Slashdot Mirror
Lenovo Allegedly Installing "Superfish" Proxy Adware On New Computers
An anonymous reader writes It looks like Lenovo has been installing adware onto new consumer computers from the company that activates when taken out of the box for the first time. The adware, named Superfish, is reportedly installed on a number of Lenovo's consumer laptops out of the box. The software injects third-party ads on Google searches and websites without the user's permission.
Another anonymous reader points to this Techspot article, noting that that it doesn't mention the SSL aspect, but this Lenovo Forum Post, with screen caps, is indicating it may be a man-in-the-middle attack to hijack an SSL connection too. It's too early to tell if this is a hoax or not, but there are multiple forum posts about the Superfish bug being installed on new systems. Another good reason to have your own fresh install disk, and to just drop the drivers onto a USB stick.
Also at ZDnet.
...to wipe the box and install some other OS.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
Ad's even after you go through the gentoo stage 3 , compile your custom kernel and build your userspace from source ?
Do that with OpenBSD.
From the ZDnet link
The issue has remained latent since Mark Hopkins, a Lenovo social media program manager, confirmed in January that the company was installing the Superfish Visual Discovery software on some of its products in order to serve ads.
I am Slashdot. Are you Slashdot as well?
When I needed a new laptop, I heard good things about Lenovo and they had a good deal so I ordered one. It initially said it would ship in 2 weeks. One week later, that ship date turned into 8 weeks. When I called asking why, I was told "we need some parts" (they wouldn't specify what parts). They also said that it *could* ship earlier but they couldn't guarantee when it would ship. When I tried to cancel, I was told I couldn't but that I could submit a form requesting cancellation which, if approved, might go through before my laptop shipped but might not. In the end, I managed to cancel the order and get all my money back. I ordered from another vendor (Toshiba) and got my laptop in two weeks.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
There are some really harsh laws concerning hacking and cracking. If Lenovo knew or caused this breach perhaps they could be prosecuted and actually jailed for this behavior.
What were Lenovo thinking? People pay bills online you know. Easily can steal lots of information
As much as we bashed RMS here for being a lunatic he has a point with trusting a for profit entity making closed source software.
http://saveie6.com/
My current Lenovo (bit long in the tooth) will be the last one. And no -- wiping clean to install Linux/*BSD/whatever doesn't cut it -- DO YOU HEAR ME, Lenovo?
I just don't want to be treated like this in the first place. Lenovo's now in my no-buy list, right up there with Sony and Microsoft.
Time to look up some System76, ZaReason, whatever (heck, even purism). I'm willing to pay premium to be treated as a customer and not as a stupid gullet.
DO YOU HEAR ME, Lenovo?
See http://blog.erratasec.com/2015...
Now all these boxes can be owned by anyone with the key!
I'll just buy from elsewhere if I need a Windows machine. I have a one strike and you are out policy on this kind of nonsense. I used to buy their machines back when IBM was still making them but they seem to have lost their way.
I just checked on my Lenovo Yoga 2 Pro I bought a few months ago, and it does not have Superfish as a trusted root certificate authority, as indicated in the screenshot in TFA.
Better known as 318230.
It is odd that PC manufacturers are willing to ruin their brands just to earn a few extra bucks.
I have never owned a mac before, but after my last encounter with a high-end Vaio I’m seriously considering a macbook pro as my next laptop. Don’t get me wrong, it ws a very nice laptop. Good battery, expansions and a carbon chassis.
HP (and Compaq before that) business laptops where ok after a reinstall, but the Vaio was just a pain. Shared libraries needed to be installed in a certain order, or it would freak out and tell you that the battery was critical and just shut down. Also support for Windows 8 was just appalling.
Anyway, it shouldn' t be neccesary to reinstall a brand new laptop. They really take the fun out of unboxing it.
It looks like Microsoft cracked the code with their Surface Pro. Clean install and a continuing brand name. Leneovo (and others) could even do what Amazon does with Kindle. Charge more for a clean version.
