Lenovo To Wipe Superfish Off PCs

The lesson here by MAXOMENOS · 2015-02-20 03:59 · Score: 5, Insightful

The feedback from users was that it wasn’t useful, and that’s why we turned it off.

Translation: our laptops are for consumers to buy crap online, and not for any kind of serious work.

Good to know!

Re:The lesson here by Anonymous Coward · 2015-02-20 04:31 · Score: 5, Informative

From a partner email regarding the SuperFish software:
"Please note that Lenovo has NOT loaded this software on any ThinkPad notebooks, nor any desktops, tablets, workstations, servers or smartphones. The only impacted models are the following consumer notebook series: Z-series, Y-Series, U-Series, G-Series, S-Series, Flex-Series, Yoga, Miix and E-Series."
Re:The lesson here by penix1 · 2015-02-20 04:35 · Score: 4, Insightful

Obviously they care about people like me, because they're taking steps to fix the situation rather than ignoring it.
Well, since the crapware came pre-installed, to really show they care they AREN'T providing you with a new system image with it removed. Instead, you are left to remove it yet again if you ever have to reset to factory....Yay Lenovo!

--
This is a sig. This is only a sig. Had this been an actual sig you would have been informed where to tune for more sigs.
Re:The lesson here by mea_culpa · 2015-02-20 04:35 · Score: 4, Interesting

There is a lot of truth to that statement.
It was the cheaper consumer models that were affected. Retail profit margins are so thin that manufacturers and retailers make up for it with preloaded crapware.
Lenovo's business products were not affected by this as these aren't usually preloaded with crap.
The same goes for other manufactures too. Dell and HP both offer cheap crapware infested models, along with pricier crap free business models.
You do get what you pay for.
Re:The lesson here by MightyMartian · 2015-02-20 04:48 · Score: 4, Insightful

They're taking steps to fix the situation, after having been busted putting spyware on them. That doesn't exactly make them sound honorable.

--
The world's burning. Moped Jesus spotted on I50. Details at 11.
Re:The lesson here by geekmux · 2015-02-20 05:02 · Score: 4, Insightful

I have a lenovo laptop, it does serious work just fine. Obviously they care about people like me, because they're taking steps to fix the situation rather than ignoring it.
"Our reputation is everything"
They care about saving face because they were caught which can directly impact sales. It doesn't mean they're going to uninstall the other crapware you're not bitching about right now. When that goes viral, they might remove it then, but make no mistake as to their overall intent of ensuring as many revenue streams as possible.
Re:The lesson here by The-Ixian · 2015-02-20 05:21 · Score: 3, Insightful

It was the cheaper consumer models that were affected. Retail profit margins are so thin that manufacturers and retailers make up for it with preloaded crapware.
This may have been true at one time, but I don't think it is the case any longer. I think that the ubiquity of cheap components and the falling price of Windows for OEMs, the profit margins have been steadily increasing over the years.

I think it is just that OEMs have become dependent on the revenue stream they get from app developers who want their software included in the base image.

--
My eyes reflect the stars and a smile lights up my face.
Re:The lesson here by CastrTroy · 2015-02-20 05:22 · Score: 3, Interesting

If you buy a laptop/computer from the Microsoft Store, I think they all feature Signature Edition, which they state includes the following

Signature Edition PCs are tuned for fast performance from the second you turn them on. They include free anti-virus software that never expires and have no junkware or trialware, ensuring that your new PC is always clean, fast, and protected.

It seems that MS realizes there is a problem with junkware included with their OS. They can't force manufacturers to not install junkware on the computers they sell, but it looks like MS is trying to do something to alleviate the problem. It actually looks like the machines sold on the Microsoft Store are actually quite competitively priced.

--

Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Re:The lesson here by the_B0fh · 2015-02-20 05:28 · Score: 2

So, if a neighbor is caught sleeping with your spouse, and promises to stop, it is now OK?
I'd rather have neighbors and spouses that don't do that.
Re:The lesson here by Pieroxy · 2015-02-20 05:34 · Score: 2, Insightful

Why prevent your spouse to have fun? Share the love !

--
Write boring code, not shiny code!
Re:The lesson here by Pieroxy · 2015-02-20 05:37 · Score: 2

My wife's MacBook Air came with no crapware preinstalled. My Ubuntu Dell XPS 13 neither.
I have no idea what you're talking about.

