Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

http://www.wired.com/2015/02/lenovo-superfish/

by taylorwc • 11 years ago

397 174 11 years ago

Great... I'm the last person in the startup world still using a PC, and it happens to be a Lenovo.

finnn• 11 years ago

And you're still running the OS that it came with? Even if you want to keep Windows, always reinstall fresh. It's far easier than trying to hunt down every piece of malware they put on it

pjc502• 11 years ago

nkozyra• 11 years ago

The time period where Superfish was included was a relatively small chunk of 2014, so you may not be impacted.

A good general guideline when buying an off-shelf Windows machine is to do a full wipe first. There may be some manufacturers who are immune to this, but assume everyone's included some bloatware. I find too many people who buy Windows machines start by attempting to manually remove this stuff, which is often a hopeless proposition. Clean wipe, reinstallation.

This isn't the reason why most startups/devs have moved to Apple, but it sure helps.

stcredzero8• 11 years ago

assume everyone's included some bloatware

We programmers should use this as an analogy for dealing with everyday psychological issues.

secabeen2• 11 years ago

Is it a Thinkpad, or a consumer model? The Thinkpads were never involved in this.

microtonal• 11 years ago

Well, given that they are morally corrupt enough to do this to their customers, why not expect them to have similar trojans or backdoors on Thinkpads?

If we assume firmware is safe, wipe it and do a clean install from trusted media.

billhendricksjr2• 11 years ago

Thinkpad T430s. It's a year old so I'm in the clear upon more detailed reading of the article. I usually do a clean install but when I bought this box it came installed with Win 7 and the discs I got were Win 8 only. Didn't come with a Win 7 serial. This is what I get for buying from a reseller on Amazon.

vacri• 11 years ago

Hey, I use a desktop machine. That paints me as some kind of startup weirdo. Granted, it runs linux, but still, it doesn't fold in the middle or have it's own monitor and keyboard built in.

leereeves• 11 years ago

The more they deny this is a problem, the more it damages their reputation.

They should just admit the problem, thank the security experts, and develop an easy fix.

Ronsenshi2• 11 years ago

They did admit the problem and linked page describing how to remove SuperFish.

We're sorry. We messed up. We're owning it. And we're making sure it never happens again. Fully uninstall Superfish: http://lnv.gy/182BW8g

https://twitter.com/lenovoUS/status/568578319681257472

scott_s• 11 years ago

Then there's a disconnect between the PR people who handle that Twitter account, and the PR people who are quoted in this story.

rdtsc8• 11 years ago

Only after various rounds of denials followed by backlash against them. Even their "removal" instruction initially failed to fully remove the root certificate. Every single step they made PR-wise was too slow and just reactionary to the backlash. Somebody up there should be fired and replaced.

rdtsc8• 11 years ago

Their PR style is a bit outdated. Denying and minimizing worked before very well -- major news sources would publish the official denials only and it would kind of stop there.

And most of all it helped if there would be litigation. The thought goes if CTO goes on record admitting guilt that is a slam dunk case for anyone suing them.

Therefore the typical corporate non-apology apology "I am very sorry you feel this way" kind of bullshit.

The problem of course is information sources are a lot more diversified, with Twitter and other media bubbling up tech news to the top faster.

The other problem they are facing is a lot of technical people were their proponents and would advocate and drive purchasing decision (in turn putting their own reputation on the line). This is where it is going to hurt them.

Something to the effect of "We are very sorry, this was a mistake, here is how to remove the software, we'll send you free software or Lenovo.com discounts. We'll cut off our relationship with this company. Etc, etc.." I think would have been much better for them in the long run.

rcthompson4• 11 years ago

I warned all my friends and colleagues who use Lenovos, and their answers were all the same. "Who'd be crazy enough to use the default install? First thing I did was (a fresh reinstall of Windows|install Linux)."