That's why you run decrapifier as the very first thing. http://www.pcdecrapifier.com/
Only then do you run your ninite selection. https://ninite.com/
scriptsafe on chrome kept asking about loading best-deals-products.com. I said blacklist, never saw anything. only after searching on the domain name did I find out about superfish and then delete it
"You mean we can pay Lenovo to install crap on all their laptops?"
"Yeah"
"What the... that's just... well.. go for it!"
Lenovo lost a lot of sales at my company because of the bloat & crapware they install.
My last experience with a Lenovo laptop was one of the worst of my career. Never again.
http://forums.lenovo.com/t5/Le...
"Superfish has completely disabled server side interactions (since January) on all Lenovo products so that the product is no longer active. This disables Superfish for all products in market.
Lenovo stopped preloading the software in January.
We will not preload this software in the future."
However, later in the post they state that the root CA will remain intact. The private key has already been extracted and cracked, so this leaves Lenovo users still open to a very easy MITM attack.
I've ran into this recently on a Lenovo tablet, but I don't think it was superfish (honestly I don't remember the name, but it was factory installed. ADWCleaner caught it.) although it looks like they purposely obfuscate the name to confuse people so they can't uninstall it.
And this is Adware No. 2 for them. They had their own homebrewed Adware program called Message Center Plus. It was so bad that MSE Detected it.
IBM knew How to make a Laptop. Lenovo Knows how to exploit a Brand Name. it's a good thing Google sold Motorola to them so they can exploit my phone now.
In Soviet Russia, Trojan exploits YOU!
Richard Stallman is spot on regarding free and open source software (FOSS). He warns us about how proprietary, closed source software can be abused and that our dependency on it is a danger to civil society. In case you didn't see it the first time round: https://www.youtube.com/watch?... Only an idiot would dismiss the concerns he raises.
I have never owned a Lenovo product, and now I certainly never will.
Remember not to buy Lenovo products or services ever again. It does not matter if you would not be affected because you install your operating system yourself. Any company doing things like this should go bankrupt.
"Superfish will be removed from Program Files and Program Data directories, files in user directory will stay intact for the privacy reason. Registry entry and root certificate will remain as well."
Which means we can crack that shit and pwn any computer that even had the software 'removed.'
Oh, and then issuing certificates under the names of other corporations? I do believe that is identity theft, at the bare minimum.
Lenovo should be hit in the courts hard over this.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
This really is enough to end large business relationships. Think about US gov network nodes with stuff on them.
I know these same outfits should be running custom endpoint images but still.
I stopped bothering with Lenovo over a year ago when their machines began to ship without the ability to create a recovery disc. They were the only brand at our store which did this. Good to know they're still awful.
Firefox maintains its own certificate database so this SSL MITM vulnerability won't affect FF users - only IE and Chrome.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
I've bought a dozen Thinkpads over the years. Lenovo has now lost my trust. Goodbye.
They need to stop calling this stuff "adware" or "bloatware". This is just a pre-deployed malicious computer crack intended to illegally gather information on users and their systems. Getting users to buy this system is just a form of social engineering. Nobody would purchase these systems if they understood the consequences of this superfish software. I believe that this should cross the line into the criminal side of things. Someone should go to prison for this.
I like how when company's get caught with their pants down the PR tries to spin things.
LOL "user feedback was not positive" really? You think? Who's going to give positive feedback to adware being included on something they purchased.
"Visual Discovery / Superfish was previously included on some consumer notebook products shipped in a short window between October and December to help customers potentially discover interesting products while shopping. However, user feedback was not positive, and we responded quickly and decisively:"
http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-Instructions-for-VisualDiscovery-Superfish-application/ta-p/2029206
I'm a big ThinkPad fan, but I generally go download a fresh set of drivers and run my own OS install when I buy one.
