29 ms·

Lenovo Statement on Superfish

337 points by mmastrac 12y ago

pkinsky 12y ago
I was considering getting a Lenovo X1 Carbon to run linux on. I'd be installing a clean image, so no Superfish, but I still don't want to give money to Lenovo right now. What alternative linux laptops are there? (aside from macs)
- jkot 12y ago
  Dell sells laptops with Ubuntu, its $100 cheaper. Most awesome is probably XPS 13" 2015, but it does not have official support yet.
  - puredemo 12y ago
    Is there a version that's not touchscreen?
- de_dave 12y ago
  The Dell XPS 13 is superb, been running Linux on it since day one. Fantastic, solid little machine.
- admax88q 12y ago
  The Dell XPS is actually not bad if you're looking for an ultrabook type machine, also the HP EliteBook.
- deleted 12y ago
  [deleted]
- Coding_Cat 12y ago
  There's System76, which are basically pre-loaded Clevo laptops (which are sold under many different names). I have the Galago Ultrapro and am quite happy with it. Good battery life, fast, user-serviceable and a calibrated IPS screen. On release the keyboard was a little off, but the new one is pretty good.
  - meritt 12y ago
    How's battery life? That was always my concern, it seemed to be quite pathetic in comparison to modern 6-12hr competitors.
    - Coding_Cat 12y ago
      It depends on what you're doing of course. Normal usage (playing music/Youtube, browsing firefox, coding, opening up some PDFs) gives me about 6-8 hours I'd say, I get about 3 hours of (modded) minecraft, which is quite the battery drain. this is on Gentoo (Awesome as WM) so the background drain is pretty low. It's good enough that I never really pay attention to it. upower says the battery is designed to store up to 48Wh, with a maximum design capacity of 53Wh.
      - geoka9 12y ago
        Is the battery controller programmable from Linux? E.g. can you set charging thresholds? Is there any hardware in it that doesn't work in Linux?
        Coding_Cat 12y ago
        I don't know about the battery controller, all of it works with Linux (System76 is a Linux retailer after all).
  - geoka9 12y ago
    Wow, a very impressive lineup. Their performance laptop even has the optional second GPU - never seen that in a laptop before. If only they had a trackpoint style pointing device, that would be my perfect next laptop!
- geoka9 12y ago
  Why does lenovo thinkpad have to be the only line of laptops that has a trackpoint by default? How hard can it be to include it for other brands? This is a very important feature for some people and it limits their choice to thinkpads and (AFAIK) some HP laptops.
  - rockdoe 12y ago
    At a guess, it's patented?
    - xienze 12y ago
      The patent is way expired. I think it has more to do with the fact that a lot of people just don't like the Trackpoint or (more likely) won't give it a shot, so manufacturers aren't going to invest the time and money to put it on their laptops. Personally I think the Trackpoint is the greatest thing ever, but I worked at IBM for a long time. Pretty much anyone who has had to use Thinkpads for an extended period of time ends up loving the Trackpoint. But regular people just don't want to give it a shot.
  - teddyuk 12y ago
    I've had track points on hp and dell laptops (I always disable them)
    - scholia 12y ago
      Also some Toshiba laptops....
- thomasmeeks 12y ago
  I am running the dell xps 15, works beautifully. Though the refreshed xps 13 is likely worth a look as well.
- teddyuk 12y ago
  I have an hp elitebook, works great with ubuntu
  - tenfingers 12y ago
    We're using almost exclusively HP here: the EliteBooks always had/have crappy trackpad buttons (to the point of being bothersome). I noticed this in their EliteBook line since 10 years, so they just don't care about it. The keyboard is so-so but acceptable, and the screen of the Folio/G1 ultrabook series is downright bad (strong blue color cast with large sample variability). You can get a matte filter and a replaceable battery in an ultrabook line, which is very good to have, but that stops here. Dell and Lenovo ship way better screens and keyboards for the same specs, which I would definitely recommend for a serious programmer. The 840 G1 I'm trying now has some ACPI and ATA issues currently on any stock kernel (google for more details). HP is definitely not even trying to test his high-end laptop line on Linux. I was quite ok with the Thinkpad line, but this move from Lenovo would now tend me to Dell.
- scrollaway 12y ago
  I recommend the Asus UX line. Don't get the super-high-end ones if you're going to put Linux on it, but you'll get excellent value for your money with $600.
- daurnimator 12y ago
  The Librem should be shipping in April if you can wait: https://www.crowdsupply.com/purism/librem-laptop https://www.crowdsupply.com/purism/librem-laptop
- jgrowl 12y ago
  The Dell Precision M3800 can come with ubuntu preloaded (which actually subtracts ~$100) It's more comparable to a macbook pro than the air though. Also this 20% off coupon works: MXPX2T1N9HGH12
  - daurnimator 12y ago
    Thankyou for the coupon code. I just bought one :)
pcora 12y ago
"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." Seriously?!
- TwoBit 12y ago
  Anybody can MITM secure connections these computers make, right?
  - rockdoe 12y ago
    Yes.
  - SixSigma 12y ago
    And present any HTTPS cert of their choosing to any compromised visitors e.g https://b4nk0famer1ca.com/ https://b4nk0famer1ca.com/
    - tomp 12y ago
      Hm... I'm pretty sure that if you can actually MITM their connection (i.e. you can intercept and modify the packages, e.g. by setting up a rogue Wi-Fi hotspot), you can also fake the DNS and/or IP addresses, so you shouldn't have a problem compromising visitors of https://bankofamerica.com https://bankofamerica.com.
      - Xylakant 12y ago
        you don't need to fake IPs or DNS requests - if you have MITMed their connection then all their traffic flows through your machine and you can present whatever content you desire on any domain.
      - SixSigma 12y ago
        The point being that you don't have to MITM their connection. The private key is in the wild, you can sign a cert and host it anywhere on the internet. Any visitors who have that see that cert signed by that root cert will say "yep, fine, go ahead". So then you spam the world with "Important message from Lenovo" and hope they click on https://len0v0.com https://len0v0.com and install your important update
eropple 12y ago
> We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. I try to be measured around here, as hard as I can. I can't formulate a polite way to respond to this claim. Lenovo, you are full of shit, and maliciously so. There is no excuse, nor forgiveness, for what you've done here.
- pja 12y ago
  Can you ever imagine Apple pulling a stunt like this? No, because it’s astonishingly user hostile: Lenovo should be hanging their head in shame, not making out like it’s no big deal.
  - Alupis 12y ago
    > Can you ever imagine Apple pulling a stunt like this? No Why would you jump to that conclusion? Apple is just a company... and through the right view-port, even something like this can appear to be "consumer oriented" to management ("we're helping customers locate products and services easier"). Recently Canonical thought it was a great idea to bake-in Amazon ads into their search lens... so ads and product placement tagged with their affiliate link were baked into your OS. No company is immune to doing stupid things, even Apple.
    - tunap 12y ago
      Actually, reading the NSA hard drive firmware hack a couple days ago rekindled my suspicions about all the MacBook Pro failures a few years back. Apple claimed the hardware was at fault & nothing short of sending off for a pricey, clean-room extraction would get the data back. Much to my clients' relief I recovered all the data from three MBP drives for a lot less than what the 'geniuses' quoted. *It was the HD controller at fault, I managed to get them to mount and read at an extremely slow rate, but in time all was recovered.
    - kalleboo 12y ago
      Apple is definitely not immune to stupid things. They've done a lot of stupid things. Apple have also made tons of mistakes when it comes to security and privacy. But I still have a hard time seeing Apple ever intentionally adding a feature that proxies all a user's encrypted connections to inspect the content and insert ads. Tim Cook's recent speech at the Cybersecurity summit sounded pretty earnest to me https://www.youtube.com/watch?v=QI6DvV2muDE https://www.youtube.com/watch?v=QI6DvV2muDE
jacquesm 12y ago
Lenovo is going to lose more through how they handle this than through the fact that they did it in the first place.
- pjmlp 12y ago
  Sadly no. Businesses will still buy Thinkpads like candies.
  - jacquesm 12y ago
    I'm structurally distrustful of the hardware that I buy so I rip out the drives without ever even booting them and then install Linux on a drive bought through another source. I can still see some potential issues there (drive firmware compromised, bios tricks, chipsets with junk and management devices) but that's a basic precaution against getting something you didn't actually buy.