--
Write boring code, not shiny code!
Re:The lesson here by Jawnn · 2015-02-20 05:42 · Score: 4, Insightful

There is a lot of truth to that statement. It was the cheaper consumer models that were affected. Retail profit margins are so thin that manufacturers and retailers make up for it with preloaded crapware.
Lenovo's business products were not affected by this as these aren't usually preloaded with crap.
So you say, and I am inclined to believe it is so. Nevertheless, Lenovo has demonstrated, in clear and undeniable terms, that profit outweighs the needs of their customers, including the need to have a secure and trustworthy computing platform. The have violated that trust.
"And for that reason, I'm out."
Re:The lesson here by Jawnn · 2015-02-20 05:44 · Score: 4, Insightful

They're taking steps to fix the situation, after having been busted putting spyware on them. That doesn't exactly make them sound honorable.
Worse than just spyware, far worse. They installed a trivially easy-to-exploit vulnerability which affects the security of every web app their customers might ever use.
Re:The lesson here by quetwo · 2015-02-20 05:44 · Score: 4, Insightful

Except on most of those Signature Edition PCs, they still include a trial of Office 365 :) The HP's on the site have pre-loaded software that help you buy ink. So, it's halfway true...
It's just other people's trialware or junkware they don't include.
Re:The lesson here by cdrudge · 2015-02-20 05:56 · Score: 3, Insightful

I think it is just that OEMs have become dependent on the revenue stream...
They aren't dependent on it, they just don't want to leave a revenue stream untapped.
Re:The lesson here by Penguinisto · 2015-02-20 06:10 · Score: 2

Not to troll, but you're right. The hardware costs a lot, but they're built like tanks for the most part. Yeah, it's OSX... whatever. Put what you want on it (but that takes the discussion off the topic...)
Anyrate, the biggest bennie is the complete and utter lack of shitware - no "trial" apps you cannot remove, no adware, no bullshit. I didn't have to blow away the HDD and install a fresh OS when I got it, and as a result, there was no scrambling or sorting through the driver mess (especially those "drivers" the OEM supply which slather on even more bloat and bullshit; quite honestly, one does not want or need these things, and they often destroy performance entirely.)
To be fair, nearly every OEM will provide a laptop with no shitware on it - if you're willing to buy something off the business model line and pay the difference, or if you order the damn things in bulk. Other sellers will do so if you're willing to pay a premium, because they're too often too small to give you the dirt-cheap pricing. Either way, the prices for doing this often put you in Apple territory anyway, so I figured fuggit - may as well take the plunge, buy something that will hold up to abuse, and run like a champ for the most part.

--
Quo usque tandem abutere, Nimbus, patientia nostra?
Re:The lesson here by TsuruchiBrian · 2015-02-20 06:12 · Score: 2

Or at least neighbors and spouses that offer the option to pay them a little extra money (e.g. $10) to have them not sleep with each other. That seems like a good deal for everyone involved.
Re:The lesson here by JohnFen · 2015-02-20 06:25 · Score: 2

If I were to use Apple products, I'd have to either use OSX, which I loathe, or replace the OS, which means that there is no point, since I can replace the OS on x86 machines too.
As bad as all that shovelware is -- and it is bad -- This Superfish thing is far worse. It is active spyware that opens your machine up to be easily hacked by anybody.
Re:The lesson here by TsuruchiBrian · 2015-02-20 06:27 · Score: 4, Insightful

Every company's primary goal is maximizing profit. The only difference is between strategy. Some companies try to maximize profits by cutting their own costs by being efficient and making a superior product that customers actually want. Some companies try to maximize profits by bribing politicians to pass laws hindering their competitors. Some companies try to maximize profits by tricking people (e.g. tricking them into buying products that are not as good as advertized).
If the trust that you had violated was your trust that a corporation valued profit over you, then it's time to stop being a consumer and to start farming in your back yard.
Asking a corporation to value it's customers more than profit is like asking you to value a corporation more than your children. Neither party should be under the false pretense of the other having unconditional loyalty. This is a mutually beneficial business arrangement that is ended the second either side realizes it is no longer beneficial to them.
What I am getting at is that the problem is not that they placed profit above you. Every corporation (even the good ones) do that. The problem is that they tricked you. "Good" companies don't trick people, not because the don't value profit above all else, but because unlike Lenovo, they actually do care about their reputation (as a means to profit).
Re:The lesson here by Anonymous Coward · 2015-02-20 06:40 · Score: 2, Informative

Just download the ISO from MS and use the key that comes with the laptop to install. Problem solved. I wound up doing that with my last Thinkpad and apart from having to install some special apps to make use of the special buttons it worked out just fine.
But, the real answer here is to not buy consumer computers and expect them to be good. The markup on those is probably about $20 over the actual cost of the hardware and the service and support reflects that.
Re:The lesson here by Hadlock · 2015-02-20 06:47 · Score: 3, Insightful

Most computers these days don't come with a restore disc, let alone a disc drive.