This just sounds like a PC manufacturer wanting to juice the margin a few dollars by installing some crapware. Most techies just wipe out the crapware, but the crapware vendors pay the manufacturer to put their crapware on the machine image. Unfortunately, it looks like they went one step further and installed crapware that was spyware also.
I'm surprised they thought they could get away with it -- but maybe my line of reasoning was used -- "consumers don't know the difference, pros wipe out the crapware, what's the harm?" Companies need to be prepared for the fact that people are going to disassemble, reverse-engineer and poke and prod every little thing about their products, then release detailed accounts of it all over social media and the tech blogs. It sounds like someone hasn't realized that yet or was willing to take the risk.
Well, I'll just add Lenovo onto my list of companies whose products I will never again purchase. That they could think this was an acceptable thing to do tells me that they cannot ever be trusted.
The correct word is fraud. Fraud has been a criminal offense for a very long time.
If they would start filing criminal charges against executives like this and locking them in prison for 30+ years, that would put a stop to that.
They should have started with Bill Gates and arrested him for perjury.
Then Carly Fiorna for Alexia spyware distributed with HP printer drivers.
Then the Sony music exec who had the root kits placed on the music CDs.
Marriott GM in Nashville for DOSing private networks.
If the just-us department and US Attorneys would do their job instead of going after easy targets like Aaron Swartz, this wouldn't be a problem.
News about some notebook ad middleware that can be disabled at setup (not unlike those toolbar bullshit installations) get front page position.
While NSA malware infiltrating all top hard drive brands in over 30 countries never get to the front page, I watched this news get deleted 3 times from the firehose.
Looks like the NSA/GCHQ psyop team are busy at work after one of the most effective malware got exposed.
NSA malware found hidden in hard drives for nearly 20 years
Russian security software vendor Kaspersky Lab, which this week released a report revealing that thousands of hard drives from 30 nations have been infected by U.S.-government sanctioned malware in existence for nearly 20 years, today said there's no way of knowing if your computer is infected and intelligence agencies are surveilling it.
Once a hard drive or SSD gets infected with this malicious payload, it's impossible to scan its firmware. To put it simply: For most hard drives, there are functions to write into the hardware's firmware area, but there are no functions to read it back. "It means that we are practically blind, and cannot detect hard drives that have been infected by this malware," said Igor Soumenkov, principal security researcher at Kaspersky Lab. The drives in PCs and Macs that were infected by the malware represented more than a dozen major HDD and SSD makers. Kaspersky all but said it was the NSA that created and used the spyware.
Reuters also cited a former NSA employee as having confirmed the latter. Two of the largest drive makers, Western Digital and Seagate, said prior to the report, they had no idea their drives had been targeted. A WD spokesman said the company has not participated in or supported the development or deployment of cyberespionage technology by government entities, adding that "Western Digital has not provided its source code to government agencies." Seagate said its self encrypting drives are supposed to thwart reverse engineering of its firmware. "This is an astonishing technical accomplishment and is testament to the group's abilities," Kaspersky's report stated."
http://www.computerworld.com/article/2885069/theres-no-way-of-knowing-if-the-nsas-spyware-is-on-your-hard-drive.html
But these days I tend to recommend Asus. Certainly they can cost a bit more than an HP/Acer, but they're fairly solid and have a decent warranty. My only real complain is their preference for 1366x768 resolution laptop screens...
Any such software or hardware that has such an effect is considered a military attack and will be subject to a response.
So you could say the fish was caught?
Really guys? This is on the Windows side. The Windows OS is one massive piece of malware. It is like you are crying over a cut when there is a massive gaping shotgun blast through the chest. Once you agree to the Windows terms of service, you are already compromised. They now have you signing in with your microsoft ID account that tracks you anyway. However, once you install GNU/Linux or Open BSD or any freedom respecting software like Trisquel or FreeSlack or Dragora, they cannot do anything to you. Lenovo makes nice laptops.
"SO we bide our time, waiting for a purer kick to bloom and the future is still bleak, uncertain and beautiful" -GSYBE
http://i.imgur.com/kRO8OW5.png
A nice cached screencap of their (conveniently) down website.
