Lenovo In Denial: Insists There's No Security Problem With Superfish -- Which Is Very, Very Wrong.

from the so-long-and-thanks-for-all-the-superfish dept

Late last night, people started buzzing on Twitter about the fact that Lenovo, makers of the famous Thinkpad laptops, had been installing a really nasty form of adware on those machines called Superfish. Many news stories started popping up about this, again, focusing on the adware. But putting adware on a computer, while ethically questionable and a general pain in the ass, is not the real problem here. The problem is that the adware in question, Superfish, has an astoundingly stupid way of working that effectively allows for a very easy man in the middle attack on any computer with the software installed, making it a massive security hole that is insanely dangerous.

Lenovo's response? Basically to shrug its shoulders and say it doesn't understand why anyone's that upset. This is because whoever wrote Lenovo's statement on this is completely clueless about computer security.
We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns.
Bullshit. That's really the only response that should be said to that line. Lenovo focuses on the reasons why many people normally hate adware: that it tracks what you're doing and sends info back to third parties. That's not what Superfish does, so Lenovo doesn't see what the big deal is. Superfish, which was just recently ranked 64th by Forbes in its list of "Most Promising American Companies," tries to watch what you're surfing, and when you see certain images, the service injects other offerings for similar (or the same) products. In theory, if one chose to use such a product, you could see why it could be useful. But automatically putting it on computers is a different thing all together.

The real problem is in how Superfish deals with HTTPS protected sites. Since, in theory, it shouldn't be able to see the images on those sites, it appears that Superfish came up with what it must have believed was a clever workaround: it just installs a root HTTPS certificate, that it signs itself, to pretend that any HTTPS page you're visiting is perfectly legitimate. For many years, we've pointed out why the HTTPS system with certificate authorities is open to a giant man in the middle attack via any certificate authority willing to grant a fake certificate -- and here we basically have Lenovo enabling this questionable company to go hogwild with this exact kind of MITM attack. Basically, EVERY SINGLE HTTPS SITE that you visit was a victim of this kind of MITM attack -- solely for the purpose of interjecting Superfish ads. In fact, some have suggested it could apply to VPNs as well. Basically this is a massively dangerous security hole with wide ranging implications. And Lenovo says they don't see why.

And, even beyond that, it's implemented incredibly stupidly -- in a way that is ridiculously dangerous. That's because it appears that the private key use for the Superfish certificate is the same on basically every install of this software. And it didn't take very long at all for security folks, such as Robert Graham, to crack the password, meaning that it's now incredibly easy to get access to information someone thinks is encrypted. As Graham notes, the password is "komodia" which just so happens to also be the name of a company that "redirects" HTTPS traffic (for spying on kids and such).

This is a massive and ridiculous security threat, and Lenovo is completely brushing it off as nothing big. As many have noted, people have been complaining about the adware components of the software for months now, and Lenovo announced that it was stopping installs, because some people didn't like the way the software created popups and such -- but with no mention of the massive security problems. And, even now, the company doesn't seem willing to admit to them.

Furthermore, the company doesn't even seem willing to say what machines it installed them on, or provide people with instructions on how to protect themselves (simply uninstalling Superfish won't do it). This is a huge mess. I've personally been a very loyal Lenovo Thinkpad customer for years, having bought many, many laptops. In fact, just a couple months ago -- right in the middle of the period of when Superfish was being preloaded -- I bought a new Thinkpad laptop, though it appears that mine is not one that includes Superfish. Still, Lenovo created a huge and dangerous mess, and they don't seem to recognize it at all. This kind of fuck up is much worse than the whole Sony rootkit thing from a decade or so ago, and as with Sony then, Lenovo doesn't seem to have the slightest clue of just how badly it has put people at risk.

It doesn't take much to kill off tremendous goodwill and trust, and Lenovo may have just done so with it's pitiful reaction here. It's one thing for Lenovo to have made the stupid decision to install this kind of adware/bloatware. It's a second thing to not realize the security implications of it. However, it's another thing entirely, once it's been pointed out to Lenovo to then deny that this is a security risk. Lenovo screwed up big time here, and mostly in the way it's responded to the mess it created.

Reader Comments

Subscribe: RSS

View by: Time | Thread


  • icon
    John Fenderson (profile), 19 Feb 2015 @ 10:28am

    It did for me

    It doesn't take much to kill off tremendous goodwill and trust, and Lenovo may have just done so with it's pitiful reaction here.