(Edit: Obviously this is not representative of the general population, and I didn't mean to suggest it was. I was just noting that my efforts to warn people about the untrustworthiness of Lenovo were thwarted because none of them trusted Lenovo to begin with, not for software at least, and that seemed interesting.)

tedks• 11 years ago

You live in a bubble. There are plenty of people who use Lenovo products that are not tech people. By saying this, even though you don't intend to, you are minimizing the effect of this and being an apologist for lenovo.

rcthompson4• 11 years ago

Well, I wasn't trying to do that. I'll edit my comment to make my intent more clear.

stcredzero8• 11 years ago

An intellectual should always be wary of semantic equivalents to, "You're either for us, or against us." In greatest part, because this is one of the major symptoms that one's consciousness is partly clouded by group psychology.

philh• 11 years ago

I don't like the attitude that if there's a problem, you aren't allowed to say anything along the lines of "here's something that makes it less of a problem than it might be".

wfunction• 11 years ago

I use a default install and I'm a techie. I just remove the bloatware first.

nitrogen• 11 years ago

Sometimes this is the only way to get CPU scaling to work properly, as the drivers for the laptop's particular quirky ACPI implementation may not be available sepatately. It's no fun having a clean system that either runs at 1999 speeds or burns a hole in your desk. Linux can be a bit better on some systems, but worse on others.

rogerbinns3• 11 years ago

The last Lenovo laptop I got came with Norton. I uninstalled that completely. Then I went to download Chrome which Norton decided to protect me from. Uninstall means different things, and they never uninstall completely/cleanly. In this Superfish example they would have left the dodgy certificates behind. The only way you know you have a good install is to do a clean install, rather than attempt surgery on the crap that got shipped.

Fortunately Lenovo do have a system updater that does a fantastic job on driver downloads etc.

ExpiredLink• 11 years ago

The CD for the clean install is included in the Home versions? Interesting.

burkaman• 11 years ago

It's not, but you don't need one. You can make your own disk or USB pretty easily: http://windows.microsoft.com/en-us/windows-8/create-reset-re...

mattmanser2• 11 years ago

On that note, Microsoft seem to have taken down the windows digital downloads, OEM CD keys don't work. How would you do a fresh install now?

rcthompson4• 11 years ago

I didn't ask them. Maybe piracy + "I have a Windows license so it's ok-ish" rationalization.

chadzawistowski• 11 years ago

I had trouble finding Windows 8.1 iso files, but Windows 8.0 isos were easy to find, and upgrading was simple.

icegreentea• 11 years ago

I followed this a few weeks ago:

http://windows.microsoft.com/en-CA/windows-8/create-reset-re...

Got me a 8.1 ISO, installed with a volume key.

pjc502• 11 years ago

This is repeatedly recommended, but I think it's overlooking that not all manufacturer customization is entirely evil. You then to hunt down all the drivers for bits of the motherboard. Are you sure your power consumption settings etc are optimal after you've done this? Have you installed all the drivers "manually" via their inf files? (e.g. Nvidia drivers come with their own pile of bloatware)

rcthompson4• 11 years ago

Yes, not all manufacturer customization is evil. But my point is that no one in my circle trusts the manufacturer enough to leave any of it on their machine.

rogerbinns3• 11 years ago

Lenovo does this for you with their system updater. It downloads and updates all drivers for your system, including bios updates and configuration tweaks that affect power and stability. It will install on a fresh install from Microsoft media - ie there is no need to keep what was preinstalled on the system. http://support.lenovo.com/us/en/documents/ht080136

emodendroket2• 11 years ago

I mean, sure, you do, but that takes less time than removing all the stuff you don't want.

dredmorbius6• 11 years ago

But by tying in good and quite obviously bad customizations, you're attacking the entire value proposition of a vendor preload.

It's why I've, in general, never trusted them.

javert• 11 years ago

I'm on my 4th Thinkpad. I always do a fresh install of Linux, would never trust the pre-installed crap.

But now that I know that Lenovo is a piece of shit company with zero integrity, I don't even want to trust their hardware.