    - omegaham 12y ago
      I think it rapidly turns into "How much effort are you willing to use to make yourself more secure?" There's diminishing returns as you increase your money and effort devoted. $50 and a couple hours will get you another hard drive and a Linux install. How much are you going to spend to guarantee that your BIOS and firmware aren't compromised? There's a reason why security-conscious folks spend an enormous amount of money on the stuff that we buy for a couple hundred bucks. I'm sure that the NSA pays thousands for $100 hard drives.
  - deleted 12y ago
    [deleted]
  - thorntonbf 12y ago
    There are some interesting corollaries that make this interesting from an InfoSec perspective. Heart of the matter is that most consumers - whether personal or business users will have little to no visibility into this. And, even a smaller fraction will have the technical chops to remove this garbage unless there's a tool that's openly presented to them. Since there are a ton of small businesses that purchase and consume laptops just as the come out of the box, I'm really interested in the industrial espionage potential with this. Couple in all the PRISMish like revelations over the last year and a half, and I simply have trouble putting much faith in their, "oh, it's just to show better ads, sorry..." statement.
superobserver 12y ago
I'm seeing at least one report dating from September of last year on their forums: https://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Lenovo-Pre-instaling-adware-spam-Superfish-powerd-by/td-p/1726839 https://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Lenovo-...
- JimmyM 12y ago
  > We are getting off-topic here. If you have questions pertaining to the differences between adware, spyware, potentially unwanted applications, and viruses please post on the Security & Malware Forum. We'll be glad to clear up any misunderstanding. Ugh. Patronising, misleading and evading the point all in one answer. This was a horrible thread to read.
electic 12y ago
> "We will not preload this software in the future." I know it is lucrative to preload but I really wish this practice would just die. In the long run, they are just hurting their business.
resonantcore 12y ago
They disabled it server-side? What about the CA certificate in all these Lenovo users' trust stores that blackhats can now use to MITM with wild abandon?
- thesimon 12y ago
  It enhances the users experience when being MITM'd. But yeah, the removal instructions mention that the certificate won't be removed, which is quite dangerous. EDIT: And users removing the cert would be unable to load https pages, which is a tricky situation.
ingler 12y ago
Lenovo is just copying their betters at the NSA: Infect the machines of others and when caught, deny it. Sadly, this business model will probably work for them.
mmastrac 12y ago
Unfortunately the best response to this is extracting the private key for the cert it installs in the root and publishing it: http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html http://blog.erratasec.com/2015/02/extracting-superfish-certi...
- rkangel 12y ago
  OK, thanks for this. I wasn't sure if the signing of stuff was being done locally by the proxy or remotely. i.e. whether the private key was on the machines. So yes, complete security clusterfuck.
admax88q 12y ago
> The relationship with Superfish is not financially significant; our goal was to enhance the experience for users. I don't believe that for a second.
packetized 12y ago
Lenovo is saying exactly what they need to say in order to prevent their statement from being admitted as evidence in a lawsuit or legal proceeding. In other words, they just acknowledged it without admitting fault or liability.
- rockdoe 12y ago
  If I base myself on that statement to decide that there's no need to remove the software, then get my bank account emptied, won't that backfire pretty hard on them?
lifeformed 12y ago
"Superfish was included [...] to help customers potentially discover interesting products while shopping". Wow how thoughtful and helpful of them. I don't understand the point of bloatware. Are the manufacturers making a ton of money off of them or something? How much could bloatware writers possibly be offering to make it worth uglifying your brand?
- ptaipale 12y ago
  Yes, "ton of money" meaning a few grand. I think manufacturers are selling their reputation for too cheap. There of course is a point that each manufacturer would like to provide some added value through software that would set them apart from other vendors - because hardware competition is so fierce - but unfortunately their priorities for selecting the vendors they use are really bad. Much of the crap is just horrible, and I don't recall seeing anything really useful recently.
  - TeMPOraL 12y ago
    Yup. You know how real value-add looks like? Permanent +50GB of DropBox I got when I bought my Galaxy S4. While I wasn't aware of it until I bought the phone and was just pleasantly surprised, it's a kind of thing that really could influence my choice of phone if I was on the edge of a choice.
tyho 12y ago
> The relationship with Superfish is not financially significant; our goal was to enhance the experience for users. I would prefer for this to be a lie than for it to turn out for this statement to be true. Surely nobody at Lenovo honestly belived that ad injection improved user experience?
- therealwill 12y ago
  Well, a lot of people use their computer to purchase things. How do people know what to purchase? Ads! Therefore more ads = more knowledge about what to purchase and results in a better user experience QED /s.
  - doodpants 12y ago
    You know, I often feel as though I'm living in a cave, because there are many things out in the world that I'm unaware of, and I often wonder if it's because I use Adblock. Take Uber, for example. It's apparently a popular ride-sharing service, which I've only heard of recently due to a bunch of articles about them getting into trouble with the law. So how did that service get to be so popular to begin with? How did people first hear of them? I'm guessing that there were lots of banner ads for them all over the web, which I've never seen. Of course, my curiosity as to what goods and services I might be missing out on is not strong enough to cause me to turn off Adblock, because good lord, the web user experience is horrible without it.
    - TeMPOraL 12y ago
      Well, truth be told, most products and services out there are crap, and if something is actually good (or stupidly bad), you'll learn about it anyway. People like to talk about things that solve their problems well. Hell, in tech the Hacker News itself is a nice place for that; most of my "product discovery" happens here. Sure, maybe sometimes you will be late to the party, but you'll find out about good products eventually, and hell no, I'm not going to look at ads unless forced at gunpoint.
    - sejje 12y ago
jwally 12y ago
Can't say I put a lot of trust in this statement "It does not profile nor monitor user behavior. It does not record user information. It does not know who the user is. Users are not tracked nor re-targeted." from someone who refers to ad-ware as "...to help customers potentially discover interesting products while shopping". Barf.
del82 12y ago
> Users are given a choice whether or not to use the product. What did this choice look like? Were users prompted to remove the cert if they didn't want it?
jamesmcq24 12y ago
"our goal was to enhance the experience for users". I've never needed help finding or discovering products, and I can compare my own prices thank you very much. The apology always seems to make it worse.
slantyyz 12y ago
The problem with the statement is that Lenovo owners need to be aware of the news to find it. I'm on Lenovo's mailing list and haven't seen a similar statement in my inbox with remedial instructions. I was only half-lucky with Superfish. I bought my Y50 before Xmas and removed Superfish and all other non-essential software but didn't know about the certificate, which I deleted today. Sadly, I don't think the typical non-technical Lenovo user is even going to find out about this or know how to fix it.
- chinathrow 12y ago
  Return it.
deleted 12y ago
[deleted]
profinger 12y ago
Honestly, I wish there was a way to comment on their stupid statement. These bullsh*t companies need to realize that users don't want the stupid bloatware in the first place. I paid you a TON of money for this computer the least you can do is give it to me in its best condition. You wouldn't buy a car that came painted with advertisements on the side!
- jakejake 12y ago
  They are perfectly aware of how people feel about bloatware. Dell at one point offered clean installs but you had to pay something like $30 extra. This probably provides some type of clue that they make about that much more per machine by including all the pre-installed crap.
  - takluyver 12y ago
