Lenovo telemetry

Topic

New Reply

[Michael432]

Stumbled on Lenovo telemetry on a Windows 10 pc.

Check the scheduled tasks for “DailyTelemetryTransmission”. I would disable it.
The task folder is LenovoVantageSchedule

Great program for this is TaskSchedulerView at nirsoft.net

Was also tracing DNS requests while running the Lenovo Vantage software and saw it making a DNS lookup for schashcheck.sutherlandglobal.com. They seem to be an analytics company.

The DNS request was made by process Lenovo.Vantage.AddinHost.x86.exe
Full path
C:Program Files (x86)LenovoVantageService3.9.23.0Lenovo.Vantage.AddinHost.x86.exe

If you can block domains and/or sub-domains via DNS, I would block this

Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com

• This topic was modified 3 years, 6 months ago by Michael432.
• This topic was modified 3 years, 6 months ago by Michael432.
• This topic was modified 3 years, 6 months ago by Michael432.
• This topic was modified 3 years, 6 months ago by Michael432.

1 user thanked author for this post.

ClearThunder

Reply | Quote

Replies

Alternative viewpoint: You consider it spying, the vendor is trying to proactively fix things. Put yourselves in the shoes of the vendors who have to play in the Windows space and deal with patching and feature release side effects.

Susan Bradley Patch Lady/Prudent patcher

3 users thanked author for this post.

Alex5723, OscarCP, ClearThunder

Reply | Quote

It could be both. It’s “just” diagnostic telemetry if the owner of the computer is aware of, and has approved, the data collection and transmission. It’s spying if the owner doesn’t know about it or wasn’t given a choice, even if it was only legit diagnostic data that was taken.

It is the practice of simply taking the diagnostic data without asking that has led to the conflation of the word “telemetry” with “spying.” It’s too much like the taking of personal data for marketing purposes without asking (and I don’t just mean having the description of what they plan to do buried in a EULA somewhere). It’s the ‘without asking’ bit that is key.

Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)

5 users thanked author for this post.

Rick Corbett, Michael432, Cybertooth, NaNoNyMouse, OscarCP

Reply | Quote

Very well put.

Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com

Reply | Quote

I stopped the Lenovo telemetry using my firewall, which I have set to alert me whenever anything wants internet access.  It will start up with the computer, but with the door locked, it’s benign and I usually close it manually (or preventing it from starting with the computer) with WinPatrol.  I do the same thing with Windows telemetry as well. It’s amazing (and disconcerting) how many windows components want internet access.  Outside of the MSFT, I block everything else for that session.

Susan has a good point about the telemetry, and it’s a valid one. One that I may just let past my firewall the next time I fire the old laptop up. If anything, just to see what it does —– how much traffic it brings in, and how much goes out, and what kinds of things Lenovo wants to pump into that seven year old boat anchor.

"War is the remedy our enemies have chosen. And I say let us give them all they want" ----- William T. Sherman

1 user thanked author for this post.

OscarCP

Reply | Quote

The more this happens, the most blasé the user gets? Live frog in a pan full of water on a low fire?

Or, paraphrasing just a bit Ron Dangerfield’s signature remark: “Users get no respect”?

Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

Reply | Quote

Why should we immediately assume it’s spying? Shouldn’t we investigate first?

What Is Lenovo Vantage and Should I Remove It? (partitionwizard.com)

it’s a software to find drivers.

On a Windows 10 machine one of the key ways to ensure that it is happy with Windows updates is to ensure that drivers are kept up to date. This is a tool to help the end user find the right drivers.  If you google on drivers you will find driver installation software that is bundled with malicious software.

Computer vendors in general aren’t there to get your information from you (aka spying), rather telemetry is there to make it easier for them and for you to have a better computing experience.

Spy or spying is “a person who secretly collects and reports information on the activities, movements, and plans of an enemy or competitor.”

That’s not what is happening.

“Telemetry is the automatic recording and transmission of data from remote or inaccessible sources to an IT system in a different location for monitoring and analysis. Telemetry data may be relayed using radio, infrared, ultrasonic, GSM, satellite or cable, depending on the application (telemetry is not only used in software development, but also in meteorology, intelligence, medicine, and other fields).

In the software development world, telemetry can offer insights on which features end users use most, detection of bugs and issues, and offering better visibility into performance without the need to solicit feedback directly from users.”

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Susan Bradley wrote:

Why should we immediately assume it’s spying? Shouldn’t we investigate first?

Sorry but, after the 2015 Lenovo ‘Superfish’ scandal (following which Lenovo paid out a $8.3 million settlement in 2019 to a class-action lawsuit), why should we just assume that it’s *not* spying?

Susan Bradley wrote:

That’s not what is happening.

How do you know? How do we manage to ‘trust, but verify’… when we cannot ‘investigate’ and verify?

2 users thanked author for this post.

Michael432, OscarCP

Reply | Quote

Distrust.

Do you still have HP Support Assistant installed on some of your managed or home computers? Have you looked at the all of the scheduled tasks?

I would like for somebody at Hewlett-Packard to explain why a Warranty check needs to occur every fifteen minutes in a day! (There was a new release recently and that same warranty check was restored to daily operation.)

Why did Touchpoint Analytics client need to be installed without warning in 2017 even with Support Assistant’s data collection turned off? (The install happened after checking for a Support Assistant update.)

Reply | Quote

Michael432 wrote:

LenovoVantageSchedule

I don’t have Lenovo\Vantage\Schedule on my Lenovo PC.
Never install Lenovo Vantage software. It has no use for me.
Uninstall the software.

Reply | Quote

I also have “HeartbeatAddinDailySheduleTask” running. Cannot find any info about this.

Reply | Quote

And, that is the difference between spying and telemetry, just as Ascaris said earlier.

I saw that scheduled task too.

Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com

Reply | Quote

Michael432 wrote:

Stumbled on Lenovo telemetry on a Windows 10 pc.

a drop in the ocean when consideration is give to the operating system in use..

Reply | Quote

Lenovo has a history in this arena:

Lenovo collects usage data on ThinkPad, ThinkCentre and ThinkStation PCs

https://www.computerworld.com/article/2984889/lenovo-collects-usage-data-on-thinkpad-thinkcentre-and-thinkstation-pcs.html

and

https://www.computerworld.com/article/2995012/trusting-lenovo.html

As for the Thinkvantage software, it has some configuration options. The PC in question was configured NOT to send usage stats as this image shows.

Get up to speed on router security at RouterSecurity.org and Defensive Computing at DefensiveComputingChecklist.com

Reply | Quote