    Including Superfish and the bogus certificate was a terrible thing to do in the first place, but what convinced me to never buy another Lenovo machine in the future was this exact response by them. It indicates either an insane level of incompetence or a deliberate effort to deceive everyone. Either way, that's enough to put them on my "never do business with" list.

    reply to this | link to this | view in chronology ]

  • identicon
    WhoKnows, 19 Feb 2015 @ 10:30am

    Lenovo - Motorola

    Are Lenovo (and now Motorola) tablets and smartphones free of this crap ?

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 19 Feb 2015 @ 10:31am

    I hope that Techdirt does not let this story die. Lenovo needs to have its feet held to the fire.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 19 Feb 2015 @ 10:32am

    Links to other coverage of Superfish

    EFF: Lenovo is breaking HTTPS security on its recent laptops (by way of Linux Weekly News)

    Superfish key (thanks to EFF for the link).

    Test site to check if a system accepts the Superfish super-CA (also thanks to EFF/LWN for the link).

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 19 Feb 2015 @ 10:33am

    Maybe their security staff (think plants working for others) told them it was a harmless thing to do. Never ascribe to incompetence what may be a deliberate act. Gone to buy more tin foil.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 10:44am

      Re:

      The problem is more likely that the security people answer to the marketing department. When a tech company puts its financial and legal staff in charge of its engineers, it's time to say goodbye.

      reply to this | link to this | view in chronology ]

    • icon
      Josh in CharlotteNC (profile), 19 Feb 2015 @ 10:50am

      Re:

      I think it more likely that their security staff are actually plants. The potted kind that need daily watering.

      reply to this | link to this | view in chronology ]

  • identicon
    Derrick Johnson, 19 Feb 2015 @ 10:34am

    Never Lenovo or Thinkpad

    Honestly, I've never been a fan of Lenovo or Thinkpad and this just reconfirms my decisions in the first place. This is absolutely ridiculous for any company to not realize exactly what they are doing to a customers computer. They are either ignorant, incompetent or just liars. Either way, stay away.

    reply to this | link to this | view in chronology ]

  • icon
    Mason Wheeler (profile), 19 Feb 2015 @ 10:35am

    So when the government warns us that Chinese hardware manufacturers are selling stuff that will make us vulnerable to being spied on, we shouldn't listen. But when Ars Technica and Robert Graham pass along such a warning, then it's finally time to listen? ;)

    reply to this | link to this | view in chronology ]

    • icon
      Josh in CharlotteNC (profile), 19 Feb 2015 @ 10:48am

      Re:

      When Ars and Robert Graham provide the documented evidence and the government doesn't... yes.

      reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 10:59am

      Re:

      Did the government specifically warn us about this vulnerability? No. How about the 14 year pwn of HDDs? No. Recent and ongoing revelations teach us that the government is far more interested in hacking our systems than it is in warning us. The government is the last place I expect honest, realtime information to come from.

      reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 11:03am

      Re:

      One word: credibility

      When the gov says it then you never know if they just try to blame someone else for something they implanted in the first place. If tech sides post something then well... they aren't spying themselves so it is possibly true and I believe them.

      btw. Techsite owners: if the NSA visits you the next days and tries to make you post stuff because people believe you more than them... you're welcome!

      reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 11:22am

      Re:

      If I am not mistaken the government warning was general for all chinese products without providing evidence (except indicating routers). Those kinds of non-specific warnings are overbroad and bordering on nationalistic state propaganda since it will hurt innocent companies from the country!

      The more specific warning seems to be relatively well investigated and documented from fall 2014 to now.

      The problem for Lenovo is their insistance that the program people have documented as a potential backdoor, should not be seen as any "security concern". For people who know a bit about computers that is scary ignorance or malicious intend since history has taught us that potential vulnerability has to be assumed a potential future exploit if you have any respect for your customers.

      reply to this | link to this | view in chronology ]

    • icon
      John Fenderson (profile), 19 Feb 2015 @ 1:26pm

      Re:

      Ars Technica and Robert Graham presented actual evidence. The government never has.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 19 Feb 2015 @ 10:42am

    Hmm. I think you named the software wrong. Shouldn't it be Superphish?

    reply to this | link to this | view in chronology ]

    • identicon
      Ven, 19 Feb 2015 @ 11:27am

      Re:

      With a name like that it almost feels like they were trying to tell us they were up to no good and daring some one to call them on it.