MichaelGG4• 11 years ago

I despise Lenovo. Purely from an engineering quality aspect, they aren't remotely close to IBM. I've been on the T440p for a year now, and I utterly hate using it. Every time I'm not docked, I'm really, really, annoyed. (Compared to feeling great when on the X201.)

But what am I gonna do? There's essentially no options to replace an old X-style ThinkPad. The newest Carbon X1 is as close as anything. Everyone else is moving to the Apple-style clickpad, which is unacceptable. HP and Dell sell mostly crap. Apple's devices are hot and unergonomic (apart from questionable Windows driver support).

So good luck not trusting them. And I doubt HP'd do any better.

dredmorbius6• 11 years ago

I'm at the level of hardware trust issues myself.

jhou22• 11 years ago

I was under the impression that Lenovo supplies a lot of computers to government and enterprise contracts around the world. Was Superfish only installed on consumer oriented devices, like the ones typically found at Best Buy? I realize most large enterprise would re-image their computers before deployment. I'm shocked that Lenovo would release such a statement. The damage to its credibility is significant.

rdtsc8• 11 years ago

Yes, it was only installed on their consumer oriented machines. Their T model Thinkpad don't have it installed.

Now the question is of course what else are they installing and what other yet undiscovered issues we'll find. It sounds like FUD but so far based on their response, they seem either incompetent (stupid) or malicious. And I don't exactly like either...

ZanyProgrammer• 11 years ago

I never quite got this distinction between consumer and non consumer machines, when you can buy high end ThinkPads (but not the blocky T models) at a retailer, and are just as nice as big old blocky good old ThinkPads.

I'm really interested if a high end (but "consumer") ThinkPad like http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo-T... that you can buy at a retail store (in this case, a special MSFT Store version that has plain Windows supposedly on it) was infected.

buro9• 11 years ago

Microsoft is currently doing Lenovo's work for them: https://twitter.com/FiloSottile/status/568800260111388672

The latest version of Windows Defender is actively removing the Superfish software and the cert.

The text of the definition is here: http://pastebin.com/raw.php?i=us7iXvkn

danielweber• 11 years ago

15 years ago this would have led to rioting on slashdot and Usenet. How dare Microsoft remove someone else's software?

I'm generally in favor of MS doing this specific thing, but there is potential for abuse here.

taylorwc• 11 years ago

Agreed. Seems like the lesser of two evils in this case. I applaud MSFT for realizing that the vast majority of their users will not have the impetus nor the requisite skill to remove this from their machine.

rdtsc8• 11 years ago

No 15 years ago Microsoft would have been the ones installing it.

I think Microsoft went from being a hated software giant to sort of an underdog vis-a-vis Google, Facebook, Amazon and Apple.

They are very big and strong no doubt, but I think the attitude they are projecting since switching CEO recently, their open source efforts, and such make them look pretty good PR-wise among the tech crowd.

ewzimm• 11 years ago

They are not removing someone else's software though, they are alerting you to a security issue, recommending removal, and providing the tools to do so. That's exactly what an antivirus is supposed to do.

apaprocki• 11 years ago

For all we know, Lenovo and Microsoft have been in communication and Lenovo asked or was ok with Microsoft doing this via Defender. Also, Defender specifically flags this issue as a "CompromisedCert", indicating that the impetus for removing it was not necessarily the app itself but because the private key for the cert was found and leaked everywhere.

ghshephard3• 11 years ago

This is only is if Windows Defender is operational - in which case the user definitely wants the malware to be disabled/removed. It's akin to having a SPAM defender - in which you grant administrative rights to the owner of the Anti-SPAM tool to redirect spam to the bit-bucket.

dredmorbius6• 11 years ago

Sorry, but as one who was on Slashdot from pre-userid days, and is in general a huge critic of the company, bullshit.

Microsoft is in a hard place in terms of determining what is or isn't allowed on their systems (due in large part to their own past and quite probably ongoing monopoly abuses), but fixing obvious flaws is to be applauded.