Nowadays they have a compressed restore image on the drive that occupies between four and twenty GB as a restore option, which likely comes with the crapware ready to spring in to action(!).

--
moox. for a new generation.
Re:The lesson here by simplypeachy · 2015-02-20 07:16 · Score: 3, Funny

"Please keep buying ThinkPads! Please!"
Re:The lesson here by spitzak · 2015-02-20 08:20 · Score: 3, Informative

Nobody does that any more.
In addition the ability of a consumer to install from that disc is about equal to their ability to install Linux. It is not going to happen.
Re:The lesson here by Solandri · 2015-02-20 09:07 · Score: 3, Informative

This may have been true at one time, but I don't think it is the case any longer. I think that the ubiquity of cheap components and the falling price of Windows for OEMs, the profit margins have been steadily increasing over the years.
You haven't been buying laptops for very long, have you? I've bought:

A Thinkpad 700 (monochrome, not color) in 1994 for about $2100.
A Thinkpad 701c in 1996 for about $2800 (original retail in 1995 was about $3800)
A Thinkpad 560E in 1999 (2 years after release) on sale for about $2600 (nearly $4000 in 1997)
A Toshiba Portege 3440CT in 2001 on a killer sale for $1750 (was $2500 when new)
A Thinkpad T40 in 2004 for $1800
A Sony S360 in 2006 for $600 in a killer sale (original retail approx 2x).
A Sony Z122 - their top of the line model - in 2010 for $800 in a killer sale (original retail approx 2x).

The ubiquity of cheap components has been translating into much cheaper laptops over time. If you look at the profit margins of these companies, they've been pretty stable at 5%-10%. Apple is the only one who's figured out a way to sell cheap components at a huge markup.
Re:The lesson here by LessThanObvious · 2015-02-20 12:27 · Score: 2

Did someone say spyware? I heard revenue stream. I'm just glad companies are working so hard to enhance my shopping experience. Adware that purposefully circumvents data encryption shouldn't be seen as a criminal violation of the CFAA, clearly they are just enhancing it.

Seems like they should send out DVDs by drinkypoo · 2015-02-20 04:00 · Score: 4, Insightful

It seems like they ought to be offering to send out fresh system restore images to customers, either via download or by DVD-for-a-small-shipping-fee. A tool which promises to remove the offending infection seems inadequate.

--
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"

Re:Sony Comcast Level Reputation by BenFenner · 2015-02-20 04:05 · Score: 2

Don't forget Acer.
Hardware keylog me once, shame on me...

Accountability by Anonymous Coward · 2015-02-20 04:06 · Score: 5, Interesting

Someone needs to be fired for this. Someone very high up the corporate ladder. Someone who thinks SuperFish improves the shopping ecperience. Someone who needs to be blackballed from the industry and die penniless huddled in a cardboard box drinking sterno.

If that doesn't happen, SuperFish and problems like it will continue to happen.

Re:Accountability by CaptainDork · 2015-02-20 04:23 · Score: 2

No, because New Coke.

The American public's reaction to the change was negative and the new cola was a major marketing failure. The subsequent reintroduction of Coke's original formula, re-branded as "Coca-Cola Classic", resulted in a significant gain in sales.

--
It little behooves the best of us to comment on the rest of us.
Re:Accountability by MickyTheIdiot · 2015-02-20 05:03 · Score: 2

upwards.

Re:Sony Comcast Level Reputation by Aristos+Mazer · 2015-02-20 04:08 · Score: 5, Insightful

Be fair. Sony and Comcast have both blamed their customers and dallied around in court for quite a while before doing anything, or avoided doing anything in some cases. Lenovo reacted within a day. Lenovo may have taken a fall, but there are circles to Hell, and they aren't in the same class as Sony and Comcast.

Re:Sony Comcast Level Reputation by BenFenner · 2015-02-20 04:08 · Score: 3, Funny

Dammit, George W. Bush really has screwed my memory of that saying. =(

That's a stretch by jones_supa · 2015-02-20 04:09 · Score: 5, Insightful

The intent of loading this tool was to help enhance our users’ shopping experience.