      It reminds me of the Reacher Gilt character from the Discworld novel "Going Postal", who had the appearance pirate as he used business deals to steal as much money as he could.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 19 Feb 2015 @ 10:43am

    Settle down, Chinese government just wanted to map out a few networks, that's all. It was either add it or watch 3 generations of your family go to "work farms".

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 19 Feb 2015 @ 10:58am

    Still shocked by the password. Not even a 123 or -123... nothing. How can you ship a product that uses a lowercase only pass for something the consumer isn't supposed to touch?

    reply to this | link to this | view in chronology ]

  • identicon
    David, 19 Feb 2015 @ 10:58am

    So, every Lenovo laptop is easily attacked using MITM attacks using the Superfish CA? Which is now widely available? And Sony doesn't see a problem? Am I really reading this right?

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 11:06am

      Re:

      "And LENOVO doesn't see a problem? Am I really reading this right?"
      FTFY and now yes you do.

      reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 11:08am

      Re:

      "So, every Lenovo laptop is easily attacked using MITM attacks using the Superfish CA? "

      I believe only some models, not all.

      reply to this | link to this | view in chronology ]

      • icon
        Mike Masnick (profile), 19 Feb 2015 @ 11:30am

        Re: Re:

        I believe only some models, not all.


        Yes, only a subset of "consumer" models. My T-series isn't effected, since that's a "business" model, apparently.

        reply to this | link to this | view in chronology ]

        • identicon
          Joel Coehoorn, 19 Feb 2015 @ 11:42am

          Re: Re: Re:

          FWIW, it's not that they don't want to "sell" this stuff to business customers. It's that the scammy software distributors don't want to pay for it on the business lines, because so many business customers replace the stock image with their own.

          reply to this | link to this | view in chronology ]

        • identicon
          Anonymous Coward, 19 Feb 2015 @ 12:55pm

          Re: Re: Re:

          "affected", not effected, and I hope you mean because you wiped the included image. Yes, this is a security problem, but running the included software is a security problem in and of itself (even the firmware, these days, but the difficulty of replacing it gives you an excuse not to do it; there's no good reason not to blow away the vendor OS image though).

          reply to this | link to this | view in chronology ]

  • icon
    Gumnos (profile), 19 Feb 2015 @ 11:00am

    Lenovo preloaded software

    Not too concerned, having installed Linux/BSD on my Lenovo laptops. The hardware used to be good, but one had a keyboard die within the first year, and the other has flaky USB & camera issues. Sigh. Not doing Lenovo again for multiple reasons. Please don't make me go back to Dell.

    reply to this | link to this | view in chronology ]

  • identicon
    rusho, 19 Feb 2015 @ 11:12am

    Culture

    It probably has to do with the culture they are living in in that country.

    reply to this | link to this | view in chronology ]

  • icon
    Geno0wl (profile), 19 Feb 2015 @ 11:12am

    Why do people think this is a big deal.

    Wait, people's first step in any pre-built machine ISN'T to instantly wipe and build the install themselves to get rid of all the BS on the image?
    I mean that is what I have been doing for years.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 11:18am

      Re: Why do people think this is a big deal.

      You're the 1%. You might have avoided this yourself, but think of all the non-technical (or even technical-but-with-little-free-time) people around you. Your family. Your friends. The employees of businesses you frequent.

      Even if you can smugly say you aren't directly affected, this is a concerning vulnerability.

      (I mean, I'm a smug Linux user, all my machines run Linux, but a Windows-specific vulnerability like this one still concerns me.)

      reply to this | link to this | view in chronology ]

      • identicon
        Ven, 19 Feb 2015 @ 11:41am

        Re: Re: Why do people think this is a big deal.

        This isn't a Windows-specific vulnerability.

        While it would be a more difficult task, this could be done on Linux if you buy a pre-built computer with a distro already installed. It just needs to come with a repository URL pointing to the manufacturer and, for example, have openssl-superfish and gnutls-superfish patched libraries installed instead of the upstream libraries.

        There is an inherit trust relationship when using a pre-imaged machine, and Lenovo has violated that trust.

        reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 11:26am

      Re: Why do people think this is a big deal.