See all these people, here? These are the people that need to be dragged into court.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Big laws are for small people.
Don't worry, UEFI secure boot will fix all of this, and make us all safe.
LOL
Wait till you can not install any OS image other than the one that came with your machine. HAHA
From : http://news.lenovo.com/article...
LENOVO STATEMENT ON SUPERFISH
Superfish was previously included on some consumer notebook products shipped in a short window between September and December to help customers potentially discover interesting products while shopping. However, user feedback was not positive, and we responded quickly and decisively:
Superfish has completely disabled server side interactions (since January) on all Lenovo products so that the product is no longer active. This disables Superfish for all products in market.
Lenovo stopped preloading the software in January.
We will not preload this software in the future.
> That cannot be true almost by definition. Running a virtual machine of any description carries overhead which you will not incur running directly on the hardware.
A computer scientists might say that's true. A stopwatch will say the virtual machine is faster - much faster. You can easily see it for yourself by checking how long it takes to reboot while installing Windows updates. You can also explain it "scientifically".
You would agree, I'm sure, that a system with 8GB of RAM and a hard drive with 64MB of drive cache might be much faster than a machine with 8.01GB of RAM and 1MB of drive cache. Agreed?
We've established that a machine with more RAM serving as storage cache might be faster than one with less, even if the one with small storage cache has more RAM overall.
Therefore, a system with 6GB of RAM and 1GB of drive cache might be faster than either of the above 8GB machines. That's essentially what a machine running a VM is. From the perspective of the guest OS, the host hypervisor is firmware - firmware with a GB of cache RAM.
Also the hypervisor or host OS may simply do a better job of using the hardware, it may have better drivers. If the hypervisor has a very fast driver for the storage, while Windows has a slower driver for that storage, it may be faster to let the hypervisor talk to the hardware. Windows uses the virtual storage driver which should be extremely fast because all it does is map, or perhaps copy, RAM.
You can see a very clear of case of a virtualized copy of Windows being much faster than one running on metal by just installing some Windows updates that requires rebooting the OS. On metal, a full reboot may over a minute to complete all of the "on startup" processes. Within a hypervisor, the same processes may complete in under 10 seconds because everything is read from host cache RAM rather than from spinning platters. From a computer science perspective you might say "that's cheating, the virtualized Windows didn't have to actually reboot the hardware". Well no, it didn't. And that made it much, much faster. It's much faster BECAUSE it didn't have to reboot the hardware, but the first three words of that sentence are "it's much faster".
How does interfering with user encryption this way not qualify as a violation of the Computer Fraud and Abuse Act (CFAA) ?
not quite. Another reason not to buy said laptops
Not to mention that a VM won't have crapware installed.
https://forums.lenovo.com/t5/W...
Registry entries are there even on laptops from 2011.
So this has likely been in planning stages for years.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
If Superfish is installed the adware can be searching the hard drive for financial information, credit card, bank accounts, all at risk. I suggest not to purchase any Lenovo equipment. It's not what it used to be anyway. If you have to buy a Lenovo then I suggest you re-image it.
Still doesn't absolve Lenovo of failing to do proper audit/review.
http://marcrogers.org/2015/02/...
And *NOW* Lenovo is trying to CYA more by issuing a 'security advisry' for the software:
http://support.lenovo.com/us/e...
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
http://imgur.com/H8459Z3,87zOr...
Oh how quickly you changed your original statement from January to February.
Good thing we can screencap and HTML-rip your entire site for the proof, Lenovo.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
The best spyware comes from Canonical and unlike Windows you can get it for FREE!
Since this thing tries to infect the Cert Store each browser utilizes, removing the stuff from the Windows Cert Store will not remove the stuff in Thunderbird, FF, or Opera. Those are still infected and vulnerable.