Shut up. It injects advertising into search engine results, and also has the capability to intercept and hijack SSL/TLS connections to websites, thanks to the installation of a self-signing certificate authority on affected machines. You are not enhancing my shopping experience in any way, but you are doing a great job ruining my computer experience. This is nothing more than classic OEM crapware at its best.

Re:That's a stretch by DarkOx · 2015-02-20 04:37 · Score: 4, Insightful

The first followup question should be; did / do you have Superfish installed on YOUR computer? I would be really interested to hear how much he valued this 'enhanced shopping experience'.
The simple fact is they willfully shipped spyware. Beyond that they willfully shipped spyware with the potential to compromise one of the most fundamental security mechanisms Internet users rely on, SSL/TSL by inserting itself into the authentication chain. Beyond that the Superfish spyware did compromise SSL/TLS because the private key it uses to generate proxy certificates was poorly protected.
So on the first count we might excuse them, everybody does it although its still slimy. On the second count they should have know they were crossing a line and entering deep scumbag territory. On the third count well, again I guess everybody does it.

--
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Re:That's a stretch by aaron4801 · 2015-02-20 05:31 · Score: 2

"The intent of loading this tool was to help enhance our users’ shopping experience."
Also dollars. The intent was dollars.
Re:That's a stretch by by+(1706743) · 2015-02-20 06:56 · Score: 3, Funny

...on affected machines.
People always misuse that word. I think you mean, "infected" ;)

Root Cause by zieroh · 2015-02-20 04:12 · Score: 5, Insightful

The intent of loading this tool was to help enhance our users’ shopping experience.

The belief that the "shopping experience" of their users needed "enhancing" speaks loudly as to exactly how little Lenovo understands.

--
People who say "sheeple" have about as much sophistication as an AOL user, and in fact are probably actually AOL users.

Re:Root Cause by kat_skan · 2015-02-20 04:33 · Score: 5, Informative

The belief that the "shopping experience" of their users needed "enhancing" speaks loudly as to exactly how little Lenovo understands.

They don't believe that. They believe their customers are stupid enough to believe it.
Re:Root Cause by Anonymous Coward · 2015-02-20 05:30 · Score: 2, Insightful

Same reason you have ads on cable TV, the executives of the company are psychopathic greedy fucks with no morals who can't ever get enough profits from you.

Chinese Company With Spying by Desidivo · 2015-02-20 04:15 · Score: 3, Informative

Hmm..... Who would have thought a Chinese company would install software that is capable of spying on laptops? Wonder how the world's secrets keep getting stolen? If you buy a Lenovo and expect anything different, you deserve what you get. This is not the first time, nor will it be the last time. They just got caught this time.

CTO admits Lenovo does not know its customers... by QuietLagoon · 2015-02-20 04:15 · Score: 2

...When asked whether his company vets the software they pre-install on their machines, he said, "Yes, we do. Obviously in this case we didn't do enough. The intent of loading this tool was to help enhance our users’ shopping experience. The feedback from users was that it wasn’t useful...

It is a rare occasion when a C-level exec admits that his company has not got a clue about what its customers want.

.
Since the marketing team are usually the ones responsible for knowing customer needs, will we be seeing a change in Lenovo's executive suite soon, say a new chief marketing officer?

Trust has been broken by OzPeter · 2015-02-20 04:17 · Score: 4, Insightful

we will provide a tool that removes all traces of the app from people’s laptops;

So how I do trust that:

1. This tool will do as it says
2. You won't repeat the process in the future?

The trust with Lenovo has been broken and I can't see what they can ever do in order to restore it.

--
I am Slashdot. Are you Slashdot as well?

Re:Trust has been broken by Khyber · 2015-02-20 04:54 · Score: 2

Their removal tool is garbage and does nothing to fix any damage done to the cert stores of browsers like FireFox and Opera, and will not fix your Thunderbird cert store either, if any of those were infected.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Re:Trust has been broken by Jason+Levine · 2015-02-20 04:59 · Score: 2

They only admitted the problem and provided a removal tool after they were caught. As a parent, I've tried to teach my boys that it is better to admit your mistakes outright and correct them than to wait until you are caught and then try to apologize. The former is more likely to be accepted and forgiven. The latter just shows you are sorry you were caught, not you are sorry you did the misdeed in the first place.
Lenovo isn't sorry for putting Superfish on PCs. They're sorry they were caught.

