13 ms·
Lenovo to pay $7.3M for installing adware in laptops
- mogadsheu 8y agoSeems like a small fine, compared to the potential financial benefit of that installation. Hopefully it serves as a deterrent for future adware installs. If not, maybe we start calling our lawmakers. For those of you in the adware space, would you pay >$10 per head to install your adware onto a computer? My guess is absolutely.
- sokoloff 8y agoAmazon gives you a $20 discount to take ads on Kindle purchases. The possibility of having to pay $10 only if caught and fined seems like not at all a deterrent.
- giancarlostoro 8y agoAmazon ads are usually for things Amazon sells... Windows sorta advertises too... Products Microsoft sells too
- paulie_a 8y agoI don't agree with it but cross promotion of products a company sells is at least a little more reasonable.
- mogadsheu 8y agoAgreed it’s tiny.. hopefully this fine implies that future infractions may carry much more serious penalties
- dmd 8y agoThis fine implies to me that future infractions will not be taken seriously, just as this one wasn't.
- tgsovlerkhgsel 8y agoThe article mentions another $7M worth of fines, and that's just for the US. Also, they sold their customers pretty cheap, so the combined fines likely significantly exceed the profit from the deal: https://www.forbes.com/sites/thomasbrewster/2015/02/27/lenovo-got-very-little-from-superfish-deal/ https://www.forbes.com/sites/thomasbrewster/2015/02/27/lenov... While I do think the punishment should be significantly more severe (including jail time for executives), I suspect the scandal has made companies aware that this is a bad idea. I still don't get why it didn't hurt them more in the enterprise space (read: why large companies didn't institute a strict "no lenovo" policy for a couple years). That would have been way more effective than fines.
- jldugger 8y ago> I still don't get why it didn't hurt them more in the enterprise space (read: why large companies didn't institute a strict "no lenovo" policy for a couple years). That would have been way more effective than fines. Using vendor OS images is a rookie mistake in the first place.
- na85 8y agoWasn't their shitty bios rewriting parts of windows? Vanilla OS images won't save you there.
- opencl 8y agoYes, Windows has a feature called Microsoft Windows Platform Binary Table that allows the OEM to embed any executable file they want into the UEFI image which is then automatically run on every boot. Extremely terrifying backdoor mechanism.
- Spivak 8y agoNot half as scary as Apple's DEP program. Pretty much everyone is moving this way because it's super convenient for admins -- devices arrive out of the box working and configured. Google has "Zero Touch", Samsung as their Knox program.
- moscovium 8y agoI read the headline thinking it was a purchasing deal, not a fine...
- throwaway932 8y agoSmall? It's negligible, and acts like the opposite of a deterrent: it's an implicit authorization.
- ihatemylifefuck 8y agothis bad
- gotbeans 8y agoI had to read twice and go through the article to make sure of the amount. IMO they'd deserve _way_ more than that. The precedent is scary.
- MrTonyD 8y agoFines are just a cost of business to corporations. We need to put people and prison and take control of the corporation, turning it over to the public.
- rjplatte 8y agoCommunism is not the answer to bad business practice.
- typeCoercion 8y agoMaybe nationalization should be an option when a company, say PG&E for example, has poorly maintained equipment that starts forest fires. It seems reasonable that an option like that should be on that table as a deterrent reserved for the worst actors. I don't think that anything like that should have happened here, but the fine of ~$10 a laptop does seem a bit low for MitM.
- Zhenya 8y agoWhy would nationalization ensure that the equipment is well maintained?
- paranoidrobot 8y agoThis descends pretty quickly into politics, but Nationalised infrastructure should be managed by a government organisation who's goal is to deliver a quality product at (or slightly above) cost. These organisations in turn report to the executive government of the day, who's interests should be aligned with that of the citizens they were elected to represent.
- ekianjo 8y agoNationalized infrastructure is a good way to create poor service, and a long lasting debt. Look at pretty much every country in Europe with national railtracks and rail lines: massively bleeding money, with worse and worse service and low levels of investements because there is no incentive to do so.
- chris_wot 8y agoThey also installed a "security" browser toolbar that was based on Conduit malware.
- lamlam 8y agoI'm always surprised that Lenovo use in the enterprise space didn't take a hit after all this came to light. I would have thought competitors like Dell and HPE would have used that opportunity to disparage Lenovo.
- 35345dfgd 8y agoNo enterprise is using the base windows image that came from Lenovo with the superfish malware. They all build their own standard operating environment image that would not include the Lenovo bloatware. I would be surprised if Lenovo enterprises even realized they were shipping this way and have no reason to react negatively. Their competitors also live in glass houses and so cannot throw stones.