I don't champion the company often, but they're doing the right thing here. Actually, sanctioning Lenovo for letting this happen might be another option they've got. Though something tells me they won't play that card (and quite possibly cannot).

drzaiusapelord• 11 years ago

Every AV should be doing this. Is MS the only one doing it?

stcredzero8• 11 years ago

Defender is my current Windows anti-malware software of choice. Basically, because they don't feel they have to shill so hard as the other AV companies, and this makes their user experience suck the least.

flyinghamster• 11 years ago

For that matter, were AV vendors intentionally looking the other way with Superfish, or any other nasties?

arthurfm2• 11 years ago

ESETs NOD32 prevents Superfish from being installed. I'm not sure if it does any more than that though.

http://i.imgur.com/NCfBs6K.png

fname• 11 years ago

This is really great, but the real question is will users actually see this on a default Lenovo OS build? Can anyone confirm that Defender doesn't get disabled in favor or say... McAfee or Symantec?

mey• 11 years ago

Per OEM appeasement, if there is a 3rd party AV software installed, Windows Defender auto-disables. So many Lenovo users will have an issue.

ArsTechnica covered this issue in their reporting today http://arstechnica.com/security/2015/02/windows-defender-now...

Sami_Lehtinen• 11 years ago

Doesn't seem to remove SuperfishIEAddon.dll file nor related registry keys.

sp332• 11 years ago

At least "Lenovo US" is owning up to it. https://twitter.com/lenovoUS/status/568578319681257472 Not sure how they're connected to the "Lenovo" that issued that statement.

notsony• 11 years ago

Seems to be a lot of self-righteous moral crusaders on Twitter, and some on HN too, who won't be satisfied until they see Lenovo employees hanging from lamp posts...

ademarre• 11 years ago

That's good. It seems too few consumers get a clean Windows experience, and this fiasco has quickly become the chief example. You'd think MS would want to address that, perhaps by hardening their OEM licensing.

istvan__• 11 years ago

This is the right action from their side, most of the users are not security specialists, somebody should watch out for them.

dredmorbius6• 11 years ago

As well Microsoft should be.

Its brand is as tarnished (if not more so) by this sort of crap.

Not that Microsoft's own hands are clean or that the issue of crapware preloads isn't a massive problem.

Google should also be paying attention: Android preloads are also increasingly a massive turn-off.

fown92• 11 years ago

"Beijing-based computer maker Lenovo has reportedly been blacklisted for years by spy agencies worldwide, as concerns about government-sanctioned Chinese hacking persist. According to the Australian Financial Review, Australia, the UK, Canada, New Zealand, and the US have all rejected Lenovo machines for their top-secret networks since the mid-2000s, though the computers can be used for lower-security tasks that don't involve sensitive information" [1]

Why buy a laptop from a company that has ties to the Chinese government [2], an authoritarian government that supports dictators in Africa and totalitarian government in Russia, oppressing women and children in those countries?

[1] http://www.theverge.com/2013/7/30/4570780/lenovo-reportedly-... [2] http://en.wikipedia.org/wiki/Lenovo

mapleoin• 11 years ago

I guess because they make good hardware.

nailer2• 11 years ago

Also (presuming grandparent is American, which may be incorrect) the US supports dictators and totalitarian governments that oppress women in Saudi Arabia.

jamieb• 11 years ago

Why buy a computer from a company that has ties to the US government, an authoritarian government that supports dictators in Africa, the Middle-East, South America, and East Asia, including torture, drug smuggling, misogyny, and has itself engaged in abduction, detention without trial, and in relation to this case, illegal interception of communications?

fown92• 11 years ago

1.) Which US computer company has ties to US government? Literally owned by the government?

2.) How is US government authoritarian? Have you actually lived in a country that has no elected representative?

rdtsc8• 11 years ago

Well because they were making darn good hardware. I had my T60 for many many years. Carbon X1 seems nice.