    > Dell at one point offered clean installs but you had to pay something like $30 extra And I'd hazard a guess (with no evidence) that very few people paid that extra cost. We undervalue our own attention, assuming that we can easily ignore adverts, so ad-supported products are disproportionately successful (preinstalled bloatware is just a special kind of advertising). Does anyone know how well Amazon Kindles with 'Special offers' are selling?
javert 12y ago
Cut the Bullshit Lenovo! Stop Lying to Us! > We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. A bald-faced lie! > our goal was to enhance the experience for users A bald-faced lie! Adding ads to a page cannot enhance user experience! I'm on, I think, my 4th ThinkPad. A loyal customer. Stop treating us like shit! This is completely unacceptable. Issue a real apology and start firing people, or shut the fuck up.
tyho 12y ago
Microsoft seems to have a vice like grip over OEM's regarding preloading windows on every product they sell without exception, IMHO this is a terrible thing, but can't they do at least a little good and prevent OEM's from shipping anything other than a pristine image with no preloaded software? Surely the endless bundled crapware from every OEM just gives Windows a bad reputation in the long term. The popularity of chromebooks now are a testament to that.
- nfoz 12y ago
  The Android ecosystem is suffering the same problem.
- 0x0 12y ago
  Exactly. If I were CEO of Microsoft now I'd terminate Lenovo's Windows OEM contract just for tarnishing the reputation of Windows. That would probably put Lenovo out of business, actually. Might get other OEMs to take notice too :)
  - scholia 12y ago
    Windows is openly licensed. You just roll up to the website and sign up, then you can do what you like. Under the US Government-imposed anti-trust rules, Microsoft wasn't even allowed to charge the top OEMs different prices. Otherwise it could have discriminated against the "bad" ones.
- derekp7 12y ago
  They tried dictating what vendors could pre-load, and were taken to court by the US Justice Dept, along with a large number of states AGs.
  - scholia 12y ago
    Correct. So OEMs can load whatever crapware they like, and Microsoft doesn't even know what they're loading. The idea of a "vice like grip" is nonsense. What Microsoft does instead is offer Signature editions that are crapware free....
Globz 12y ago
I seriously consider stopping buying Lenovo laptops for the company I work with, I simply cannot go through the trouble of removing all of Lenovo pre-loaded crap each time I replace or buy a new machines. I used to recommend Lenovo as a good laptop for work, with great quality hardware for the price but since a couple years my vision is shifting towards "Lenovo isn't what it used to be, I think we should stop ordering from them..." I had a lot of problems with defective hardware lately even on Thinkpad... This news just adds to the pile of deception I had with Lenovo lately.
nickysielicki 12y ago
>Superfish was previously included on some consumer notebook products shipped in a short window between September and December to help customers potentially discover interesting products while shopping. It's not adware, it's a feature!
vbezhenar 12y ago
It's clearly an adware with backdoor to espionage on user. In many countries creating and distributing that kind of adware is classified as crime. What a nonsense they are talking.
verytrivial 12y ago
Now I'm being stalked by Komodia ads!
flyinghamster 12y ago
I have a ThinkPad T61 that I bought refurbished a couple of years ago. One thing that I really like about it is that it came with a clean Windows 7 installation. But now, there's no way in hell I'd buy a Lenovo. Trust is not easily regained once broken.
PythonicAlpha 12y ago
Even when they disabled server side operations, the malicious root certificate very likely remains on thousands of computers -- and thus a high security risk for all owners of those computers! In essence, a root certificate with known private key is as dangerous as a worm that infected your computer. Maybe even more dangerous.
JustSomeNobody 12y ago
Well there you go. They investigated and found no security issues. Can't get any better than that! Seriously, there were so many different ways they could have gone with this and saved face, but they just decided to hunker down. Sad.
throwaway41597 12y ago
> Users are not tracked nor re-targeted Have a look at code delivered by Superfish: https://www.superfish.com/ws/sf_preloader.jsp https://www.superfish.com/ws/sf_preloader.jsp https://www.superfish.com/ws/sf_code.jsp https://www.superfish.com/ws/sf_code.jsp And grep for track and retarget. Just two snippets: var url = sfDomain + "trackSession.action?userid=" + similarproducts.b.qsObj.userid + "&sessionid=-10&action=ud_host_failed"; and: function isRetargetingEnabled(){ if( similarproducts.b.enableRetargetingUnit && !isRetargetingBlackList()){ return 1; } else{ return 0; } }
- gabn 12y ago
  LOL
- omegaham 12y ago
  Outstanding. It's like a ridiculous Law & Order episode where the defendant goes "I wasn't even in town that night." "So what's your face doing on all of these security cameras at the scene of the crime?" "... uh..."
  - shpx 12y ago
    so just to be clear, because I find this hard to believe, they are straight up, 100% lying? Or is this taking some hash generating code out of context or something?
    - throwaway41597 12y ago
      It's hard to judge without digging into this spaghetti mess of files. But having the word retarget in your code seems like straight up lying to me. Tracking is more ambiguous a word and I couldn't find where they define the userid. But however it is generated, it reads like it's unique. And in order to retarget users, you'd have to track which products they've viewed in the first place, that would imply storing browsing history (they deny storing user info as well) and uniquely identifying users across websites. Given the coding style, I don't think the person(s) who wrote this code is/are doing anything clever other than what it seems.
gluejar 12y ago
Class-action lawsuit anyone?
michaelhoffman 12y ago
"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." One way to read this is they have not seen any evidence that people have actually been hacked in the wild. They may understand perfectly well that it is now trivial to do this but no one's actually reported yet that they had thousands of dollars stolen due to using online banking on a compromised Lenovo machine on public Wi-Fi. Roll on the class action lawsuits.
IvyMike 12y ago
I've been a ThinkPad customer for ages, and have recommended them to others many times. I'm fuming mad over this. What's the best way to tell Lenovo they fucked up? I mean, I can vent over social media all day but will they even pay attention?
- joshuapants 12y ago
  Stop buying their products. I was already considering moving away from Lenovo after the ruination of the -40 series. I was almost swayed back in by the -50s but this put the final nail in the coffin.
AC__ 12y ago
Yeah this is fucking hilarious! Be sure to read the Extracting SuperFish Certificate article first for full affect though lol
Thrymr 12y ago
Why is a press release undated? You have to go back to the "News releases" page to see that it is dated today. The PDF version doesn't have the date, either.
api 12y ago
While this kind of foistware sucks, I'm also a bit dismayed by the seeming domain-specificity of peoples' privacy concerns. Do a simple tracker on a desktop, and people freak out. But all you have to do is change the form factor and UI metaphor to mobile and people are absolutely fine with constant location tracking, ambient sound being uploaded to the cloud (SIRI, etc.), a camera and a microphone that can be activated by all kinds of apps while the device is in your pocket, and a constant 24/7 Internet connection. You could never even approach that level of invasiveness on a desktop or laptop. A desktop/laptop is a computer. A smartphone is a computer. Why the different reaction? I wonder if it's a generation gap thing. Older people tend to use mobile devices less than younger people. Are the younger generation this oblivious? Same phenomenon holds by the way with regard to jailed devices. Way back when Microsoft tried to introduce something called "trusted computing," which was basically just code signing. Everyone flipped the hell out and they shelved it. But mobile devices can't run software that isn't tethered to their app stores, and everyone is totally fine with that. Different form factor, different universe? It also seems related to brand. When you sign into Chrome with your Google ID, Google tracks everything you do. But that's Google, not some random little foistware company, so that's okay I guess. Same goes for Safari and iCloud, etc.
- nhaehnle 12y ago