- larkeith 8y agoLenovo is known to install rootkits in their devices [1], which an OS image will not prevent. Do you have a citation for Lenovo's competitors installing comparably vulnerable malware? [1] https://threatpost.com/lenovo-hit-with-criticism-over-second-rootkit-like-utility/114261/ https://threatpost.com/lenovo-hit-with-criticism-over-second...
- lamlam 8y agoSo yes, in a normal case, one would expect to be safe because they are using their own built image. But Lenovo went much further than simply installing crapware, they added a firmware that updates files on startup in the OS to ensure that they had a way to install whatever they wanted onto your system [1]. [1] https://www.theregister.co.uk/2015/08/12/lenovo_firmware_nasty/ https://www.theregister.co.uk/2015/08/12/lenovo_firmware_nas...
- lamlam 8y agoTo add to this, while the Superfish issue only affected their consumer laptop lines (e.g. IdeaPad), the LSE issue was found on their enterprise lineup (e.g. ThinkPad).
- gniv 8y agoSo, somewhat offtopic. I'd like to buy some tablets as presents and the Lenovo ones seemed well rated for the price. Are there others that are made by a, umm, nicer company? I'm looking for cheap and reliable rather than performant.
- dawnerd 8y agoSo what's your price range? Ipads were down to 249 which I'd consider pretty darn cheap.
- dingaling 8y agoAmazon Fire 7 were down to £30 ( $40 ). That's cheap. $249 is still serious money for most families.
- SmellyGeekBoy 8y ago"Some" tablets implies more than 2, that's an awful lot of money to spend on presents.
- shash7 8y agoMaybe give chromebooks a spin? Or pair up an ipad with a portable keyboard.
- Lio 8y agoI can't really comment on the iPad idea but in the context of Lenovo's malware install... If you're purchasing a computer with Google software on it aren't you already handing everything to Google? So is a Chromebook really an alternative if you're rejecting Lenovo tablets for poor security/privacy? I've been interested in Chromebook hardware but have rejected them for security reasons previously. I'd be interested to hear other people's opinions on the mater.
- MegaLeon 8y agoLast year I bought a Fire 7 for black friday, then rooted it and replaced the amazon OS with LineageOS and the Play Store. Made for an excellent cheap tablet gift which is still being used today.
- shmerl 8y agoDidn't they also install some malware in UEFI at one point? Which is even worse, since you can install Linux on Lenovo laptops wiping out their pre-installed (but non refundable) Windows, but you can't easily replace UEFI there.
- tgsovlerkhgsel 8y agoThey did have a firmware-based malware dropper. The "only" thing it did was re-infect clean Windows installations, so installing Linux would still mean you'd be fine as the second stage wouldn't be dropped, but of course that's not a technical limitation - they could have built it to also infect Linux, but didn't.
- pritambaral 8y agoThey couldn't have. The dropper was passive, abusing a Windows mechanism designed for installing vendor software, in which Windows looks for such software and executes it. Linux does not go diving in UEFI looking for executables to run.
- freediver 8y agoIBM Thinkpad t43p was my first heavy duty laptop. In 2005 IBM made a mistake that someone in their management must regret to date, selling Thinkpad laptop line to Lenovo. Things went downhill for Thinkpads and I lasted 3-4 more generations before finally giving up. Thinkpad had a shot at being the world's most loved laptop, by developers and businessman on the go. Passion for great products and great user experience is clearly not what drives the thinkpad product line today, and that is regretful. It is one of those business that I would love to run.
- tjr225 8y agoTo this day I want an older 16:10 thinkpad to run xubuntu on. Happy with my 2013 mbpr, however.
- int_19h 8y agoThing is, Thinkpads are still the best productivity laptops on the market. Which isn't to say that your observations aren't true, but more of a comment on the general state of that market...
- a_imho 8y agoAgree for some definition of best, however I'm very tempted to pick up a Xiaomi next, they seem to be very reasonably priced.
- simonh 8y agoThinkpads were actually manufactured by Lenovo right from the start, they were only badged by IBM. But even then, why should anyone at IBM care what happened to the brand after they sold it? I know some creators love their product lines and such and care about posterity, but, IBM!