Now I ended up buying a cheap ASUS Chromebook for traveling, replaced drive with a large one and installed Ubuntu. But still haven't decided if I want to replace my main machine.

Was eyeing Carbon X1 models for a while, but now will have to rethink.

Besides, like some people here, I always wipe everyone out and reinstall my own distro on it (Ubuntu usually).

Tortuga001• 11 years ago

The T60 was one of the very first laptops Lenovo released after it purchased the IBM PC division. I wonder if it had already been in development under IBM before the purchase.

tveita• 11 years ago

Superfish is a US company, though, and Komodia is Israel based.

There is nothing connecting this to the Chinese government. This appears to be a a cross-border display of greed and incompetence.

eli3• 11 years ago

This seems offtopic unless you think the recent security lapse was some type of conspiracy instead of just apathy, greed, and incompetence.

foz• 11 years ago

I'd be curious to know what brands or models are considered safe by these agencies.

intheknow• 11 years ago

itl12• 11 years ago

I think it mentions in the article about agencies having Dell and HP on the list of allowed companies.

SideburnsOfDoom3• 11 years ago

While we're at it, Lenovo's statement that we might enjoy the adware: "The relationship with Superfish is not financially significant; our goal was to enhance the experience for users" is self-evidently bullshit.

eli3• 11 years ago

The key word is significant. They're not claiming they didn't preload this software for money, they're just saying it wasn't for very much money. Such a small amount of money that they have no problem ending the relationship now that it's causing them problems.

My wild guess would be they got in the ballpark of $0.25 an install.

SideburnsOfDoom3• 11 years ago

For me the key word is "enhance". Why would Lenovo go to the trouble of bundling this, knowing full well that it doesn't actually enhance anything for end users?

Hint: It starts with $ and ends with $.

CWuestefeld• 11 years ago

A different way to frame the comment might be something like: "we were willing to sell out your privacy and security for a mere pittance, 'cause we're cheap whores".

ufmace2• 11 years ago

Which kinda sounds even worse. It says essentially that they're willing to break critical security components on their entire product line for pennies per device.

Hey Lenovo, can you install this root cert I made on your entire product line for me? I'll give you like $20 for it. It's at least better than Superfish - I promise not to include the private key with a trivially-crackable password in the install, so only I can intercept all secure communications by any of your customers, instead of anybody in the world.

pavel_lishin• 11 years ago

I'm not even that miffed about being a product and not the customer; I am incredibly miffed that I'm apparently one of the products in the discount bin.

luddypants• 11 years ago

I wonder if this is actually true at all? I mean, yes, everyone around here absolutely abhors software like this, but there is a class of people who love hunting for bargains and accumulating coupons etc. Is there someone who buys a laptop like this and enjoys the additional advertisements? I always wondered the same about those annoying toolbars, I imagine some people actually perceive these as useful.

argos• 11 years ago

They changed their statement. Now there is no mention of the issue not being "security concern" (http://news.lenovo.com/article_display.cfm?article_id=1929)

somerandomone• 11 years ago

That's one example of management being utterly technologically incompetent, which unfortunately is the case in a lot of Chinese companies.

Phlarp• 11 years ago

Thankfully American companies _never_ have technologically incompetent managers...

r00fus• 11 years ago

s/Chinese//

It's not we haven't thought about replacing management with shell scripts...

PhasmaFelis2• 11 years ago

Superfish is an American company. Lenovo may have been dumb enough to be suckered by it, but they weren't dumb enough to create it.

albertzeyer• 11 years ago

Note that Lenovo has now removed the statement from their article:

“We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns.”

nissehulth• 11 years ago

Looks like they also removed a number of posts in the forum where the discussion started, including a post where a moderator wrote that customers asked Lenovo for this kind of service. The same moderator also pointed out that it was against the community rules to argue with moderators...

jhou22• 11 years ago

Kudos to MS, srsly. lol the amount of positive press that MS has been garnering recently on HN is impressive.

devy3• 11 years ago

I found this whole Lenovo Adware-gate very hypocritical. Why everyone blames the messenger Lenovo but not the source Superfish? Why? Is it because Lenovo is a Chinese company whereas Superfish is a Iserali-American company based in Silicon Valley?