--
My sci-fi novel, Ghost Thief, is now available from Amazon.com.

Useless by Khyber · 2015-02-20 04:19 · Score: 5, Informative

I will guarantee you that this particular 'update' will only take care of the core OS infection. If you have FF, Opera, or Thunderbird, do not expect this to work. You're stuck fixing those programs and their cert stores on your own.

I wouldn't trust Lenovo, anyways. They can't keep a story straight.

First they say 'Between October and December' and then just a few lines later contradict themselves by saying they stopped in January.

Then they further contradict their words by releasing a security advisory stating they stopped in February.

We know this software has been on Lenovo laptops since June, at the least. So the Oct-Dec statement is a lie. Three straight lies in a row.

Simply put, you cannot trust this company any longer. Their 'fix' is a lie, their statements are lies, and they're trying to save face to avoid the Federal hand of pain bearing down upon them.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.

Don't forget samsung by goombah99 · 2015-02-20 04:25 · Score: 5, Informative

http://www.pcworld.com/article...

Samsung also got caught this month injecting ads into TV viewing. They only got caught because they screwed up the algorithm and injected ads into people's personal ad-free videos. And then samsung's genius engineers biffed again by sending the TV microphone pickups back to samsung (which is okay--that's what siri, alexa, cortana, and google do) but doing so unencrypted.

Obviously parasitic ad injection is the the single most lucrative way to earn money on the internet. Your doing it just like google does for nearly all its revenue, selling ads and harvesting click-thru data, but your doing it without the associated cost of attracting customers with a product. No wonder Lenovo wanted this action.

--
Some drink at the fountain of knowledge. Others just gargle.

Re:Don't forget samsung by mlts · 2015-02-20 05:00 · Score: 4, Interesting

Ad injection is quite lucrative. This is what entire companies like Phorm which intercepts in-flight connections and inserts ads.
As for ad injection like this, I've seen a number of consumer level PCs route traffic through a local proxy, installing Web browser add-ons to keep the browser switched to the proxy and to inject their own SSL key. The fix was removal, and even then, there were processes that had to be stopped via autoruns, as well as blocked from phoning home via the Windows Firewall (so there wasn't a chance they could do damage even if restarted.)
The exception to this seems to be HP, which might have sample programs on it (Norton, for example), but no crapware that loads in Web browser add-ons. It actually was a shock seeing a new HP consumer laptop actually in a usable state out of the box, without having to go swinging at what starts up with the autoruns pickaxe.
The problem is that companies face zero negative consequences for adding intrusive software like this onto a machine. Joe Sixpack won't know or care that his search engine gets redirected through some no-name third party site so his google search page has flash ads. With the private key out, he won't realize that his banking stuff is compromised until his bank account gets drained.
The fix? As a consumer, either bring your own OS and completely wipe and reinstall the box, or buy a business-line version. Lenovo would not dare to try installing anything like this on the Thinkpad line, just like Dell's Latitude line, and HP's EliteBook line. Of course, there is always Apple, which seems expensive, but if one compares like for like, a MacBook Pro actually has a price advantage to a comparable business line HP or Dell with the same features and chipset.

Re:Banned from our approved vendors list by rjhubs · 2015-02-20 04:26 · Score: 3, Insightful

Any competent company should have their own OS image put onto new laptops. This should not affect the corporate world.

On the bright side by MAXOMENOS · 2015-02-20 04:27 · Score: 4, Funny

Maybe I can get a Lenovo laptop at deep discount and put Mint/KDE on it.

--
Finding God in a Dog

Reputation by JohnFen · 2015-02-20 04:34 · Score: 4, Informative

Our reputation is everything and our products are ultimately how we have our reputation.

Well, they'll miss it then! Their reputation is now that they are a sleazebag company willing to compromise their customers security so they can make a few bucks injecting unwanted advertising, then lying about the security risk when they got caught.

That's a company I will never do business with again.

a round of testing perhaps? by magarity · 2015-02-20 04:34 · Score: 2

As soon as the programmer is finished...

Oh boy, another case of testing in production.

"the programmer" by Rob+Bos · 2015-02-20 04:41 · Score: 2

So, they only have one at Lenovo? Explains a few things.

Re:"the programmer" by kmahan · 2015-02-20 05:11 · Score: 2

Hope "the tester" hasn't been let go.

--
Invalid Checksum. Retrying.

