Slashdot Mirror
Lenovo Finally Pays $7.3 M Fine Over Invasive 2014 'Superfish' Adware Pre-Installations (softpedia.com)
Leonovo will add $7.3 million into a $1M fund settling a class action lawsuit over their undisclosed pre-installation of Superfish's targeting adware on 28 different laptop models in 2014.
Within one year the U.S. Department of Homeland Security had warned that the adware made laptops vulnerable to SSL spoofing, allowing the reading of encrypted web traffic and the redirecting of traffic from official websites to spoofs, while according to Bloomberg the original software itself also "could access customer Social Security numbers, financial data, and sensitive heath information, the court said."
An anonymous reader quotes Softpedia: According to a "SuperFish Vulnerability" advisory published by Lenovo on their support website following the discovery of the pre-installed software by consumers, the VisualDiscovery comparison search engine software was designed to work in the background, intercepting HTTP(S) traffic with the help of a self-signed root certificate that allowed it to decrypt and monitor all traffic, encrypted or not.... "VisualDiscovery was installed on nearly 800,000 Lenovo laptops sold in the United States between September 1, 2014 and February 28, 2015," also states the settlement agreement. "On January 18, 2015, in response to mounting complaints about the effects of VisualDiscovery, Lenovo instructed Superfish to turn it off at the server level...."
Out of the 800,000 who bought the laptops that came with VisualDiscovery pre-installed, the 500,000 ones who registered their devices with Lenovo or bought them from retailers such as Best Buy and Amazon will be contacted directly by the Chinese company and informed about the settlement agreement. The rest of the customers who cannot be reached straightaway will be targeted by Lenovo using multiple online advertising platforms, from Google to Twitter and Facebook.
A separate settlement with the FTC in 2017 was criticized for its failure to fine Lenovo -- though it did require the company to get affirmative consent for any future adware programs, plus regular third-party audits of its bundled software for the next 20 years.
Within one year the U.S. Department of Homeland Security had warned that the adware made laptops vulnerable to SSL spoofing, allowing the reading of encrypted web traffic and the redirecting of traffic from official websites to spoofs, while according to Bloomberg the original software itself also "could access customer Social Security numbers, financial data, and sensitive heath information, the court said."
An anonymous reader quotes Softpedia: According to a "SuperFish Vulnerability" advisory published by Lenovo on their support website following the discovery of the pre-installed software by consumers, the VisualDiscovery comparison search engine software was designed to work in the background, intercepting HTTP(S) traffic with the help of a self-signed root certificate that allowed it to decrypt and monitor all traffic, encrypted or not.... "VisualDiscovery was installed on nearly 800,000 Lenovo laptops sold in the United States between September 1, 2014 and February 28, 2015," also states the settlement agreement. "On January 18, 2015, in response to mounting complaints about the effects of VisualDiscovery, Lenovo instructed Superfish to turn it off at the server level...."
Out of the 800,000 who bought the laptops that came with VisualDiscovery pre-installed, the 500,000 ones who registered their devices with Lenovo or bought them from retailers such as Best Buy and Amazon will be contacted directly by the Chinese company and informed about the settlement agreement. The rest of the customers who cannot be reached straightaway will be targeted by Lenovo using multiple online advertising platforms, from Google to Twitter and Facebook.
A separate settlement with the FTC in 2017 was criticized for its failure to fine Lenovo -- though it did require the company to get affirmative consent for any future adware programs, plus regular third-party audits of its bundled software for the next 20 years.
I see /. is approaching high art:
"The rest of the customers who cannot be reached straightaway will be targeted by Lenovo using multiple online advertising platforms"
Or are those obsolete in the Trump era?
Forcing to install an adware OS even when people refused. That's bad!
Forcing the installation of unwanted adware apps. That's also bad!
I once heard an older person say "Don't trust a chinaman! They're dishonest!".
No.
It's not that. It's a different culture. If something is "OK", and you adhere to that standard, does that make you immoral? Certainly not!
For example, bribery is typical in China. Everyone, every-freakin-one does it. It's essentially part of one's salary, in some positions.
Well, this is along those lines. In China, this sort of thing is 'just normal', like any other form of 'ripping people off', it's far more caveat emptor than in the West -- which also has that problem! Just not to the same degree.
For example? The legal framework. We've had hundreds of years of common-law decisions, a vast history of increasing consumer protections both via court decisions and via legislation, that screams "DO NOT DO THIS!".
Frankly, two things need to happen:
1) Never buy directly from China
2) The person that imports a product from China? The corporation that does the actual import? Needs to be 100% responsible for issues such as this.