      Main problem, is most of these were christmas season laptops. When your mom buys her partner a laptop for christmas, when a parent buys their child a laptop for school, how many of those random customers will think "I need to image this laptop before I use it?"

      How many of the thousands (millions?) of non-technical end users only see a new computer to do research/email/school/etc. and just care that it "just works?"

      Those are the people who will be served websites that "require an update" and download a file "signed" by microsoft.

      So what if YOU nuke and pave once a month and wipe every new machine. Does your mom do that? Your siblings? Even your coworkers who should know better?

      reply to this | link to this | view in chronology ]

  • identicon
    Rich Kulawiec, 19 Feb 2015 @ 11:18am

    Isn't it time to cue the prosecutors?

    I mean, if they're not too busy harassing journalists and activists and bullying hackers and researchers, maybe, just this once, they could find the time to go after a corporation that deliberately broke the security of tens of thousands of people (and quite possibly many more: that figure is based on the EFF's report about what their SSL observatory has seen).

    This is a systematic, malicious, intentional large-scale attack, with serious adverse consequences for those affected...unlike, let's say, mass downloading of academic journal articles. So where are those who like to wield the CFAA like a club? When can we expect to see Lenovo executives being dragged out of their offices? How about the indictments, where are those? And can we expect aggressive prosecution with the threat of long prison sentences?

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 11:33am

      Re: Isn't it time to cue the prosecutors?

      Did you forget the golden rule?
      Those with the gold make the rules

      Lenovo has too much money to be punished over this.

      reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 12:05pm

      Re: Isn't it time to cue the prosecutors?

      The government probably doesn't want to admit they've known about this and been using it all along.

      reply to this | link to this | view in chronology ]

    • icon
      That One Guy (profile), 19 Feb 2015 @ 7:49pm

      Re: Isn't it time to cue the prosecutors?

      The government doesn't go after targets that might fight back, so I'm sure they'll ignore this one in favor of going after some 'malicious hacker' who'll be an easy win for them.

      reply to this | link to this | view in chronology ]

  • icon
    Jon Renaut (profile), 19 Feb 2015 @ 11:26am

    Hooray Websense for a change

    I tried to check out Superfish's home page to see if they'd made a statement and Websense blocked it as "Potentially Unwanted Software".

    reply to this | link to this | view in chronology ]

  • identicon
    Joel Coehoorn, 19 Feb 2015 @ 11:39am

    Some Credit

    You have to give them some credit: they stopped adding this stuff in January, well before the story broke.

    That said, there's still a lot of product out on store shelves that will take the better part of a year to clear out. Lenovo ought to recall this merchandise and re-image the machines. They could even resell them as refurbished (I for one would look forward to a glut of near-perfect refurbished laptops hitting the market).

    There's also the issue of what to do for customers who already purchased these machines. There is, at this point, no evidence of active abuse for this vulnerability. A simple patch the merely removes the entry from the trusted certificates store would be adequate to protect consumers. However, that would leave many of them feeling that their machines are broken (their browser would show every https site they visit as fake), and so completely removing the service will be necessary. This is a harder patch, but just making the patch available and notifying customers would be adequate. At least, it's the bare minimum.

    Unfortunately, Lenovo has not yet taken either of these steps. Instead, they published a response that demonstrates a complete lack of understanding of the issue.

    reply to this | link to this | view in chronology ]

    • identicon
      Rich Kulawiec, 19 Feb 2015 @ 12:03pm

      Re: Some Credit

      "There is, at this point, no evidence of active abuse for this vulnerability."

      Which means nothing.

      Think about it for a minute: what, exactly, would that evidence look like? And how would one make a definitive connection from it to Superfish?

      That circumstance isn't an accident. It's called "plausible deniability" and it will enable Lenovo, during the inevitable class-action lawsuit, to claim that observed symptoms X and Y and Z were not caused or enabled by Superfish, but by some other security issue on the affected systems.

      reply to this | link to this | view in chronology ]

      • identicon
        jackn, 19 Feb 2015 @ 1:02pm

        Re: Re: Some Credit

        "There is, at this point, no evidence of active abuse for this vulnerability."

