LG Monitors Silently Install Software via Windows Update Without Consent
LG monitors silently install software through Windows Update without consent
I discovered that LG monitors are secretly pushing software updates through Windows Update without asking users for permission. This hidden practice bypasses standard consent protocols, raising serious concerns about privacy and user control over their own hardware. The silent installation method exploits the trust users place in Microsoft's update system to distribute potentially unnecessary or intrusive applications directly to connected displays.
LG monitors silently install software through Windows Update without user consent.
- devttyeu
This is so much worse that the title makes it out to be:
1. Your OS installs malware (technically manufacturers software) from a 3rd party vendor in background, zero user interaction
2. Happens as soon as you or anyone with physical access plug in a device into the HDMI port
3. That malware has internet and full system access, no sandboxing
4. It starts with every system boot
5. This software gets installed when you plug in a new LG monitor
6. OR ALREADY HAD AN OLDER LG MONITOR PLUGGED IN, BECAUSE LG APPARENTLY ROLLED THIS OUT FOR MANY OLDER MODELS TOO!!
7. And yes, if you think that's horrendous, as mentioned in the video below, that also applies to 'Professional' LG monitors!
This situation has.. no precedent as far as I can tell..
GamersNexus has a video diving deeper into what LG did here - https://www.youtube.com/watch?v=Q9uefFYe6bM
- delta_p_delta_x
Workaround:
gpedit.msc
Computer Configuration > Administrative Templates > System > Device Installation
Prevent automatic download of applications associated with device metadata
Set to enabled
OK
On home editions sans gpedit.msc:
sysdm.cpl
Hardware tab
Click Device Installation Settings
Under 'Do you want to automatically download manufacturers' apps for your devices?', select 'No'
Save Changes
- tialaramex
Assuming they don't get a revenue cut, pushing back on Microsoft can in principle be effective here.
Microsoft decides what happens here, and presumably today they just take it on trust that hardware makers know what software to install. New driver? Sure. McSpam installer? OK. Maybe they have a guideline saying "Don't ship unrelated garbage" but today it's not enforced because why would you do that?
If the Microsoft customers (particularly larger corporate customers) tell Microsoft they hate this that policy will get tightened or if there isn't a policy one is introduced, and outfits like LG get told if you do this again we're taking away your update privileges, 'cos our customers hated this. Because (as I said assuming MS don't get a taste) this is all downside for Microsoft.
Pushing back on LG will be less likely to work because you already bought their product, so at most you can insist you'll forgo LG next iteration and they know such pledges evaporate in practice usually. Whereas Microsoft has contract negotiations every day, somewhere a $$$ contract is being renegotiated next week and if "Yeah, these LG popups suck" comes up - even if it's not a corporate system but the VP's niece's video editing suite for her vlog that's strictly unrelated - that Microsoft sales droid reports this was an impediment and it's on the list of things that don't benefit Microsoft.
- gkbrk
A monitor cannot install software on your computer by the way. It's Windows installing this software automatically (for some reason), so the blame should be on Microsoft.
Autorun of malware when you plugged in a USB drive was also a Windows issue, I'd classify this as the same security problem.
- GaProgMan
Gamers Nexus have a video about this. Definitely worth a watch.
- kingleopold
They used to call this spyware/malware. Now it's a regular practice by eng. teams and managers inside these big corp. Well played guys :) Congrats with new type of tricks
- motbus3
I am tired of this. LG is now on my blacklist alongside EA and Blizzard Entertainment for their anti consumer practices.
I can't change them, I can't change policies about it. I can choose to not buy.
- OptionOfT
Windows urgently needs to revamp their driver consent model.
You can't block a just one driver. E.g. for my touch screen on the Lenovo website there is version X. When I install it the next day Windows installs X-1.
On Lenovo's website the latest version is 7.7.2.66 (https://pcsupport.lenovo.com/us/en/products/laptops-and-netb...).
Windows reverts that to 7.7.2.44.
I tried blocking that update with the Powershell command-thingy, but even that doesn't work:
Administrator in ~
get-windowsupdate -isHidden | ft Status,KB,Size,Title
Status KB Size Title
------ -- ---- -----
----H-- 92KB Wacom Technology - HIDClass - 7.7.2.44
(this command by the way takes 20+ seconds), and the filtering doesn't work because there is no KB.
- deathanatos
Malware like this will continue until there is privacy laws that make it illegal.
The GN video focuses a lot on consent, and while maybe this is notionally currently illegal without consent, that just steers towards companies shipping a generic ToS popup, claiming you "read" that 1.8 PiB of ToS, and including the "oh btdubs we can modify these terms at any times and if you want to go to court lol forced arbitration has other ideas about that."
MS & Windows having conditioned users to expect / think they need drivers for peripherals speaking standard protocols is also part of this. A monitor shouldn't need a driver. It takes the pixels, it displays the pixels.
- lardosaurusrex
I dunno why so many people across different platforms insist that anyone concerned about this is overdramatic.
This is one of those things where if I found the person responsible I would likely spit in their face; if not worse. It's quite literally spyware installed as you plug it in much like those old DVD DRMs from sony that would install spyware.
It's garbage.