  I would agree with you if this were only about adware. The problem is that the adware opens a massive security hole that is exploitable by everybody. The Lenovo adware wants to hijack SSL connections. To do so, it installs its own CA, and the private key for that CA can be (and has been) extracted. This means that if you own such a laptop and access your bank's SSL website from a random coffee shop, anybody could MitM you, since they can use the publically available "private" key of the rogue CA to impersonate your bank. Smart phones enable turn-key surveillance-based dictatorships beyond anything we've ever seen in the west, but unlike this Lenovo thing, it is not an immediate threat. Hence people react differently to it.
- vezzy-fnord 12y ago
  A desktop/laptop is a computer. A smartphone is a computer. Why the different reaction? They're still two different classes. Smartphones (at least the mainstream Android, iOS and Windows platforms) aren't even self-hosting yet, so they're definitely in their infancy and unlikely to displace the microcomputers we have until said shift occurs, regardless of widespread commentary to the contrary. By the way, "trusted computing" was backed by a ton of other companies besides Microsoft (I don't even think Microsoft were remotely the first), and it is most certainly not dead in the slightest.
ihnorton 12y ago
Repeating this from the other thread: people should file complaints with their state consumer protection division. There are probably at least one or two attorneys general in the country who would love to make an example out of Lenovo ("big bad foreign company", etc.). Here's the complaint form for Massachusetts: http://www.eform.ago.state.ma.us/ago_eforms/forms/piac_ecomplaint.action http://www.eform.ago.state.ma.us/ago_eforms/forms/piac_ecomp... Some state AGs are active on Twitter too, which might get more direct visibility.
Vir0 12y ago
We have a Lenovo G710 at work that was purchased less then a month ago and the amount of bloatware installed on that thing is quite amazing really it's almost a type of art. The Superfish cert is there, however the VisualDiscovery service that injects the adds was at some point disabled as I could only find remnants of it in form of INI files and registry keys. A quick fun fact, There are two encrypted INI files located in the Windows Folder : A.) VisualDiscovery.INI B.) VisualDiscoveryOff.INI If that doesn't tell you everything you need to know about the guy that developed this shit then I don't know what will.
masmullin 12y ago
- Lenovo stopped preloading the software in January. My X1C was ordered on Feb 4th, and shipped Feb 9. I believe that my machine had this malware installed when I received it. On firefox, websites that would not normally have many ads, were filled with ads to the point where I couldn't use the sites. I am unable to prove my claims, as I formatted the HD and installed Linux to get rid of all the obvious bloat-ware. I really enjoy the laptop. But if I was less tech savvy and unable to format/installLinux I would probably have returned the machine (the ads were really really intrusive)
- deleted 12y ago
  [deleted]
xioxox 12y ago
I have a Lenovo laptop and had the superfish root cert installed. I also have a "Nuance" trusted root certificate installed. It's a SHA1RSA certificate issued by Nuance, expiring in January 2040 (serial 9e ef 9d f5 9a...), thumbprint (51 2d 19 4d 28 64...). It says it's usable for everything. Does anyone know about this one?
- danielki 12y ago
  Nuance makes Dragon Naturally Speaking, which also comes preinstalled on some Lenovo laptops (including mine, but it was one of the first things I uninstalled). I'd imagine it has something to do with being able to voice control applications/websites/whatever-Dragon-does. If you don't use Dragon, you can probably safely delete it.
chez17 12y ago
>To be clear, Superfish technology is purely based on contextual/image and not behavioral. It does not profile nor monitor user behavior. It does not record user information. It does not know who the user is. Users are not tracked nor re-targeted. Every session is independent. We've heard this song and dance before. Excuse my skepticism, but I don't believe you and until we can see some source code, I won't believe you.
copsarebastards 12y ago
There's a scene in the movie The Rum Diary where Sanderson says roughly that the way to sell the public on the idea of building a hotel on an untouched island is to start by trying to build 20 hotels. Public outrage will occur, people will write their politicians, and finally a compromise will be reached, in which you get to build only one hotel. But the trick is, that's what you wanted to do in the first place. In the end, this compromise wasn't good enough: the result is still horrible. This is roughly what Lenovo is trying to pull off here. > Superfish was previously included on some consumer notebook products shipped in a short window between September and December to help customers potentially discover interesting products while shopping. This is the compromise being offered. They're claiming, "We didn't violate your privacy, we didn't violate your security, we just wanted to help you discover interesting products." Superfish opens up all sorts of security holes and privacy concerns, but it's probably true that this wasn't Lenovo's intention (not yet, anyway). But to accept this as a compromise would be to give Lenovo the thing they want in the first place: to serve ads into our web searches. And that in itself is deplorable. It is not acceptable for companies to force their agendas on us. Lenovo's only defense here is that they were doing something disgusting. We should not accept this compromise.
stefanix 12y ago
It's perplexing you still need to put a couple of days work into setting a up a computer. In the 90s it was all about getting all the peripherals to work. Now it's all about removing the bloatwear, data leaks, and security holes. On a PC I do a Linux install and go through some extra settings. On Android I install CyanogenMod with an IPtables firewall. The number of apps that try to raid your address book on Android is mind-boggling. When you set Privacy guard to "ask" instead of "deny" you will have so many popups that the phone is bogged down for a couple of minutes after startup.
packetized 12y ago
The absolute best part? "Superfish will be removed from Program Files and Program Data directories, files in user directory will stay intact for the privacy reason. Registry entry and root certificate will remain as well. The Superfish service will stop working as soon as it is uninstalled via above process, and following reboot." Per Lenovo's removal instructions [1], the compromised root certificate will still be installed and trusted. This is completely laughable. [1] http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-Instructions-for-VisualDiscovery-Superfish-application/ta-p/2029206 http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-...
herf 12y ago
Lenovo was discounting 30-40% around Black Friday. For weeks! The simple truth is that crapware pays for cheap PCs, and the economics don't work otherwise.
Mikeb85 12y ago
I like my ThinkPad, but between this and the fact that Dell is selling several Linux laptops, I think my next laptop will be a Dell.
mindcrash 12y ago
> We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. Apparently a wildcard SSL certificate valid for every domain on the internet installed in a certificate store isn't a security concern. Apparently said SSL certificate having a extractable private key installed within a user certificate store isn't a security concern And apparently leaving said certificate behind in the certificate store even after uninstalling the crapware (according to a very reliable InfoSec Taylor Swift) isn't a security concern. Wow? Wow.
HackinOut 12y ago
"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-Instructions-for-VisualDiscovery-Superfish-application/ta-p/2029206 http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-... "This article will be updated with additional instructions on clean up of deactivated files and removal of certificate shortly." This was just edited in, here is the post before that: https://web.archive.org/web/20150219151726/http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-Instructions-for-VisualDiscovery-Superfish-application/ta-p/2029206 https://web.archive.org/web/20150219151726/http://forums.len... So, Lenovo, why should we remove this certificate after all? Any security concerns perhaps?
bhauer 12y ago
The chief question I have is whether or not a Lenovo PC sold by the Microsoft Store as a Signature Edition (e.g., [1]) would contain this or anything similar. My suspicion is that it would not. If anyone is near a Microsoft Store, and can stop in to run the test, it would be interesting to see the results. [1] http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo-Y50-4K-Ultra-HD-Signature-Edition-Gaming-Laptop/productID.306275000 http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo-Y...
ocdtrekkie 12y ago
Love the claim that their relationship with Superfish "isn't finanncially relevant" and that they were doing it for their users.
gchokov 12y ago
An example how not to write press release. So much shit talk.. such a shame.
gcdgcd 12y ago
Lenovo is dead

