buy an lg monitor
it installed weird shit on your box.
thanks, windows
thanks lg.
great
7
Replies
·
0
Boosts
dont buy lg or samsung.
any of their shit.
samsung washing machines catch fire.
yes, the ones full of water.
and their tv's phone home and do super shady shit with wifi networks
wait wait wait holdup.
you can plug an hdmi device into a computer, and you get ..
...
... autorun.inf functionality?
it installs and runs entirely without user consent?
so we're back to evil usb sticks again that autorun shit, except now ... a malicious... firestick? chromecast? ..
hdmi is the new usb?
@Viss
Ah, I remember years ago there being some Windows LPE when connecting Razer USB devices. (Driver installation included a GUI-based coinstaller that ran with privileges). I made a raspberry pi script to enumerate known VID/PID combos to see if other devices behaved similar (some did!).
Disturbing to see the same thing happen with HDMI devices. 😬
(Assuming that's what's actually happening here, and not that somebody plugged the LG monitor USB connection in)
Not quite. Unless this is a new technique, the device just sends model and manufacturer IDs. Windows then connects to the Windows Update service to see if there are drivers and installs them. And there is woefully inadequate vetting of the auto-installed stuff.
I remember the Razer instance of this because it came a couple of weeks after Microsoft bought Razer cameras for all employees, which was hilarious timing.
@Viss not really. As others have pointed out, it’s based on the device vendor ID + product ID that Windows “helpfully” searches Windows Update automatically for drivers, and has done since at least Windows 7 (maybe 😜 and Vista too but that’s fallen out of my memory).
Of course, building a HDMI interceptor which changes VID+PID while preserving full device functionality wouldn’t be that hard using a small FPGA…