Here is the letter Lenovo sent out to everyone by gurps_npc · 2015-02-20 04:43 · Score: 3, Informative

February 20, 2015 Dear Andrew, As you may have heard, select Lenovo consumer notebooks shipped after September 2014 included Superfish Visual Discovery software as a shopping aid to customers. Superfish is a TrustE certified third-party software vendor, with offices in Palo Alto, CA. User feedback on the software was not positive and we received some reports of security concerns. Please note that Lenovo has NOT loaded this software on any ThinkPad notebooks, nor any desktops, tablets, workstations, servers or smartphones. The only impacted models are the following consumer notebook series: Z-series, Y-Series, U-Series, G-Series, S-Series, Flex-Series, Yoga, Miix and E-Series. If you use any of these Lenovo consumer models in your enterprise, please refer to the Customer Support information below. While this software does not impact the models typically used by businesses, we wanted to let you know that we take user feedback seriously at Lenovo. We know that millions of people rely on our devices every day, and it is our responsibility to deliver quality, reliability, innovation and security to each and every customer. We make every effort to provide a great user experience for our customers. We recognize that the Superfish software has caused concern. Lenovo has taken steps to address that concern. â Superfish has completely disabled server side interactions (since January) on all Lenovo products so that the software is no longer active. â Lenovo has stopped preloading the software and will not preload this software again in the future. â Lenovo has provided instructions for uninstalling this software and will soon provide a software removal patch. For more information on this, or for instructions on Superfish software removal, please visit http://support.lenovo.com/us/e.... We appreciate your confidence in Lenovo. Unsubscribe | Privacy Policy Lenovo reserves the right to alter product offerings or specifications at any time without notice. Models pictured are for illustrative purposes only. Lenovo is not responsible for typographic or photographic errors. Information advertised has no contractual effect. You are subscribed as andrew.coleman@dpw.com. To ensure delivery of Lenovo email offers to your inbox, please add lenovo@update.lenovo.com to your address book. Lenovo and the Lenovo logo are trademarks of Lenovo. All other trademarks are the property of their respective owners. Lenovo 1009 Think Place Morrisville, NC 27560 Â© 2015 Lenovo. All rights reserved.

--
excitingthingstodo.blogspot.com

They got caught this time... by JimMcc · 2015-02-20 04:44 · Score: 3, Insightful

But what about next time?

What about other vendors?

The quest to further "monetize" customers that have already paid for a product is one that more and more companies are doing. I understand the business reasons behind it, but what about the consumer's rights? Do we have any let? Superfish is an especially egregious example if this problem. It is, in essence, a back door installed into millions of consumer devices. The penalties on a company should be so severe that they couldn't just make it disappear in one quarter, but not so severe that it forces the company in bankruptcy. In other words it needs to be painful enough that other companies will think long and hard about possibly doing something similar, but stopping short of putting the head of the villain on a stick outside the castle walls.

Sadly, I think the extent of the punishment will be a little bad press for a few days, then they'll continue on as if nothing had happened.

Re:Only a partial removal? by DarkOx · 2015-02-20 04:44 · Score: 4, Insightful

Well Mozilla products are defective in this area IMHO. They should system certificate stores by default rather than their own. On Windows they should the windows store, on OSX they should keychain and on linux/bsd they should use /etc/ssl

Shipping their own is confusing for end users and forces them to manage multiple trust locations. I can totally see some people wanting to use a different keystore for their web browser than other software uses and having an option would be nice, but it should NOT be the default let alone the only offered behavior. I write this as a long time Seamonkey user, but this would be my biggest complaint.

--
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html

Brand damage by jdgoulden · 2015-02-20 04:46 · Score: 2

Sure, they reacted quickly but it should never have happened in the first place. The damage to the Lenovo brand is permanent. There are plenty of folks who won't by a Sony product of any kind, for similar reasons.

Re:Only a partial removal? by Khyber · 2015-02-20 04:51 · Score: 3, Insightful

"Well Mozilla products are defective in this area IMHO. They should system certificate stores by default rather than their own."

Nope. Having your own cert store protects you if the primary OS cert store gets fucked.

My god it is like the lessons of granular security have just been totally forgotten, these days.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.

Re:Sony Comcast Level Reputation by JohnFen · 2015-02-20 04:51 · Score: 2

I might agree with you if their initial response hadn't been lying (they claimed that they thoroughly tested and there was no security risk) and designed to avoid taking real responsibility (we did this for you!)

