The IT Nerd

Lenovo finally seems to have gotten a clue. In an interview with re/code, the CTO of Lenovo Peter Hortensius admitted that the adware that they installed put users at risk:

“We messed up,” CTO Peter Hortensius told Re/code. The company now confirms that the way Superfish operates could leave machines vulnerable to a “man-in-the-middle,” or MITM, attack, in which an attacker mimics both sides of a conversation to actively eavesdrop on each one. The problem stems from the fact that Superfish intercepts Web traffic, including secure traffic, using a self-signed security certificate that could be spoofed by attackers.

And:

“We should have known going in that that was the case,” Hortensius said. “We just flat-out missed it on this one, and did not appreciate the problem it was going to create.”

And:

“We are taking our beating like we deserve on this issue,” he said.

And Finally:

“We are not just curled up in a ball,” he said. “We are taking real action to make this right with our customers.”

To prove that, the uninstall tool that they promised is now available. Great. But I am still not recommending Lenovo products to my customers ever again.

For Lenovo, installing potentially dangerous adware on computers that they sell is pretty bad. But the problem is now really bad as security researcher Robert Graham has shown how one can leverage this adware to spy on users:

I extracted the certificate from the SuperFish adware and cracked the password (“komodia”) that encrypted it. I discuss how down below. The consequence is that I can intercept the encrypted communications of SuperFish’s victims (people with Lenovo laptops) while hanging out near them at a cafe wifi hotspot. Note: this is probably trafficking in illegal access devices under the proposed revisions to the CFAA, so get it now before they change the law.

I guess that any attempt by Lenovo to say that this adware isn’t really harmful has just gone up in smoke. This fiasco is starting to reach the point where someone needs to slap anyone and everyone behind this adware and the installation of it onto Lenovo computers silly. The Government, law enforcement, lawyers via a class action lawsuit, consumers via a boycott of Lenovo products. I don’t really care whom. It just has to happen as this is completely unacceptable.

There’s a lot of people who don’t like Lenovo. Some people don’t like them because they’re Chinese, which means that they must be evil in some way. Some weren’t thrilled with their business practices. Neither is good. But this is going to make things worse for them. The Next Web is reporting that Lenovo has been caught installing adware on their computers:

The adware, named Superfish, is reportedly installed on a number of Lenovo’s consumer laptops out of the box. The software injects third-party ads on Google searches and websites without the user’s permission.

Superfish appears to affect Internet Explorer and Google Chrome on these Lenovo computers.

For a top tier computer company to do this is beyond unacceptable. What really bothers me is that when they were caught, they did promise to stop shipping it, but they also defended it by saying that this adware “helps users find and discover products visually” and “instantly analyzes images on the web and presents identical and similar product offers that may have lower prices.”

That is quite frankly is a load of bull. But it doesn’t end there:

Other users are reporting that the adware actually installs its own self-signed certificate authority which effectively allows the software to snoop on secure connections, like banking websites as pictured in action below.

This is a malicious technique commonly known as a man-in-the middle attack, where the certificate allows the software to decrypt secure requests, yet Lenovo appears to be shipping this software with some of its products out of the box.

If this is true — we’ve only seen screenshots so far — Superfish could be far more dangerous than just inserting advertising.

I am shocked by Lenovo’s behavior and I for one will not recommend their products going forward to my customers as they clearly cannot be trusted.

Now if you’ve got a Lenovo computer and you wish to check to see if you’ve got this adware on your computer, click here for a site that will allow you to do that. If you are infected, there are instructions to remove it on the site.