- jhoh 8y agoI recently was asked by my girlfriends sister to help her choose a laptop. After finding a model that looked good spec-wise I searched for that same model but without Windows pre-installed. It was 150€ cheaper. Then I got a 10€ Windows 10 key from ebay, installed O&O ShutUp and Winaero Tweaker and now it almost feels like a great system that you can actually work with. Vendor-bloatware has been bad since Windows 7 but now that even Microsoft chose to ship Windows itself with ads, pre-installed garbage like Candy Crush Saga and that annoying Cortana I can't imagine going back to it.
- simfoo 8y agoThere are no legitimate Windows licenses that only cost 10€. They may activate but successful activation does not imply that you are not breaching Microsofts license agreement and they may decide to deactivate those licenses at any time
- dx034 8y agoWasn't the ban on resale of licenses declared illegal at least in some countries? In that case, second hand licenses would very well be legal, even if Microsoft doesn't like them.
- simfoo 8y agoI don't know, but I would be surprised if such a ruling applied to licenses that were never intended for the country they are resold in.
- Double_a_92 8y agoThose licenses are mostly from education institutions or from company MSDN subscription. I.e. from rogue IT admins that abuse their power.
- Ziomislaw 8y agoit is illegal in Poland
- _Nat_ 8y agoI wonder how costly this particular class-action suit was for Lenovo? This is, the 7.3 MUSD to be paid, plus the prorated expenses to compensate the employees handling the case, plus court fees, plus travel expenses, etc., but ignoring factors like lost sales, other fines and settlements, etc.; is the final figure still around 7.3 MUSD, or would it be significantly more?
- dotdi 8y agoI really wanted to read the article, but, by principle, I leave websites that mess with the native scrolling. Bye hackread.
- neotek 8y agoAbsolutely ludicrous. This is basically an incentive for other laptop manufacturers to do the same thing, knowing the punishment (if it even ever comes) is a drop in the bucket compared to the reward.
- gchokov 8y agoI wonder how much M$FT should pay for all the adware in their OS :)
- 1337shadow 8y agoMaybe a step towards the possibility to buy lenovo hardware without forced m$ license ?
- scarface74 8y agoYou don’t actually pay more for the Windows license. The cost of the Windows license is usually offset by OEM installed crapware on consumer PCs.
- murph-almighty 8y agoSuppose I purchase a laptop from Lenovo. Do I have a surefire way to easily decrapify the laptop?
- Ziomislaw 8y agodd if=/dev/zero of=/dev/sda
- shakna 8y agoTo expand: Lenovo's LSE used UEFI to redeploy the binaries thanks to Microsoft's wonderful Windows Platform Binary Table. Microsoft's default Disk Management system cannot remove EFI partitions (in all cases), and you need to.
- mkirklions 8y agoReformat the computer? I do this on 100% of my computers now. I thought there was a risk of losing some functionality like the touch screen, but everything works and far better than when I bought it.
- pbhjpbhj 8y agoBut if you install Win10 don't you just get spyware/adware/crapware direct from MS then? (asking, I don't know, not a regular MS user)
- murph-almighty 8y agoHaving done this in the past year... kind of. I view it as a lesser brand of evil though. Also it's possible to turn off telemetry. Cortana still sucks though.
- jammygit 8y agoCan you? There was a security report posted last week on here recommending that enterprise users rotate their accounts to prevent some of it.
- prasanthmj 8y agoHope the same step is taken against mobile phone manufacturers who fill the phone with unwanted apps
- increment_i 8y agoI still cant bring myself to purchase a Lenovo product because of this, despite the generally favourable reviews I see on HN regarding the ThinkPads. Its just such a revolting decision to me to do that to a paying customer. I may just put my money where my mouth is and start the break up with Google too, as painful as that will be. I just dont feel like I align with these fucking companies at all anymore.
- dmschulman 8y agoSuperFish and other adwares were installed on Lenovos lower-grade laptops and Thinkpads. The X series and T series, the choice of most consumers who care enough to own a Thinkpad, were not affected by this issue[1]. While it's unacceptable for Lenovo to be doing this on ANY machine, I still feel confident that the company understands how consumers view the Thinkpad brand and how reluctant they are to do anything that might tarnish the brand for business and prosumer users. [1]https://support.lenovo.com/us/en/product_security/superfish https://support.lenovo.com/us/en/product_security/superfish
- jammygit 8y agoAgreed. The machines are lovely but I won't be buying one anytime soon. They got caught 3 times doing variations of this. Three times. They don't deserve to exist anymore. Edit https://www.makeuseof.com/tag/security-failings-demonstrate-avoid-lenovo/ https://www.makeuseof.com/tag/security-failings-demonstrate-...
- LiterallyDoge 8y agoMillion?