        Yes, there is. They impersonated 1000's of websites. That is called abuse.

        reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 1:09pm

      No credit

      A simple patch the merely removes the entry from the trusted certificates store would be adequate to protect consumers. However, that would leave many of them feeling that their machines are broken (their browser would show every https site they visit as fake), and so completely removing the service will be necessary. This is a harder patch, but just making the patch available and notifying customers would be adequate.
      I would classify such a patch as a necessary, but insufficient, step. As I understand it, there is currently no mechanism to ensure that users discover the existence of the flaw, that they understand the severity of the flaw, or that they understand the need to install the fix proposed here. The extensive news coverage will probably help the first problem. Lenovo's deceptive pseudo-disclosure will hurt with the second problem.

      Although not exactly appropriate, a product recall notice occurs to me as one way to notify consumers. Not everyone is guaranteed to read that either, but at least users who worry about physical defects in their purchases will be periodically reading recall announcements. It will help that some vendors have shipped laptops that later were recalled as fire hazards, so monitoring recall notices on one's laptop has practical value.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 19 Feb 2015 @ 11:56am

    They have stated which hardware has Superfish
    http://news.lenovo.com/article_display.cfm?article_id=1929

    reply to this | link to this | view in chronology ]

  • icon
    BentFranklin (profile), 19 Feb 2015 @ 12:04pm

    Can we hit Superfish with CFAA violations?

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 19 Feb 2015 @ 12:43pm

    Mint my own certs

    So...if I can get my black hat hands on that cert, I can mint my own valid certificates? Cool!

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 1:09pm

      Re: Mint my own certs

      Yes, you can mint your own certificates, but the only people who will see them as valid certificates will be those who have Superfish's root certificate as a Trusted Root certificate.

      So, basically, yes, it'll work, but your certificates will only be recognized by those who have chosen to install Superfish, and those who have the affected Lenovo laptops.

      reply to this | link to this | view in chronology ]

  • identicon
    Steve, 19 Feb 2015 @ 1:06pm

    Consumer line only?

    We pretty much use lenovo products exclusively in my company, but since we load a custom image on them I don't know if any of ours originally shipped with this software. I do know though that their consumer models tends to come with lots of 'free software' that isn't included (or wanted) on their business models.

    From the descriptions I've read, this sounds like the kind of product that I might expect to find installed on lenovo's consumer line products. Does anyone know if this was occurring in "Think" branded products, or only in "idea" branded products?

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 19 Feb 2015 @ 3:35pm

      Re: Consumer line only?

      -Run certmgr.msc
      -Go to Trusted Root Certificate Authorities\Certificates
      -Look for a certificate issued to Superfish, Inc. by Superfish, Inc.

      Alternatively, use Superfish CA test

      reply to this | link to this | view in chronology ]

    • icon
      John Fenderson (profile), 19 Feb 2015 @ 3:46pm

      Re: Consumer line only?

      According to Lenovo:


      Superfish may have appeared on these models:
      G Series: G410, G510, G710, G40-70, G50-70, G40-30, G50-30, G40-45, G50-45
      U Series: U330P, U430P, U330Touch, U430Touch, U530Touch
      Y Series: Y430P, Y40-70, Y50-70
      Z Series: Z40-75, Z50-75, Z40-70, Z50-70
      S Series: S310, S410, S40-70, S415, S415Touch, S20-30, S20-30Touch
      Flex Series: Flex2 14D, Flex2 15D, Flex2 14, Flex2 15, Flex2 14(BTM), Flex2 15(BTM), Flex 10
      MIIX Series: MIIX2-8, MIIX2-10, MIIX2-11
      YOGA Series: YOGA2Pro-13, YOGA2-13, YOGA2-11BTM, YOGA2-11HSW
      E Series: E10-30


      That "may have" bugs me, since it implies that the list is not complete.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 19 Feb 2015 @ 1:12pm

    They are about to have a realllllly shitty day tomorrow morning:

    http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 19 Feb 2015 @ 1:16pm

    Tinfoil hat time

    So... How long has the NSA known about this adware and been using it as cover for their own access to the machine? Have Lenovo deploy it widely enough to disguise any targetting metrics, use the superfish update mechanism as their C&C mode, and unless someone actually catches an example where they've tailored the superfish system, nobody is the wiser.

    Add tailored access (QUANTUMINSERT) and even superfish need not know that their attackware has been compromised.

    reply to this | link to this | view in chronology ]

    • identicon
      Ven, 20 Feb 2015 @ 8:43am

      Re: Tinfoil hat time

      Who's to say that Superfish isn't an NSA or CIA front?