337 points by mmastrac 12y ago

I was considering getting a Lenovo X1 Carbon to run linux on. I'd be installing a clean image, so no Superfish, but I still don't want to give money to Lenovo right now. What alternative linux laptops are there? (aside from macs)

jkot 12y ago
Dell sells laptops with Ubuntu, its $100 cheaper. Most awesome is probably XPS 13" 2015, but it does not have official support yet.
- puredemo 12y ago
  Is there a version that's not touchscreen?
de_dave 12y ago
The Dell XPS 13 is superb, been running Linux on it since day one. Fantastic, solid little machine.
admax88q 12y ago
The Dell XPS is actually not bad if you're looking for an ultrabook type machine, also the HP EliteBook.
deleted 12y ago
[deleted]
Coding_Cat 12y ago
There's System76, which are basically pre-loaded Clevo laptops (which are sold under many different names). I have the Galago Ultrapro and am quite happy with it. Good battery life, fast, user-serviceable and a calibrated IPS screen. On release the keyboard was a little off, but the new one is pretty good.
- meritt 12y ago
  How's battery life? That was always my concern, it seemed to be quite pathetic in comparison to modern 6-12hr competitors.
  - Coding_Cat 12y ago
    It depends on what you're doing of course. Normal usage (playing music/Youtube, browsing firefox, coding, opening up some PDFs) gives me about 6-8 hours I'd say, I get about 3 hours of (modded) minecraft, which is quite the battery drain. this is on Gentoo (Awesome as WM) so the background drain is pretty low. It's good enough that I never really pay attention to it. upower says the battery is designed to store up to 48Wh, with a maximum design capacity of 53Wh.
    - geoka9 12y ago
      Is the battery controller programmable from Linux? E.g. can you set charging thresholds? Is there any hardware in it that doesn't work in Linux?
      - Coding_Cat 12y ago
        I don't know about the battery controller, all of it works with Linux (System76 is a Linux retailer after all).
- geoka9 12y ago
  Wow, a very impressive lineup. Their performance laptop even has the optional second GPU - never seen that in a laptop before. If only they had a trackpoint style pointing device, that would be my perfect next laptop!
geoka9 12y ago
Why does lenovo thinkpad have to be the only line of laptops that has a trackpoint by default? How hard can it be to include it for other brands? This is a very important feature for some people and it limits their choice to thinkpads and (AFAIK) some HP laptops.
- rockdoe 12y ago
  At a guess, it's patented?
  - xienze 12y ago
    The patent is way expired. I think it has more to do with the fact that a lot of people just don't like the Trackpoint or (more likely) won't give it a shot, so manufacturers aren't going to invest the time and money to put it on their laptops. Personally I think the Trackpoint is the greatest thing ever, but I worked at IBM for a long time. Pretty much anyone who has had to use Thinkpads for an extended period of time ends up loving the Trackpoint. But regular people just don't want to give it a shot.
- teddyuk 12y ago
  I've had track points on hp and dell laptops (I always disable them)
  - scholia 12y ago
    Also some Toshiba laptops....
thomasmeeks 12y ago
I am running the dell xps 15, works beautifully. Though the refreshed xps 13 is likely worth a look as well.
teddyuk 12y ago
I have an hp elitebook, works great with ubuntu
- tenfingers 12y ago
  We're using almost exclusively HP here: the EliteBooks always had/have crappy trackpad buttons (to the point of being bothersome). I noticed this in their EliteBook line since 10 years, so they just don't care about it. The keyboard is so-so but acceptable, and the screen of the Folio/G1 ultrabook series is downright bad (strong blue color cast with large sample variability). You can get a matte filter and a replaceable battery in an ultrabook line, which is very good to have, but that stops here. Dell and Lenovo ship way better screens and keyboards for the same specs, which I would definitely recommend for a serious programmer. The 840 G1 I'm trying now has some ACPI and ATA issues currently on any stock kernel (google for more details). HP is definitely not even trying to test his high-end laptop line on Linux. I was quite ok with the Thinkpad line, but this move from Lenovo would now tend me to Dell.
scrollaway 12y ago
I recommend the Asus UX line. Don't get the super-high-end ones if you're going to put Linux on it, but you'll get excellent value for your money with $600.
daurnimator 12y ago
The Librem should be shipping in April if you can wait: https://www.crowdsupply.com/purism/librem-laptop https://www.crowdsupply.com/purism/librem-laptop
jgrowl 12y ago
The Dell Precision M3800 can come with ubuntu preloaded (which actually subtracts ~$100) It's more comparable to a macbook pro than the air though. Also this 20% off coupon works: MXPX2T1N9HGH12
- daurnimator 12y ago
  Thankyou for the coupon code. I just bought one :)

pcora 12y ago

"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." Seriously?!

TwoBit 12y ago
Anybody can MITM secure connections these computers make, right?
- rockdoe 12y ago
  Yes.
- SixSigma 12y ago
  And present any HTTPS cert of their choosing to any compromised visitors e.g https://b4nk0famer1ca.com/ https://b4nk0famer1ca.com/
  - tomp 12y ago
    Hm... I'm pretty sure that if you can actually MITM their connection (i.e. you can intercept and modify the packages, e.g. by setting up a rogue Wi-Fi hotspot), you can also fake the DNS and/or IP addresses, so you shouldn't have a problem compromising visitors of https://bankofamerica.com https://bankofamerica.com.
    - Xylakant 12y ago
      you don't need to fake IPs or DNS requests - if you have MITMed their connection then all their traffic flows through your machine and you can present whatever content you desire on any domain.
    - SixSigma 12y ago
      The point being that you don't have to MITM their connection. The private key is in the wild, you can sign a cert and host it anywhere on the internet. Any visitors who have that see that cert signed by that root cert will say "yep, fine, go ahead". So then you spam the world with "Important message from Lenovo" and hope they click on https://len0v0.com https://len0v0.com and install your important update

eropple 12y ago

> We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. I try to be measured around here, as hard as I can. I can't formulate a polite way to respond to this claim. Lenovo, you are full of shit, and maliciously so. There is no excuse, nor forgiveness, for what you've done here.

pja 12y ago
Can you ever imagine Apple pulling a stunt like this? No, because it’s astonishingly user hostile: Lenovo should be hanging their head in shame, not making out like it’s no big deal.
- Alupis 12y ago
  > Can you ever imagine Apple pulling a stunt like this? No Why would you jump to that conclusion? Apple is just a company... and through the right view-port, even something like this can appear to be "consumer oriented" to management ("we're helping customers locate products and services easier"). Recently Canonical thought it was a great idea to bake-in Amazon ads into their search lens... so ads and product placement tagged with their affiliate link were baked into your OS. No company is immune to doing stupid things, even Apple.
  - tunap 12y ago
    Actually, reading the NSA hard drive firmware hack a couple days ago rekindled my suspicions about all the MacBook Pro failures a few years back. Apple claimed the hardware was at fault & nothing short of sending off for a pricey, clean-room extraction would get the data back. Much to my clients' relief I recovered all the data from three MBP drives for a lot less than what the 'geniuses' quoted. *It was the HD controller at fault, I managed to get them to mount and read at an extremely slow rate, but in time all was recovered.
  - kalleboo 12y ago
    Apple is definitely not immune to stupid things. They've done a lot of stupid things. Apple have also made tons of mistakes when it comes to security and privacy. But I still have a hard time seeing Apple ever intentionally adding a feature that proxies all a user's encrypted connections to inspect the content and insert ads. Tim Cook's recent speech at the Cybersecurity summit sounded pretty earnest to me https://www.youtube.com/watch?v=QI6DvV2muDE https://www.youtube.com/watch?v=QI6DvV2muDE

jacquesm 12y ago

Lenovo is going to lose more through how they handle this than through the fact that they did it in the first place.