Re:Banned from our approved vendors list by JohnFen · 2015-02-20 04:54 · Score: 4, Insightful

It doesn't matter. That they were willing to do this on low-cost consumer machines indicates a lack of judgement that reflects on all aspects of their company.

Re:The lesson here = Wipe & Reinstall by BoRegardless · 2015-02-20 04:54 · Score: 2

No other rational choice.

Dear Peter Hortensius by stasike · 2015-02-20 04:58 · Score: 2

Dear Lenovo CEO Peter Hortensius.

My shopping experience needs NO enhancements, and especially NO enhancements in form of additional injected ads. I haven't even started talking about you installing appaling security holes and other crapware on MY new computer.

Your apology has made the situation even worse. I would have appreciated if you said something like "margins on PCs are very thin so we have to take any opportunity to offset the price of Windows licence by installing questionable things on our computers".

Not that I would buy Lenovo notebook even without this scandal. You do not let users to make backup media with a "factory restore" image. If a disk dies, or if somebody wants to install an SSD to his notebook later on, he has to seek Lenovo technician to get the image with OS.
The only way to redeem a little bit of respect would be if you started bundling vanilla OS installation media and media with drivers. Like it was done long time ago.

Yours truly
*very* pissed off potential customer.

Re:Banned from our approved vendors list by MickyTheIdiot · 2015-02-20 05:02 · Score: 4, Insightful

Just fine in bigass-corporate-company land, but the world is bigger than that. A huge amount of US economic activity is in small business, and how many of those have competent IT? This will be a possible opening of a lot of companies for a long time.

Re:Lenovo were already falling by damn_registrars · 2015-02-20 05:04 · Score: 3, Informative

they'd already turned the thinkpad line into boring mass-market hunt-and-peck-optimised dvd ogling boxes. In that sense, I'd written them off years ago.

Really? I have used both IBM and Lenovo ThinkPads and while the Lenovo ones aren't quite as great as what IBM made, they are still vastly superior to any consumer laptop on the market today. You might be thinking of the IdeaPad line, which looks like a ThinkPad to a small degree but isn't nearly the same thing. The ThinkPads are still solid - and someone else pointed out they don't have Superfish on the, either.

--
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.

Re:The password for the private key by mlts · 2015-02-20 05:05 · Score: 2

My shopping experience is just fine without active MITM attacks.

The ironic thing is that Lenovo has had a good reputation. They inherited the Thinkpad name, and it used to be that it was the go to brand for laptops before Apple jumped in that market. Plus, business-line Thinkpads are pretty secure, be it a decent TPM implementation, fingerprint scanner, and other items.

I just hope they learn their lesson, and this doesn't pop up again, as their products are quite usable.

Re:Banned from our approved vendors list by mrchaotica · 2015-02-20 05:12 · Score: 4, Insightful

It also wouldn't affect the corporate world because business-grade PCs were never infected with it in the first place.

However, the real issue -- the one that makes competent companies completely justified in shit-listing Lenovo -- is the argument that if a company is capable of exercising such poor judgement now, then who knows what other poor judgement they might show in the future. Maybe the next "oops" will be a hardware keylogger in Thinkpads or a compromised WiFi firmware or something.

Lenovo may have backpedaled this time, but the malware only happened to begin with because somebody at Lenovo thought it was a good idea. That, by itself, poses an unacceptable risk to any sane customer.

--

"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

Re:Only a partial removal? by Khyber · 2015-02-20 05:15 · Score: 2

"I got news for you if your primary OS cert store gets fucked you are fucked."

Given the history of the NSA and Microsoft, you're better off assuming the OS cert store is fucked in the first place, sir.

There's a good reason to have security on every program with its own rules.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.

Where's the damned accountability? by the_B0fh · 2015-02-20 05:27 · Score: 2

No, this is not enough. Where is the fucking accountability? The person who proposed this needs to be named, and fired, and any bonuses paid for this need to be taken back.

You are only sorry you got caught with your hands in the cookie jar.

This type of shitty nonsense have been going on for years, and I'm surprised that both Microsoft *AND* Windows users just tolerate it.

*WHY?*

Re:Only a partial removal? by Khyber · 2015-02-20 05:29 · Score: 3, Insightful

The discussion is far from moot. Security also involves mitigation. By assuming your OS is fucked in the first place, you get programs that should in theory provide more security by using their own stuff instead of the OS, thus mitigating (or outright eliminating in some cases) the specific threat to the point of rendering it useless. Thus, even if the OS isn't actually compromised, you've still greatly managed to increase your security over the baseline.