      /tinfoilhat

      reply to this | link to this | view in chronology ]

      • icon
        John Fenderson (profile), 20 Feb 2015 @ 10:15am

        Re: Re: Tinfoil hat time

        Superfish founder & CEO, Adi Pinhas, has a long history in the field of surveillance technology. He is also pretty famous for the fact the every project he has been involved with has been malware and spyware. He's been a fairly reviled figure for over ten years.

        So, while speculation about Superfish being an intel front isn't ridiculous, it's also not necessary. I don't think that the company would do anything differently at all if they are or are not, and the intel agencies would derive just as much of a benefit either way.

        reply to this | link to this | view in chronology ]

  • identicon
    Mr Big Content, 19 Feb 2015 @ 4:09pm

    What Is This "Bad Guys Can Use It Too" Bullshit?

    If we banned everything just because bad guys can take advantage of it too, we'd never have guns.

    reply to this | link to this | view in chronology ]

  • icon
    That Anonymous Coward (profile), 19 Feb 2015 @ 4:53pm

    So they start the day with a press release saying it was no big deal, it was just to benefit consumers....
    Now it is a severe security warning on their website.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 19 Feb 2015 @ 7:48pm

    Mike, Mike, Mike....
    Why do you so hate capitalism? Lenovo was just trying to maximize profits, as any good capitalist should. Sure, they may have made a mistake, but their heart was in the right place.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 20 Feb 2015 @ 12:47am

    My mother's laptop got infected with Superfish a while ago. I ended up having to wipe the laptop, and it had still infected her Microsoft profile's Internet Explorer settings, meaning it came back after she signed back into her fresh install, so I scrubbed that profile clean of it and reformatted again immediately, just to be sure.

    I'm certainly never going to buy a Lenovo computer ever again now that I've seen this story. I've got a Lenovo Android device, which has been fine up until now but honestly I don't think I want it any more, given the power manufacturers have over what gets installed remotely onto "their" hardware...

    I'm absolutely disgusted.

    reply to this | link to this | view in chronology ]

  • icon
    bugmenot (profile), 20 Feb 2015 @ 2:09am

    At no point was Superfish installed on *any* Thinkpad laptops. This affects *only* the low end consumer Ideapad division. Lenovo has stated this also. See this article: http://thenextweb.com/insider/2015/02/19/lenovo-posts-superfish-removal-instructions-fails-acknowled ge-severity-problem/

    Article above should be amended to correct this. What they've done is indefensible, but get the facts right.

    reply to this | link to this | view in chronology ]

  • identicon
    RandallX, 20 Feb 2015 @ 11:13am

    Hang 'em High!

    This kind of crap will continue and get even worse. The bad guys know that NO ONE is doing anything about it. All they have to do is say, "Sorry" and all is forgiven. Bullshit! We need to start seeing CEO's going to prison. This is a violation on an epic scale and the consequences should fit the crime. Not only should the CEO of Lenovo go to prison, but so should the people that made the software in the first place. If we start throwing these despicable people in prison others might start to think that this kind of tactic isn't all that great of an idea after all. But if we let it go, then every other prick in the world will be lining up to screw the public as well. As a citizen of this country, I demand that we see these bastards in prison! And you should too!

    reply to this | link to this | view in chronology ]

    • icon
      GEMont (profile), 22 Feb 2015 @ 4:13pm

      Re: Hang 'em High!

      We are very sorry, but the re-think version of the US Constitution - made possible by the wonderful 9/11 Crisis (tm) - states plainly that nobody among the 1% can be held responsible for their crimes against the 99%, as this is simply business and thus perfectly legal.

      If you want justice, you have to join the 1% of the US population, by whatever means - fair or foul - or suffer the consequences of the laws, according to the new Corporate Constitution of the United States of America.

      ---

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 23 Nov 2015 @ 2:29pm

    Might wanna re-check those Lenovo machines, as recent updates have pushed out MORE hidden self-signed root certificates.

    Lenovo (internally) decided to wait a few months for 'the stupids [quote]' to focus on something else and then re-introduced superfish but now with chameleon name-randomizing capability.

    Of course its 100% coincidental that 'someone' within 12hours of the update going live started siphoning data to chinese government-owned servers....

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Techdirt Gear
Shop Now: I Invented Email
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.