pjmlp 12y ago
Sadly no. Businesses will still buy Thinkpads like candies.
- jacquesm 12y ago
  I'm structurally distrustful of the hardware that I buy so I rip out the drives without ever even booting them and then install Linux on a drive bought through another source. I can still see some potential issues there (drive firmware compromised, bios tricks, chipsets with junk and management devices) but that's a basic precaution against getting something you didn't actually buy.
  - omegaham 12y ago
    I think it rapidly turns into "How much effort are you willing to use to make yourself more secure?" There's diminishing returns as you increase your money and effort devoted. $50 and a couple hours will get you another hard drive and a Linux install. How much are you going to spend to guarantee that your BIOS and firmware aren't compromised? There's a reason why security-conscious folks spend an enormous amount of money on the stuff that we buy for a couple hundred bucks. I'm sure that the NSA pays thousands for $100 hard drives.
- deleted 12y ago
  [deleted]
- thorntonbf 12y ago
  There are some interesting corollaries that make this interesting from an InfoSec perspective. Heart of the matter is that most consumers - whether personal or business users will have little to no visibility into this. And, even a smaller fraction will have the technical chops to remove this garbage unless there's a tool that's openly presented to them. Since there are a ton of small businesses that purchase and consume laptops just as the come out of the box, I'm really interested in the industrial espionage potential with this. Couple in all the PRISMish like revelations over the last year and a half, and I simply have trouble putting much faith in their, "oh, it's just to show better ads, sorry..." statement.

superobserver 12y ago

I'm seeing at least one report dating from September of last year on their forums: https://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Lenovo-Pre-instaling-adware-spam-Superfish-powerd-by/td-p/1726839 https://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Lenovo-...

JimmyM 12y ago
> We are getting off-topic here. If you have questions pertaining to the differences between adware, spyware, potentially unwanted applications, and viruses please post on the Security & Malware Forum. We'll be glad to clear up any misunderstanding. Ugh. Patronising, misleading and evading the point all in one answer. This was a horrible thread to read.

electic 12y ago

> "We will not preload this software in the future." I know it is lucrative to preload but I really wish this practice would just die. In the long run, they are just hurting their business.

resonantcore 12y ago

They disabled it server-side? What about the CA certificate in all these Lenovo users' trust stores that blackhats can now use to MITM with wild abandon?

thesimon 12y ago
It enhances the users experience when being MITM'd. But yeah, the removal instructions mention that the certificate won't be removed, which is quite dangerous. EDIT: And users removing the cert would be unable to load https pages, which is a tricky situation.

ingler 12y ago

Lenovo is just copying their betters at the NSA: Infect the machines of others and when caught, deny it. Sadly, this business model will probably work for them.

mmastrac 12y ago

Unfortunately the best response to this is extracting the private key for the cert it installs in the root and publishing it: http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html http://blog.erratasec.com/2015/02/extracting-superfish-certi...

rkangel 12y ago
OK, thanks for this. I wasn't sure if the signing of stuff was being done locally by the proxy or remotely. i.e. whether the private key was on the machines. So yes, complete security clusterfuck.

admax88q 12y ago

> The relationship with Superfish is not financially significant; our goal was to enhance the experience for users. I don't believe that for a second.

packetized 12y ago

Lenovo is saying exactly what they need to say in order to prevent their statement from being admitted as evidence in a lawsuit or legal proceeding. In other words, they just acknowledged it without admitting fault or liability.

rockdoe 12y ago
If I base myself on that statement to decide that there's no need to remove the software, then get my bank account emptied, won't that backfire pretty hard on them?

lifeformed 12y ago

"Superfish was included [...] to help customers potentially discover interesting products while shopping". Wow how thoughtful and helpful of them. I don't understand the point of bloatware. Are the manufacturers making a ton of money off of them or something? How much could bloatware writers possibly be offering to make it worth uglifying your brand?

ptaipale 12y ago
Yes, "ton of money" meaning a few grand. I think manufacturers are selling their reputation for too cheap. There of course is a point that each manufacturer would like to provide some added value through software that would set them apart from other vendors - because hardware competition is so fierce - but unfortunately their priorities for selecting the vendors they use are really bad. Much of the crap is just horrible, and I don't recall seeing anything really useful recently.
- TeMPOraL 12y ago
  Yup. You know how real value-add looks like? Permanent +50GB of DropBox I got when I bought my Galaxy S4. While I wasn't aware of it until I bought the phone and was just pleasantly surprised, it's a kind of thing that really could influence my choice of phone if I was on the edge of a choice.

tyho 12y ago

> The relationship with Superfish is not financially significant; our goal was to enhance the experience for users. I would prefer for this to be a lie than for it to turn out for this statement to be true. Surely nobody at Lenovo honestly belived that ad injection improved user experience?

therealwill 12y ago
Well, a lot of people use their computer to purchase things. How do people know what to purchase? Ads! Therefore more ads = more knowledge about what to purchase and results in a better user experience QED /s.
- doodpants 12y ago
  You know, I often feel as though I'm living in a cave, because there are many things out in the world that I'm unaware of, and I often wonder if it's because I use Adblock. Take Uber, for example. It's apparently a popular ride-sharing service, which I've only heard of recently due to a bunch of articles about them getting into trouble with the law. So how did that service get to be so popular to begin with? How did people first hear of them? I'm guessing that there were lots of banner ads for them all over the web, which I've never seen. Of course, my curiosity as to what goods and services I might be missing out on is not strong enough to cause me to turn off Adblock, because good lord, the web user experience is horrible without it.
  - TeMPOraL 12y ago
    Well, truth be told, most products and services out there are crap, and if something is actually good (or stupidly bad), you'll learn about it anyway. People like to talk about things that solve their problems well. Hell, in tech the Hacker News itself is a nice place for that; most of my "product discovery" happens here. Sure, maybe sometimes you will be late to the party, but you'll find out about good products eventually, and hell no, I'm not going to look at ads unless forced at gunpoint.
  - sejje 12y ago

jwally 12y ago

Can't say I put a lot of trust in this statement "It does not profile nor monitor user behavior. It does not record user information. It does not know who the user is. Users are not tracked nor re-targeted." from someone who refers to ad-ware as "...to help customers potentially discover interesting products while shopping". Barf.

del82 12y ago

> Users are given a choice whether or not to use the product. What did this choice look like? Were users prompted to remove the cert if they didn't want it?

jamesmcq24 12y ago

"our goal was to enhance the experience for users". I've never needed help finding or discovering products, and I can compare my own prices thank you very much. The apology always seems to make it worse.

slantyyz 12y ago

The problem with the statement is that Lenovo owners need to be aware of the news to find it. I'm on Lenovo's mailing list and haven't seen a similar statement in my inbox with remedial instructions. I was only half-lucky with Superfish. I bought my Y50 before Xmas and removed Superfish and all other non-essential software but didn't know about the certificate, which I deleted today. Sadly, I don't think the typical non-technical Lenovo user is even going to find out about this or know how to fix it.

chinathrow 12y ago
Return it.

deleted 12y ago

[deleted]

profinger 12y ago

Honestly, I wish there was a way to comment on their stupid statement. These bullsh*t companies need to realize that users don't want the stupid bloatware in the first place. I paid you a TON of money for this computer the least you can do is give it to me in its best condition. You wouldn't buy a car that came painted with advertisements on the side!

