Slashdot Mirror
Lenovo Won't Pay a Fine For Preinstalling Superfish Adware (theverge.com)
An anonymous reader shares a report: In 2014, Lenovo began bundling a third-party adware program called "Superfish" into its consumer PCs. Now, nearly three years later, the company is facing the consequences. Today, Lenovo settled a lawsuit by the Federal Trade Commission over the Superfish adware, agreeing to get affirmative consent for any future adware programs, as well as audited security checks of their software for the next 20 years. Installed on Lenovo laptops between September 2014 and January 2015, Superfish was granted root certificate access, allowing it to insert ads into even HTTPS-protected webpages. According to the FTC's indictment, breaking HTTPS presented a clear risk to consumers -- but Lenovo isn't going to have to pay for putting customers at risk. Instead, the settlement requires Lenovo to give clear notice to customers of any data collection or ad-serving programs bundled on their laptops, and get affirmative consent before the software is installed. Lenovo also agreed to conduct an ongoing security review of its bundled software, running regular third-party audits for the next 20 years.
Customers were superfish to think that a ruling could be in their favor.
So they get a slap on the wrist. Especially since they are only agreeing to SOFTWARE audits with no mention of a hardware audit.
With these kind of verdicts, what is going to deter other laptop vendors from doing this to their customer...or...is that what the government wants, as they access to all that data upon request.
"Imagination is more important than knowledge" - Einstein
I only overpaid if your privacy has no value!
So long, and thanks for all the fish!
Do not expect your system to be secure - ever.
Industrial espionage, hacking, data mining, whatever .... Lenovo is a state run company.
Remember that.
And with tensions mounting, who knows what the Chinese government will turn on - think of Lenovo computers are the ultimate manchurian candidate.
China will do ANYTHING to protect their North Korean satellite state.
The next time you plan to install a rootkit on PCs and spy on people, first found a corporation. Then it's apparently no longer a crime.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
No it's not ok to break https, Lenovo should have their root CA revoked.
Lenovo should have been dissolved for this, or at least banned from doing business in the United States for at least a century.
Apparently they don't have to worry about consequences for their acts, so there should be no consequences for anyone if their organs are sold off, since it involves people who are above the law.
They literally got less than a slap on the wrist. They'll just put some super small print in with their 500 page long EULA and continue on with business as usual.
if only software / IT people had PE powers and then can tell the CEO hell no find your own PE willing lose there cert over this
They couldn't afford to open the floodgates.
The problem is there aren't that many options and very few companies are trying to fix things. When we are depending on "cloud" services and proprietary software we as users lose control and hand over any control to third parties that don't have our interests in mind.
ThinkPenguin's one of the few who have been working on a solution to these problems. They have EOMA68 that they've been working on and supporting for years- which should be shipping soon (recent updates see crowd funding page). But outside of this there really isn't much happening. We have "half" fixes like LibreBoot on seriously out of date hardware (and it isn't 100%, still CPU micro code, keyboard firmwares, etc) and a means of disabling part of the Intel Management Engine firmware, but it's not everything.
EOMA68 is a modular computing standard that's bringing down the cost to design and manufacture devices that are fully in the users and our communities control (ie a complete set of source code is available).
There is a laptop and desktop housing design being designed around EOMA68, which is a removable card that is the computer. Users can upgrade or swap computers without replacing the rest of the device (ie keyboard/LCD screen/etc) while the community also gains control over all the components going into the designs (ie like the CPU/SoC used don't have to be from Intel/AMD and we can get sources for things like bootloaders, ie uboot). Compare that to being forced to build off a stock AMD/Intel reference design where there are numerous components from Intel Management Engine firmwares to CPU micro codes and BIOSes needed which necessitate the licensing from one of 5 or so proprietary BIOS vendors.
Am I the only one that immediately wipes/reloads a machine when buying it? Hell, I usually give away the drives that come with PCs and put cheap SSDs in them, so I'm always starting fresh... I'll take the hassle of a fresh install for the subsidy that companies pay to preinstall their crap.. Doesn't affect me one bit anyways.
Lenovo will pay $3.5M. Source 1 Source 2
TL;DR There was no fine by the FTC, but they will pay a settlement on another lawsuit.
Both the title and summary here, as well as the TFA are misleading. Come on /. check your facts!
See subject & stalling its ad servers = cake via hosts files. I did this the day it came out 0.0.0.0 www.superfish.com & yes, it works!
* Per http://www.bing.com/search?q=superfish+adserver&qs=n&form=QBLH&sp=-1&pq=undefined&sc=0-18&sk=&cvid=266267AD975248BF812E2604C86A8FD9/
APK
P.S.=>It's THAT easy to nullify this & to create the BEST hosts file vs. malware, rootkits, trackers, scripts, spam/phish, & other threats online (inclusive of DNS tracking/down avoiding dns, lightening DNS load too + locally FASTER resolutions in kernelmode ops + RAM speed of your favorite sites where you spend MOST time online - bonus) for more speed, security, reliablity & anonymity online APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ ... apk
This case is specially bad because it wasn't just once that Lenovo slipped on this... superfish was only the first of 3 times the company was caught red handed with shady tactics:
http://www.makeuseof.com/tag/n...
It's why I don't recommend their stuff anymore nor I'll ever buy anything from Lenovo ever again.
Unfortunatelly, the overall tech press keeps advertising their shit and falling head over heels for it.
This is why you uninstall all of the crapware or better still do a clean install.
What will Lenovo do when the customer says "No"? Delete all data files, perhaps? This FTC deal is less than not a slap on the wrist, it's an instruction to Lenovo to blackmail their customers.
I will never own a Lenovo device and superfish is only a small portion of the real problem: shitty hardware billed as enterprise/business class.
Let's make like a bird... and get the flock outta here.
Intel execs, for implementing Intel Management Engine
AMD execs, for implementing the equivalent
Microsoft execs, for backdoors in the OS that cannot be fully disabled
Firefox developers, for allowing telemetry and having geo and google safe browsing enabled by default
Google for spying on users' texts, mail, web activity on their android phones. Having Chrome call home
MacOS for their level of telemetry
CiscoVPN for call home features that cannot be disabled
Tesla keeping track of every statistic of their vehicles' usages and making that data available whenever their vehicles are brought in for regular maintenances
AdBlockPlus for calling home with usage data
I guess it's technically not a "fine", but Lenovo did agree to pay $3.5 million US as part of the settlement for this case. http://www.reuters.com/article...