Before this adware-gate, EVERY PC manufacturer bundles adware, HP, Dell, Acer, Lenovo, Asus to name a few top players(Apple perhaps is the only exception as I don't count them as a PC manufacturer). Did anyone bother to look if there were tons of similar security risks with those?

JohnTHaller• 11 years ago

Because there are all sorts of insecure malware/adware out there. They're all various levels of evil and a known quantity of badness.

Lenovo is a company that you paid your money to to buy a laptop. It shouldn't come pre-infected with something that compromises your security and privacy.

rdtsc8• 11 years ago

Lenovo had a chance to redeem itself by apologizing, removing the software and quickly distancing itself from the company.

They screwed up by denying there was problem in the first place. Which means they were defending both their decision to install Superfish as well as, by proxy, Superfish itself.

Thus they are seen to be either incompetent (can't trust them) or malicious (also can't trust them).

Also consumers never bought Superfish. They paid for a relatively expensive piece of hardware from Lenovo and got screwed. They are right to blame Lenovo for it.

devy3• 11 years ago

They did. https://twitter.com/lenovoUS/status/568578319681257472

engendered• 11 years ago

Why everyone blames the messenger Lenovo but not the source Superfish?

Because Lenova is the one who took your hundreds to thousand+ dollars and in return compromised your experience (for what has to be pennies). And in this case it caused a serious security compromise?

"EVERY PC manufacturer bundles adware"

Crapware/bloatware and adware are very different things. Dell installs some bloatware crap that I can uninstall (and even that is, truly, unacceptable. Again, they can't make more than a dollar or two on that junk, yet they compromise the user experience), but they don't MITM my secure communications, or compromise my security.

This has nothing to do with Lenova being a Chinese company. Further, no one expects anything out of Superfish (some slimy adware company), but they do expect standards from Lenova.

devy3• 11 years ago

BTW, it's Lenovo. I wouldn't be surprised if other manufacturers had adware installed but perhaps remedied quickly rather than a PR disaster.

JumpCrisscross• 11 years ago

It tickles me that Superfish is a DFJ-funded [1] start-up based out of Palo Alto. Reporters are focussing on Lenovo's Chinese lineage. Yet this bubbled up out of our backyard, from our own lack of diligence (or scruples).

[1] Edit: Draper Fisher Jurvetson, the $4 billion Menlo Park VC firm that backed Baidu, Hotmail, Tesla, SpaceX and Twitter.

pkaye• 11 years ago

What is DFJ?

jgrowl2• 11 years ago

http://en.wikipedia.org/wiki/Draper_Fisher_Jurvetson

nailer2• 11 years ago

Edit: confirmed

https://www.crunchbase.com/organization/superfish

links to their website, which links to

https://twitter.com/superfishteam

ghshephard3• 11 years ago

Looking over the executive team of Superfish (Which, creepily, refers people to their linkedin profiles - presumably so they can see who is looking at them.) I see that their Chief Product Officer (Cmpt. Science from Stanford, so obviously knew what was going on) is formerly from Zynga. Mark Pincus is (infamously?) known for his comments about how sometimes, when you are small, you have to do all these terrible things that you are really ashamed of, just so you can get big and never have to think about doing them again. In the case of Pincus, he was referring to a the zwinky toolbar that earns money by redirecting web searches to advertisements - oddly close to what just happened with Superfish/Lenovo.

ghshephard3• 11 years ago

How on earth can Lenovo/Superfish state:

"But Superfish tells us it stands by Lenovo’s assessment. “Superfish is completely transparent in what our software does and at no time were consumers vulnerable—we stand by this today.” a company spokeswoman said. “Lenovo will be releasing a statement later today with all of the specifics that clarify that there has been no wrong doing on our end.”