jakejake 12y ago
They are perfectly aware of how people feel about bloatware. Dell at one point offered clean installs but you had to pay something like $30 extra. This probably provides some type of clue that they make about that much more per machine by including all the pre-installed crap.
- takluyver 12y ago
  > Dell at one point offered clean installs but you had to pay something like $30 extra And I'd hazard a guess (with no evidence) that very few people paid that extra cost. We undervalue our own attention, assuming that we can easily ignore adverts, so ad-supported products are disproportionately successful (preinstalled bloatware is just a special kind of advertising). Does anyone know how well Amazon Kindles with 'Special offers' are selling?

javert 12y ago

Cut the Bullshit Lenovo! Stop Lying to Us! > We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. A bald-faced lie! > our goal was to enhance the experience for users A bald-faced lie! Adding ads to a page cannot enhance user experience! I'm on, I think, my 4th ThinkPad. A loyal customer. Stop treating us like shit! This is completely unacceptable. Issue a real apology and start firing people, or shut the fuck up.

tyho 12y ago

Microsoft seems to have a vice like grip over OEM's regarding preloading windows on every product they sell without exception, IMHO this is a terrible thing, but can't they do at least a little good and prevent OEM's from shipping anything other than a pristine image with no preloaded software? Surely the endless bundled crapware from every OEM just gives Windows a bad reputation in the long term. The popularity of chromebooks now are a testament to that.

nfoz 12y ago
The Android ecosystem is suffering the same problem.
0x0 12y ago
Exactly. If I were CEO of Microsoft now I'd terminate Lenovo's Windows OEM contract just for tarnishing the reputation of Windows. That would probably put Lenovo out of business, actually. Might get other OEMs to take notice too :)
- scholia 12y ago
  Windows is openly licensed. You just roll up to the website and sign up, then you can do what you like. Under the US Government-imposed anti-trust rules, Microsoft wasn't even allowed to charge the top OEMs different prices. Otherwise it could have discriminated against the "bad" ones.
derekp7 12y ago
They tried dictating what vendors could pre-load, and were taken to court by the US Justice Dept, along with a large number of states AGs.
- scholia 12y ago
  Correct. So OEMs can load whatever crapware they like, and Microsoft doesn't even know what they're loading. The idea of a "vice like grip" is nonsense. What Microsoft does instead is offer Signature editions that are crapware free....

Globz 12y ago

I seriously consider stopping buying Lenovo laptops for the company I work with, I simply cannot go through the trouble of removing all of Lenovo pre-loaded crap each time I replace or buy a new machines. I used to recommend Lenovo as a good laptop for work, with great quality hardware for the price but since a couple years my vision is shifting towards "Lenovo isn't what it used to be, I think we should stop ordering from them..." I had a lot of problems with defective hardware lately even on Thinkpad... This news just adds to the pile of deception I had with Lenovo lately.

nickysielicki 12y ago

>Superfish was previously included on some consumer notebook products shipped in a short window between September and December to help customers potentially discover interesting products while shopping. It's not adware, it's a feature!

vbezhenar 12y ago

It's clearly an adware with backdoor to espionage on user. In many countries creating and distributing that kind of adware is classified as crime. What a nonsense they are talking.

verytrivial 12y ago

Now I'm being stalked by Komodia ads!

flyinghamster 12y ago

I have a ThinkPad T61 that I bought refurbished a couple of years ago. One thing that I really like about it is that it came with a clean Windows 7 installation. But now, there's no way in hell I'd buy a Lenovo. Trust is not easily regained once broken.

PythonicAlpha 12y ago

Even when they disabled server side operations, the malicious root certificate very likely remains on thousands of computers -- and thus a high security risk for all owners of those computers! In essence, a root certificate with known private key is as dangerous as a worm that infected your computer. Maybe even more dangerous.

JustSomeNobody 12y ago

Well there you go. They investigated and found no security issues. Can't get any better than that! Seriously, there were so many different ways they could have gone with this and saved face, but they just decided to hunker down. Sad.

throwaway41597 12y ago

> Users are not tracked nor re-targeted Have a look at code delivered by Superfish: https://www.superfish.com/ws/sf_preloader.jsp https://www.superfish.com/ws/sf_preloader.jsp https://www.superfish.com/ws/sf_code.jsp https://www.superfish.com/ws/sf_code.jsp And grep for track and retarget. Just two snippets: var url = sfDomain + "trackSession.action?userid=" + similarproducts.b.qsObj.userid + "&sessionid=-10&action=ud_host_failed"; and: function isRetargetingEnabled(){ if( similarproducts.b.enableRetargetingUnit && !isRetargetingBlackList()){ return 1; } else{ return 0; } }

gabn 12y ago
LOL
omegaham 12y ago
Outstanding. It's like a ridiculous Law & Order episode where the defendant goes "I wasn't even in town that night." "So what's your face doing on all of these security cameras at the scene of the crime?" "... uh..."
- shpx 12y ago
  so just to be clear, because I find this hard to believe, they are straight up, 100% lying? Or is this taking some hash generating code out of context or something?
  - throwaway41597 12y ago
    It's hard to judge without digging into this spaghetti mess of files. But having the word retarget in your code seems like straight up lying to me. Tracking is more ambiguous a word and I couldn't find where they define the userid. But however it is generated, it reads like it's unique. And in order to retarget users, you'd have to track which products they've viewed in the first place, that would imply storing browsing history (they deny storing user info as well) and uniquely identifying users across websites. Given the coding style, I don't think the person(s) who wrote this code is/are doing anything clever other than what it seems.

gluejar 12y ago

Class-action lawsuit anyone?

michaelhoffman 12y ago

"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." One way to read this is they have not seen any evidence that people have actually been hacked in the wild. They may understand perfectly well that it is now trivial to do this but no one's actually reported yet that they had thousands of dollars stolen due to using online banking on a compromised Lenovo machine on public Wi-Fi. Roll on the class action lawsuits.

IvyMike 12y ago

I've been a ThinkPad customer for ages, and have recommended them to others many times. I'm fuming mad over this. What's the best way to tell Lenovo they fucked up? I mean, I can vent over social media all day but will they even pay attention?

joshuapants 12y ago
Stop buying their products. I was already considering moving away from Lenovo after the ruination of the -40 series. I was almost swayed back in by the -50s but this put the final nail in the coffin.

AC__ 12y ago

Yeah this is fucking hilarious! Be sure to read the Extracting SuperFish Certificate article first for full affect though lol

Thrymr 12y ago

Why is a press release undated? You have to go back to the "News releases" page to see that it is dated today. The PDF version doesn't have the date, either.

api 12y ago

While this kind of foistware sucks, I'm also a bit dismayed by the seeming domain-specificity of peoples' privacy concerns. Do a simple tracker on a desktop, and people freak out. But all you have to do is change the form factor and UI metaphor to mobile and people are absolutely fine with constant location tracking, ambient sound being uploaded to the cloud (SIRI, etc.), a camera and a microphone that can be activated by all kinds of apps while the device is in your pocket, and a constant 24/7 Internet connection. You could never even approach that level of invasiveness on a desktop or laptop. A desktop/laptop is a computer. A smartphone is a computer. Why the different reaction? I wonder if it's a generation gap thing. Older people tend to use mobile devices less than younger people. Are the younger generation this oblivious? Same phenomenon holds by the way with regard to jailed devices. Way back when Microsoft tried to introduce something called "trusted computing," which was basically just code signing. Everyone flipped the hell out and they shelved it. But mobile devices can't run software that isn't tethered to their app stores, and everyone is totally fine with that. Different form factor, different universe? It also seems related to brand. When you sign into Chrome with your Google ID, Google tracks everything you do. But that's Google, not some random little foistware company, so that's okay I guess. Same goes for Safari and iCloud, etc.

