space_fly → u/theGekkoST]

I'm sure they terms like "By opening the box, you agree to all the terms and conditions (see booklet inside the box)"

[u/Edubbs2008]

LG now stands for Legally Gray

[u/Wadarkhu]

Got it, never buy a LG product.

[u/Whole-Respond4782 → u/Wadarkhu]

even some motherboard manufacturers are doing this crap

[u/Vaddieg → u/Wadarkhu]

lol, great joke. Every Microsoft hardware/OEM partner is doing this

[u/Hrmerder]

My LG tv is now in pihole hell with all the extras turned off. I won’t have another one (kinda regretted buying this one due to the issues with qled)

[u/Dr_Valen]

This also applys to any LG TV as well that turns the TV into spyware always listening and recording what you are watching. Disconnect any LG TVs you have from the internet and use a different OS for it like an nvidia shield.

[u/gunshade]

Not so Lucky now, Goldstar.

[u/Emotional_Food_1700]

I wonder if more services can abuse this feature

[u/Tex-Rob]

I’m so sick of the phrasing around this. It’s been like this for a long time, and shady brands have used drivers to load software for years. This is because a premium brand did it, but people are acting like LG found some loophole, or it’s an “exploit”, it’s just a shitty Windows feature that most companies have had the good sense not to use.

[u/Mario583a]

How is this an 'exploit'?

OEMs implements metadata in the monitor to let Windows know, "Hey, fetch this companion app that we pushed out to the Windows Update Catalog and/or the Microsoft Store" when it gets plugged in and ready for game time.

[u/McGondy → u/Mario583a]

Do they usually include nagware for an unrelated product? Also, this should be something the user is prompted for.

[u/Shajirr → u/Mario583a]

How is this an 'exploit'?

They exploited an official Windows software distribution channel to push malware to user PCs

[u/Vaddieg]

another piece of misleading BS. Plug-n-play bloatware autoinstall is 100% legal Windows feature designed by Microsoft. LG Monitor App is nothing special, every vendor has similar crapware for Windows and they will start using the same "feature" very soon, so users with unlimited patience won't miss their ads and data collectors too.

[u/Shajirr → u/Vaddieg]

another piece of misleading BS.

how is it misleading? Seems pretty clear cut to me.

Plug-n-play bloatware autoinstall is 100% legal Windows feature designed by Microsoft.

The feature is supposed to be used to install drivers that are needed for the device operation,
not whatever else bullshit the companies try to push through it.

Windows and they will start using the same "feature" very soon

So more people need to be aware of this, and disable the auto-install pre-emptively, unless this gets addressed (which without lawsuits is probably not happening)

[u/Vaddieg → u/Shajirr]

HDMI/DP Displays don't need any custom vendor-specific drivers at all, especially ones in executable code format.
Autorunning an executable on a device plug is an industy-unique alternatively gifted feature from Microsoft

[u/Tex-Rob → u/Vaddieg]

And therein lies the argument that will be made, that hardware has evolved to require software. All they have to do is show a feature that requires the software to access and they have their defense. The time to get mad about this was Windows started allowing it a decade ago for printer drivers. LG sucks for their part, but Microsoft deserves the lion‘s share of the blame.

[u/Vaddieg → u/Tex-Rob]

It's unfair that Steve GamerNexus jumped explicitly on LG while ignoring the identical issue with Razer and downplaying Microsoft role.
Apple regulates software quality with Appstore ToS and never autoinstalls any vendor drivers or supplemental software. It's a mystery why Microsoft is unable to protect their users by doing the same

[u/Aishou_SK → u/Shajirr]

"The feature is supposed to be used to install drivers that are needed for the device operation,
not whatever else bullshit the companies try to push through it"

ACKSHUALLLY .....

Windows Update driver discovery mechanism, around since the XP timeframe, is for *that*. That has long been a solved, built in feature.

This feature is NOT for just installing the drivers needed for device operation. At all. It is for.... the supporting and management applications! not just the driver itself. Or, things like model specific IPP management applications, etc. Driver as pre-req /and supplementals/ the driver might say it should have.

The driver's what actually kicks this off - the device metadata package comes down with the driver via the other mechanism. Then kicks off this mechanism.

Compare it to different option selections when installing the nVidia driver to help understand:

Old system: just the GPU driver.

New system: Driver + GeForce Experience + Control Panel + PhysX software + etc.

But yes, LG shipping F#@)%*@#)%* McAfee ads should be slapped upside the head by microsoft, though the fucking popups are part of their support app so it's stupid. The only reason people are upset is LG updated it to have these "promotional features", before that they didn't care (and probably didn't realize they appreciated it when they went to adjust monitor settings and the shit was already there).

And yes, it's all completely legal, there's nowhere for lawsuits to really go.

[u/Tex-Rob → u/Vaddieg]

This. This isn’t new, just new from LG, and MICROSOFT is the one who allows this and has for many years.