Now that an official CERT announcement has been released:

https://www.us-cert.gov/ncas/alerts/TA15-051A

I think their misleading comments are going to come back and bite them more than they have already.

[EDIT - Looks like they are back peddling a little on: http://news.lenovo.com/article_display.cfm?article_id=1929

" Finally, we are working directly with Superfish and with other industry partners to ensure we address any possible security issues now and in the future. "

" By the end of this month, we will announce a plan to help lead Lenovo and our industry forward with deeper knowledge, more understanding and even greater focus on issues surrounding adware, pre-installs and security. We are eager to be held accountable for our products, your experience and the results of this new effort"

And on: http://support.lenovo.com/us/en/product_security/superfish

"Vulnerabilities have been identified with the software, which include installation of a self-signed root certificate in the local trusted CA store. ... Superfish intercept HTTP(S) traffic using a self-signed root certificate. This is stored in the local certificate store and provides a security concern. "

]

TillE2• 11 years ago

back peddling

Just because I've been seeing this mistake a lot lately: peddling is selling. Pedaling is the thing you do with your feet.

vram22• 11 years ago

Reminds me of story of "the ant letter". I'd describe it, but I'm interested to wait a bit to see if anyone else has heard/read it. Will describe it later if no one replies. I've not found via Google despite a search.

belorn• 11 years ago

Lenovo's response is not astonishingly in the least, its the expected behavior. They made a business decision to include adware in order to raise some extra revenue and then got caught. The default response is to underplay the importance of it, sweeping it under the rug and hope no legal action will happen.

A few months ago there was a HN story about a car manufacturer who had made the decision to use cheaper parts for the ignition. They had the critical internal reports from engineers, and when the deaths started to pile up they did the same thing as lenovo. Act clueless, downplay the issue, make a fix, and silently move on. So long it just customer outrage, it is perfectly fine to do borderline illegal things in order to raise some revenue.

harrystone• 11 years ago

It is not astonishing that a company that would do this would also lie about it. They knew what they were doing.

whytry• 11 years ago

It's kind of hypocritical when USA loads backdoors into hardware that VisualDiscovery relies on.

mchahn• 11 years ago

Last night I fired up a brand new HP stream desktop with windows 8.1 (only $179!). It had a Superfish icon on the desktop. When I get home I'll check for the cert.

So maybe Lenovo isn't the only offender.

Edit: Duh. It was snapfish, not superfish. I've been reading about superfish so much that's what I saw.

halayli6• 11 years ago

Can someone explains to me how Graham claims he can decrypt the intercepted traffic? The proxy communicates securely with the intended website. It's just the browser <-> proxy communication that's vulnerable but that's local on the machine, no ?

shawkinaw• 11 years ago

I'm wondering the same thing. As far as I understand, the proxy is local to the machine, so HTTPS traffic over Wi-Fi should be past the proxy and therefore encrypted using the real certificate.

Animats3• 11 years ago

The installed backdoor certificate is trusted as a root certificate. Its private key is contained in the MITM software, and is now known publicly. So anyone can now create phony certs signed by the backdoor cert, and Lenovo machines accept them as valid.

Here is such a page:

https://badfish.filippo.io/yes.png

That's an image of the word "Yes" signed with the Superfish certificate. If your browser shows that image without warnings about an invalid cert, the backdoor exists.

MichaelGG4• 11 years ago

The proxy accepts fake certificates so you can MiTM anyone. It does not properly verify the remote site's certificate.

tonylemesmer• 11 years ago

komodia.com admits to be undergoing a DDoS attack at 2300hrs UTC (fri 20th Feb 2015)

(komodia is apparently the underlying tech for the superfish thingy)

eire1130• 11 years ago

if anyone knows someone who has purchased an infected lenova with superfish, send me an email. My wife is a class action attorney and is conducting an investigation in the matter. Eire1130 (at) gmail (Dot) com

Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

Related Stories