Looks like a full DBAN zero-out format is the only way to go.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
That hasn't said anything about it RUNNING faster. I would imagine a virtual REBOOT is faster.
That is more like the opposite of RUNNING. I have a 4.7MHz system that probably REBOOTS faster than either (OS actually IS in firmware) but it doesn't RUN any faster than my calculator.
Well, it just so happens that when you install a nice, secure OS instead of the spyware that comes with your Lenovo product, you do not have to worry about this issue. It will not inject nasty stuff. Isn't that nice? Try a nice GNU/Linux OS or one of the BSD's. Also, who uses google these days anyway? So much nasty tracking going on! Also, if you insist on using Firefox, distro's iike Trisquel repackage it as "abrowser" and make it run more securely. Turn that frown upside down!
"SO we bide our time, waiting for a purer kick to bloom and the future is still bleak, uncertain and beautiful" -GSYBE
"Well, it just so happens that when you install a nice, secure OS instead of the spyware that comes with your Lenovo product, you do not have to worry about this issue"
Except this stuff can hit FF and Opera and Thunderbird, which don't use the OS's cert store. Which means FireFox on Linux and BSD can get fucked as well.
And since this crapware is utilized as the base for many other programs, many of which have Linux ports, you can be rest-assured that there are quite likely infected Linux machines.
Well, no surprise someone freely espousing OSS nonsense wouldn't have half a fucking clue what they're talking about.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
I used to be a big fan of Lenovo's Thinkpads but the quality (and keyboard) has gone downhill in recent models. Preinstalling malware is the final deal-breaker (The TFS says it was to consumer-grade machines, but doing this is a serious breach of trust).
Does anyone recommend a good enterprise-grade laptop? Something like the T400 but with a Haswell chip?
...to wipe the box and install some other OS.
Would anyone tolerate purchasing an alarm clock with a hidden cam on it?
I think not! This is outright criminal. No no reinstalling an OS should never be a common practice on a new system. Yes people use, need, and do not have the technical ability or need to run a non-Windows OS. Yes this is going to butt hurt many here but give it up.
Windows 7 is stable and works fine for non hacker use. People ... normal people ... do not run an OS. They run applications. This means Windows.
If Linux wont he marketshare wars they would have fake certificates, app stores, in Ubuntu too. This should be illegal ... actually it is illegal and hacking. People pay their bills on their systems these days as a normal practice and this is downright scary. Just because I image Windows 7 and install Unix VMs on my system does not mean the average user should at all.
MS needs to change the EULA to prevent this since Windows 10 will be free for the consumer version of it.
http://saveie6.com/
If Linux wont he marketshare wars they would have fake certificates, app stores, in Ubuntu too
Yes, but fixing it will be simpler. Most Linux distribution installations are easier than windows installations. And getting the installer image is easier as it is most prominent in the distribution website rather than obscure as in the case of Microsoft's windows downloads.
MS needs to change the EULA to prevent this since Windows 10 will be free for the consumer version of it.
What has the end user got to with it? Lenovo is the middle-man, so MS need to change the MMLA (middle man license agreement).
Bingo Dictionary - Pragmatist, n. A myopic idealist.
Booting is one of the most resource-intensive things that most people do with their computers, so it's ONE EXAMPLE in which the speed difference is obvious. While booting, the kernel and init system hit the CPU quite a bit and the disk even more. Make no mistake, by the time you see the Windows logo, the kernel is running, running a sprint.
Other examples of tasks that are faster on a virtualized system depend on your hardware, drivers, and configuration. Try it sometime. Assign about 75% of the RAM to the guest, less if you have more than 12GB of RAM.
Any PC or laptop with a preinstalled OS should only be allowed to be sold if an original OS DVD is included. Means the ones that Microsoft releases for Windows, not the already junked up 'recover' DVDs from the manufacturer. That is the only way to properly wipe the entire system and start from scratch. Or just do not add all these often useless 3rd party apps. I know that the hardware vendors get paid to push this garbage, but is that worth these PR disasters?