--
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.

readamading compreheminsionation failuration /gwb by Thud457 · 2015-02-20 05:34 · Score: 2

Isn't that the case with pretty much every consumer-level laptop on the market today?

The HP business laptops do not ship with crapware.

Wherethehell is IKANREAD when we need him?!

--

the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff

To Google, Lenovo, et al by rogoshen1 · 2015-02-20 05:42 · Score: 2

I don't want you fucking around with my 'shopping experiences'. Please, please do not sell my eyeballs to advertisers and claim (even with a wink and a nod) that you are somehow doing *ME* a favor.

Re:Got found out ... by Anonymous Coward · 2015-02-20 06:00 · Score: 5, Informative

In other news, Superfish has now been added to the Windows Defender malware database.

Some joke using the word "appwipe"... by ThatsDrDangerToYou · 2015-02-20 06:03 · Score: 2

Sorry, I got nothin. You?

Enhancing users shopping experience by Rudisaurus · 2015-02-20 07:02 · Score: 2

"When asked whether his company vets the software they pre-install on their machines, [Lenovo CTO Peter Hortensius] said, "Yes, we do. Obviously in this case we didn't do enough. The intent of loading this tool was to help enhance our users’ shopping experience. The feedback from users was that it wasn’t useful, and that’s why we turned it off. Our reputation is everything and our products are ultimately how we have our reputation."

Far too little and far, far too late!

If Superfish was merely not "useful", some people would carp about it and most would just ignore it. It is far more dangerous than that because it deliberately behaves in a way that undermines the integrity of the trust system on which internet is based and so jeopardizes the security of the user. To claim that this was done in order to "enhance" the user's experience is cynical beyond belief. I'm certain Hortensius is right when he says that the software was vetted at Lenovo. I'm also quite sure that it performed precisely the way it was intended to. But who on earth thought that was a good idea?

There has to be a price to pay for this major failure of judgement and I can only hope that it is both hefty and that it impacts those at Lenovo who were ultimately responsible for it, Hortensius among them.

--
licet differant, aequabitur

Way to own it, dickhead by Wee · 2015-02-20 07:16 · Score: 2

You fucking suckhole, at least have the balls to own up to your mistakes. You assholes not only put a shitty MITM attack in the OS, you fucking used the same goddam key so that anyone else could MITM us too?! And not a single person with half a clue ever stood up in that design meeting and asked what a monumental fuck-up that was? Right. Trying to make the "user experience" better by inserting your ads into my TLS-based google searches or my secure bank session? It "wasn't useful"?! Just stop. Stop that nonsense and own your mistakes like a real actual person.

I've been buying and recommending Thinkpads since the late 90's. I'm using one now in fact (thankfully re-imaged, no thanks to the twatwaffles at Lenovo). I'm never going to do either of those things again. I might have if they had said, "You got us, our bad, we're sorry and it won't happen again". But not anymore. Not with the wishy-washy corporate-speak bullshit.

Do not fuck with people's stuff for ad revenue. And if you do and get caught, at least fucking own up to it.

And so now I'm wondering what my next laptop will be. Because it sure as shit isn't going to be a Lenovo...

-B

--

Ash and Hickory, straight-grained and true, make excellent bludgeons, dandy for the cudgeling of vegetarians.

Why do they even TRY with this B.S.? by sirwired · 2015-02-20 07:49 · Score: 2

Obviously the "intent" with this tool was not some sort of alutruistic impulse to "improve our customers' shopping experiences"; the "intent" was to collect some tiny payment per PC in exchange for their users giving up some of their piracy.

I'm willing to believe they didn't realize the security implications of this junk, but they might as well admit they play the Crapware game all the consumer PC makers do because it makes them money.

Re:Got found out ... by penguinoid · 2015-02-20 12:52 · Score: 2

Got found out ...

Yup! One of the clues that Lenovo already knew this was bad software because it is designed to hijack people's data to inject ads, breaks security, and can't be uninstalled (hence the company is currently working on an uninstaller).

In unrelated news, a murderer that got caught said that the bullet was intended to enhance circulation, but he received negative feedback from his customers, and is working on instructions on how to remove all traces of the bullet (except, of course, for all the damage it already caused).

--
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways

Slashdot Mirror

Lenovo To Wipe Superfish Off PCs

77 of 266 comments (clear)