LG and McAfee Found the Eight-Year-Old Gap

When you plug an LG monitor into a Windows PC, McAfee antivirus software might install itself without your consent—not a trial version with a clear uninstall option. The real thing, bundled and persistent, arriving through Windows Update like a system patch.

Microsoft has now begun blocking these installations. But the fact that LG and McAfee could execute this in 2023 means something important about how institutional memory actually works. Whether it works at all.

Eight years earlier, Lenovo shipped laptops with Superfish—a man-in-the-middle security software that intercepted encrypted connections and injected advertisements into them. The software came pre-installed and buried so deep in the system that removing it required manual registry edits. When the scandal broke in January 2015, it exposed a specific vulnerability, not in the laptops themselves but in the distribution mechanism.

Lenovo had used Windows Update (the channel Microsoft controls for critical security patches) to invisibly push security software onto millions of machines. Users trusted Windows Update because it carried the weight of the operating system itself—that trust became the vector. Microsoft responded by tightening Windows Update certification requirements, and it was the institutional move that looked like learning.

LG and McAfee appear to have used the identical distribution method—monitor drivers loaded through the same channel, triggering software installation that users never explicitly authorized. The mechanism survived eight years of supposed policy change intact. Either Microsoft's restrictions don't extend to hardware drivers, or vendors found the gaps and exploited them. Either way, the pattern repeated because the vulnerability wasn't actually fixed—it was just repositioned.

What's instructive isn't that companies try to install unwanted software. That's baseline behavior. What matters is recognizing that when you build a system expecting compliance, you've already lost. The vendors won't comply harder next time. They'll find where the compliance mechanism has a blind spot, and they'll pour through it.