nhaehnle 12y ago
I would agree with you if this were only about adware. The problem is that the adware opens a massive security hole that is exploitable by everybody. The Lenovo adware wants to hijack SSL connections. To do so, it installs its own CA, and the private key for that CA can be (and has been) extracted. This means that if you own such a laptop and access your bank's SSL website from a random coffee shop, anybody could MitM you, since they can use the publically available "private" key of the rogue CA to impersonate your bank. Smart phones enable turn-key surveillance-based dictatorships beyond anything we've ever seen in the west, but unlike this Lenovo thing, it is not an immediate threat. Hence people react differently to it.
vezzy-fnord 12y ago
A desktop/laptop is a computer. A smartphone is a computer. Why the different reaction? They're still two different classes. Smartphones (at least the mainstream Android, iOS and Windows platforms) aren't even self-hosting yet, so they're definitely in their infancy and unlikely to displace the microcomputers we have until said shift occurs, regardless of widespread commentary to the contrary. By the way, "trusted computing" was backed by a ton of other companies besides Microsoft (I don't even think Microsoft were remotely the first), and it is most certainly not dead in the slightest.

ihnorton 12y ago

Repeating this from the other thread: people should file complaints with their state consumer protection division. There are probably at least one or two attorneys general in the country who would love to make an example out of Lenovo ("big bad foreign company", etc.). Here's the complaint form for Massachusetts: http://www.eform.ago.state.ma.us/ago_eforms/forms/piac_ecomplaint.action http://www.eform.ago.state.ma.us/ago_eforms/forms/piac_ecomp... Some state AGs are active on Twitter too, which might get more direct visibility.

Vir0 12y ago

We have a Lenovo G710 at work that was purchased less then a month ago and the amount of bloatware installed on that thing is quite amazing really it's almost a type of art. The Superfish cert is there, however the VisualDiscovery service that injects the adds was at some point disabled as I could only find remnants of it in form of INI files and registry keys. A quick fun fact, There are two encrypted INI files located in the Windows Folder : A.) VisualDiscovery.INI B.) VisualDiscoveryOff.INI If that doesn't tell you everything you need to know about the guy that developed this shit then I don't know what will.

masmullin 12y ago

- Lenovo stopped preloading the software in January. My X1C was ordered on Feb 4th, and shipped Feb 9. I believe that my machine had this malware installed when I received it. On firefox, websites that would not normally have many ads, were filled with ads to the point where I couldn't use the sites. I am unable to prove my claims, as I formatted the HD and installed Linux to get rid of all the obvious bloat-ware. I really enjoy the laptop. But if I was less tech savvy and unable to format/installLinux I would probably have returned the machine (the ads were really really intrusive)

deleted 12y ago
[deleted]

xioxox 12y ago

I have a Lenovo laptop and had the superfish root cert installed. I also have a "Nuance" trusted root certificate installed. It's a SHA1RSA certificate issued by Nuance, expiring in January 2040 (serial 9e ef 9d f5 9a...), thumbprint (51 2d 19 4d 28 64...). It says it's usable for everything. Does anyone know about this one?

danielki 12y ago
Nuance makes Dragon Naturally Speaking, which also comes preinstalled on some Lenovo laptops (including mine, but it was one of the first things I uninstalled). I'd imagine it has something to do with being able to voice control applications/websites/whatever-Dragon-does. If you don't use Dragon, you can probably safely delete it.

chez17 12y ago

>To be clear, Superfish technology is purely based on contextual/image and not behavioral. It does not profile nor monitor user behavior. It does not record user information. It does not know who the user is. Users are not tracked nor re-targeted. Every session is independent. We've heard this song and dance before. Excuse my skepticism, but I don't believe you and until we can see some source code, I won't believe you.

copsarebastards 12y ago

There's a scene in the movie The Rum Diary where Sanderson says roughly that the way to sell the public on the idea of building a hotel on an untouched island is to start by trying to build 20 hotels. Public outrage will occur, people will write their politicians, and finally a compromise will be reached, in which you get to build only one hotel. But the trick is, that's what you wanted to do in the first place. In the end, this compromise wasn't good enough: the result is still horrible. This is roughly what Lenovo is trying to pull off here. > Superfish was previously included on some consumer notebook products shipped in a short window between September and December to help customers potentially discover interesting products while shopping. This is the compromise being offered. They're claiming, "We didn't violate your privacy, we didn't violate your security, we just wanted to help you discover interesting products." Superfish opens up all sorts of security holes and privacy concerns, but it's probably true that this wasn't Lenovo's intention (not yet, anyway). But to accept this as a compromise would be to give Lenovo the thing they want in the first place: to serve ads into our web searches. And that in itself is deplorable. It is not acceptable for companies to force their agendas on us. Lenovo's only defense here is that they were doing something disgusting. We should not accept this compromise.

stefanix 12y ago

It's perplexing you still need to put a couple of days work into setting a up a computer. In the 90s it was all about getting all the peripherals to work. Now it's all about removing the bloatwear, data leaks, and security holes. On a PC I do a Linux install and go through some extra settings. On Android I install CyanogenMod with an IPtables firewall. The number of apps that try to raid your address book on Android is mind-boggling. When you set Privacy guard to "ask" instead of "deny" you will have so many popups that the phone is bogged down for a couple of minutes after startup.

packetized 12y ago

The absolute best part? "Superfish will be removed from Program Files and Program Data directories, files in user directory will stay intact for the privacy reason. Registry entry and root certificate will remain as well. The Superfish service will stop working as soon as it is uninstalled via above process, and following reboot." Per Lenovo's removal instructions [1], the compromised root certificate will still be installed and trusted. This is completely laughable. [1] http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-Instructions-for-VisualDiscovery-Superfish-application/ta-p/2029206 http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-...

herf 12y ago

Lenovo was discounting 30-40% around Black Friday. For weeks! The simple truth is that crapware pays for cheap PCs, and the economics don't work otherwise.

Mikeb85 12y ago

I like my ThinkPad, but between this and the fact that Dell is selling several Linux laptops, I think my next laptop will be a Dell.

mindcrash 12y ago

> We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. Apparently a wildcard SSL certificate valid for every domain on the internet installed in a certificate store isn't a security concern. Apparently said SSL certificate having a extractable private key installed within a user certificate store isn't a security concern And apparently leaving said certificate behind in the certificate store even after uninstalling the crapware (according to a very reliable InfoSec Taylor Swift) isn't a security concern. Wow? Wow.

HackinOut 12y ago

"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-Instructions-for-VisualDiscovery-Superfish-application/ta-p/2029206 http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-... "This article will be updated with additional instructions on clean up of deactivated files and removal of certificate shortly." This was just edited in, here is the post before that: https://web.archive.org/web/20150219151726/http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-Instructions-for-VisualDiscovery-Superfish-application/ta-p/2029206 https://web.archive.org/web/20150219151726/http://forums.len... So, Lenovo, why should we remove this certificate after all? Any security concerns perhaps?

bhauer 12y ago

The chief question I have is whether or not a Lenovo PC sold by the Microsoft Store as a Signature Edition (e.g., [1]) would contain this or anything similar. My suspicion is that it would not. If anyone is near a Microsoft Store, and can stop in to run the test, it would be interesting to see the results. [1] http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo-Y50-4K-Ultra-HD-Signature-Edition-Gaming-Laptop/productID.306275000 http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo-Y...

ocdtrekkie 12y ago

Love the claim that their relationship with Superfish "isn't finanncially relevant" and that they were doing it for their users.

gchokov 12y ago

An example how not to write press release. So much shit talk.. such a shame.

gcdgcd 12y ago

Lenovo is dead