Lenovo accused of compromising user security by installing adware on new PCs

[Bosonic]

Source: The Guardian

Lenovo, the largest PC manufacturer in world, has been accused of fatally compromising user security by installing an adware application on all its Windows computers as they leave the factory.

The software, called Superfish, purports to offer users a “visual search” experience. In actual fact, it injects third-party advertisements into Google search results and websites, without asking the user.

But in order to place adverts on websites served to the user over an encrypted connection, as Google does by default, Lenovo owners report that Superfish also breaks the security used by every computer to access the internet privately. Even if the user removes the adware from their computer, the artificial security hole stays active. At its worst, it leaves any Lenovo user permanently open to a “man in the middle” attack any time they use a public Wi-Fi network, letting an eavesdropper read users’ web browsing at will.

Users had been complaining about Superfish on Lenovo’s forums since September 2014, but it took until late January for the Chinese firm, which leads the PC market in terms of units sold, to respond. In the fourth quarter of 2014 alone, the company sold 16 m PCs, including the hugely popular ThinkPad range, which it bought from IBM in 2005.

Read more: http://www.theguardian.com/technology/2015/feb/19/lenovo-accused-compromising-user-security-installing-adware-pcs-superfish

---

also: Lenovo shipped lappies with man-in-the-middle ad/mal/bloatware

'Superfish' causes an almighty stink

http://www.theregister.co.uk/2015/02/19/superfish_lenovo_spyware/?mt=1424355730172

[hobbit709]

1. first thing I run on any new computer is Revouninstaller.

And get rid of all the crapware and "trial offers"

and Lenovo ain't the only one that installs that kind of crap.

[madokie]

3. First thing I'd run on a new computer is Ubuntu

on a cleaned, wiped hard drive.

[hobbit709]

4. Trying to talk a Windoze customer into using something they're totally unfamiliar with is useless

While Linux does a lot of things it doesn't do everything a Windows machine does. Not without a lot of extra tweaking at the very least.

[madokie]

6. I know

but I do run AutoCad 2000 on my linux machine though. Since it was written for win 98 I had to run it in compatibility mode in my old xp anyway and Wine does a better job. Much faster running on Ubuntu and Wine.

Never did get it to run on my brothers windows 7 machine and his son is a high dollar (six figure) IT guy and he couldn't do it either. finally put ubuntu on his machine and installed AutoCad 2000 on it. Trouble is brother won't take the time to learn the program so it was all for naught anyway.


I build things that I design myself and learned AutoCad 10 when it first came out because of the 3-d capability. In fact Acad 10 was why I bought my first computer back in '89 I think it was, may have been early '90 just can't remember exactly

[hobbit709]

8. My first computer

5 minutes of flipping the switches on the front panel so that it could read the paper tape reader so that you could talk to it in English.

[madokie]

9. They had something about like that at the foundry where i worked a while

it wasn't being used. We, my brother and I and our help were in the process of updating all the machines to David Bradley process controllers.

My first was when the 80286 process first came out running at a wild 10 mhz complete with 1 meg of ram and a 20 meg hard drive.
I made a batch file that I loaded autocad into the smart drive I created in the extra ram and ran it from there. Pretty good performance doing it that way. I remember my first house plan I drew learning the program while writing my own menu and made the mistake of hiding the lines and in perspective mode and it took hours. I made sure not to do that again on the whole drawing with all layers turned on. LOL

[Renew Deal]

2. This is probably not a problem if the operating system is manually reinstalled

[hobbit709]

5. Hard to do with Windows 8/8.1

No disks, no product key. And if you do a complete restore from the factory partition it puts all the crapware right back on it.

[onehandle]

7. I've never owned a computer device preloaded with adware/spamware/junkware. nt

[CreekDog]

13. that's smart but an average consumer should be able to buy a computer w/o a security flaw like this

without your level of knowledge or your procedures.

[bigworld]

10. I hope this sinks them

This is the kind of crap that should result in a company being blacklisted by everyone. And all for a couple measly bucks.

[mahatmakanejeeves]

11. Didn't Sony do something like this several years ago?

Sony BMG copy protection rootkit scandal

The Sony BMG CD copy protection rootkit scandal of 2005–2007 concerns deceptive, illegal, and potentially harmful copy protection measures implemented by Sony BMG on about 22 million CDs. When inserted into a computer, the CDs installed one of two pieces of software which provided a form of digital rights management (DRM) by modifying the operating system to interfere with CD copying. Neither program could easily be uninstalled, and they created vulnerabilities that were exploited by unrelated malware. Sony claims this was unintentional. One of the programs installed even if the user refused its EULA, and it "phoned home" with reports on the user's private listening habits; the other was not mentioned in the EULA at all, contained code from several pieces of open-source software in an apparent infringement of copyright, and configured the operating system to hide the software's existence, leading to both programs being classified as rootkits.

Sony BMG initially denied that the rootkits were harmful. It then released, for one of the programs, an "uninstaller" that only un-hid the program, installed additional software which could not be easily removed, collected an email address from the user, and introduced further security vulnerabilities.

Following public outcry, government investigations, and class-action lawsuits in 2005 and 2006, Sony BMG partially addressed the scandal with consumer settlements, a recall of about 10% of the affected CDs, and the suspension of CD copy protection efforts in early 2007.

Okay, it's not the same. What do I know?

[bemildred]

12. It's not a bug, it's a feature. nt

[olddots]

14. sell the sizzle not the stake

N.T.

[candelista]

15. Do you have Superfish? Check here.

https://filippo.io/Badfish/