3) Because of what will happen in #2, there probably needs to be foreign ownership restrictions in domestic corps that resell, *or* some form of bond placed to ensure that it is easy to fine.
Because you know what?
Everything from China is like this. And even if it isn't outright evil like this case, it's just plain *CRAP*.
Of course, option #4 is that China adopts a pro-consumer legislative framework very similar to the West... but I don't think that will happen.
7.3 million divided by 800,000 customers doesn't leave much room for attorneys' fees, right?
if the chinese government (it owns part of lenovo, as well as many others.. plus dictates what they and other chinese companies, without government investment, do) was nailed for all the nasties they put in hardware and software.
The fine should be cut in 1/2. I told a few customers one day in Best Buy that Lenovo was installing this trash on systems as well as using the mainboard to store this trash.
They still bought the things. There is a certain point where you can start blaming the so-called "victims" for being stupid.
I no longer feel sorry for anyone that buys lenovo, nintento, Sony, or from any other business that felt that screwing customers over was OKAY and good practice. I wish people understood that boycotts are effective, but since they are too lazy to participate in the economy properly I no longer feel sorry for them when they get screwed by big business.
Why would anyone buy a consumer PC and NOT re-install the OS from scratch?
We've seen time after time that you cannot trust the mfg-installed OS. The only sane approach is to buy the hardware, and install your own OS from scratch after a reformat.
The same is now true of smartphones. Trusting the shitware delivered on the device is idiotic.
Sure, you may have fined Lenovo, but what about the people who had that crap on their machine? What do they get? The middle finger.
"I said people were told that malware was present yet they still purchased them." -You're asserting everyone who bought them was told that. You have yet to prove that. It's obviously not the case.
"when people "knowingly and voluntarily" buys a product they "legally" accepted something called "assumption of risk". -Sure, but there are still laws. They don't go away because of assumed risk generalizations.
"This means they LOST their right "legally" to bitch about being spied on!" = Bullshit, legally. Unless they formally waived those rights in a legal contract, which they didn't, and that contract would have to be upheld.
Anyhow you can say I'm lying but you are advocating above to halve the court fine based on a fallacious sub-legal argument, so yeah.
Are you not man enough to admit when you're wrong, Sir Astral?
So, does Google still use system-provided certificates in Windows versions of Chrome? :P
At some point, this ancient wisdom comes into play:
Arguing on the internet is like the special Olympics. Even if you win ...
He's clearly not listening. Go hug someone or whatever because you're wasting your time here.
https://tech.slashdot.org/comments.pl?sid=12520486&cid=57184660 - Want to tell us why you pushed Nazi propaganda Ray?
Hello Everyone, in return for a great hack service which i received from this professional hack team collinshackworld@gmail.com i promised to refer them to other people, even after being ripped off twice by some of this so called hackers, i currently do not regret giving it a last try!!!! with collinshackworld@gmail.com i received professional job at good cost, swift delivery and also to my specifications, if you ever need a hacker you can trust i would suggest you turn to collinshackworld at gmail..c o m 100% sure of their service.
Usually first thing I do with a laptop, is set it up, then pull and shelf the HDD/SDD until the warranty period ends. I install a blank drive, set it up how I want. Granted, if the bug is embedded in the bios or something, can't really do anything about that, but for the most part, that should clean it out, not to mention getting rid of the bloat.
Surely this devastating blow to their financial security will serve as a deterrent for other companies... right? What's that? Their gross profit over the last 10 years has averaged in the hundreds of millions, and this fine serves no other purpose than to demonstrate that it's a more fiscally-viable option to fuck over your customer and then pay the fine later? Color me shocked...
What's "shocking" is the lengths of time you'll waste in stoic defense of being wrong and completely UNABLE to admit it lol.
Not dealing in (whether commercially or gratis) proprietary software is always wise. $7,300,000/800,000 people is almost $9.13/person. Nobody who can afford a modern Lenovo computer will find $9.13 very rewarding and Lenovo won't find $7.3M a challenge to pay.
But the structure of proprietary software (being hidden from the user who is legally prohibited from inspecting or editing the software and often prohibited from sharing the software as well) keeps users ignorant of the software they run. Since there's a lot of proprietary malware out there and we can't tell which proprietary software is malware, we are wise to avoid it all. Ethically, all proprietary software operates not in the user's interests. Users aren't well served by software running on their computers which don't respect their software freedom. This is increasingly becoming a health/life or death concern (see a recent story about a CPAP machine hacker, for instance) and have always been an a concern for those motivated by how we ought to treat other people (perhaps the most important consideration we can make in life).
Digital Citizen