13 ms·

Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

397 points by taylorwc 12y ago

billhendricksjr 12y ago
Great... I'm the last person in the startup world still using a PC, and it happens to be a Lenovo.
- finnn 12y ago
  And you're still running the OS that it came with? Even if you want to keep Windows, always reinstall fresh. It's far easier than trying to hunt down every piece of malware they put on it
  - pjc50 12y ago
    This is repeatedly recommended, but I think it's overlooking that not all manufacturer customization is entirely evil. You then to hunt down all the drivers for bits of the motherboard. Are you sure your power consumption settings are optimal after you've done this?
    - joshuapants 12y ago
      Windows has gotten pretty good at finding and installing drivers for you. I'm not sure about 8.1 (only used it briefly on a tablet that came with it installed) but with the 10 preview it has found and installed all the drivers I needed for the two Thinkpads I tried it on. It didn't download the Lenovo power management utility which is key to really squeezing the most out of it, but in my experience it isn't significantly better than Windows power management + keeping the screen brightness down (which is what the Lenovo utility does anyway).
- nkozyra 12y ago
  The time period where Superfish was included was a relatively small chunk of 2014, so you may not be impacted. A good general guideline when buying an off-shelf Windows machine is to do a full wipe first. There may be some manufacturers who are immune to this, but assume everyone's included some bloatware. I find too many people who buy Windows machines start by attempting to manually remove this stuff, which is often a hopeless proposition. Clean wipe, reinstallation. This isn't the reason why most startups/devs have moved to Apple, but it sure helps.
  - stcredzero 12y ago
    assume everyone's included some bloatware We programmers should use this as an analogy for dealing with everyday psychological issues.
- secabeen 12y ago
  Is it a Thinkpad, or a consumer model? The Thinkpads were never involved in this.
  - danieldk 12y ago
    Well, given that they are morally corrupt enough to do this to their customers, why not expect them to have similar trojans or backdoors on Thinkpads? If we assume firmware is safe, wipe it and do a clean install from trusted media.
    - jgrowl 12y ago
      Can we assume their firmware is safe though?
      - stcredzero 12y ago
        No. Firmware has been a part of the "trusting trust" conundrum for several years now.
    - secabeen 12y ago
      Because the business and consumer teams at Lenovo are largely separate. I can't order a Yoga through my Thinkpad rep. I have to go to a retail vendor and us a credit card. I expect there are lots of people at the old IBM offices in New York who are as horrified as we are at when the consumer team agreed to.
  - billhendricksjr 12y ago
    Thinkpad T430s. It's a year old so I'm in the clear upon more detailed reading of the article. I usually do a clean install but when I bought this box it came installed with Win 7 and the discs I got were Win 8 only. Didn't come with a Win 7 serial. This is what I get for buying from a reseller on Amazon.
    - gbl08ma 12y ago
      If you have Windows installed I think you can extract the license key from it (assuming Windows is genuine), then use it to do a clean install, or just save it for posterity in case the hard disk ever dies. As far as I know this is fine WRT Windows EULA.
- vacri 12y ago
  Hey, I use a desktop machine. That paints me as some kind of startup weirdo. Granted, it runs linux, but still, it doesn't fold in the middle or have it's own monitor and keyboard built in.
leereeves 12y ago
The more they deny this is a problem, the more it damages their reputation. They should just admit the problem, thank the security experts, and develop an easy fix.
- Ronsenshi 12y ago
  They did admit the problem and linked page describing how to remove SuperFish. > We're sorry. We messed up. We're owning it. And we're making sure it never happens again. Fully uninstall Superfish: http://lnv.gy/182BW8g http://lnv.gy/182BW8g https://twitter.com/lenovoUS/status/568578319681257472 https://twitter.com/lenovoUS/status/568578319681257472
  - scott_s 12y ago
    Then there's a disconnect between the PR people who handle that Twitter account, and the PR people who are quoted in this story.
  - rdtsc 12y ago
    Only after various rounds of denials followed by backlash against them. Even their "removal" instruction initially failed to fully remove the root certificate. Every single step they made PR-wise was too slow and just reactionary to the backlash. Somebody up there should be fired and replaced.
    - Ronsenshi 12y ago
      Oh, OK. Was not aware about that.
- rdtsc 12y ago
  Their PR style is a bit outdated. Denying and minimizing worked before very well -- major news sources would publish the official denials only and it would kind of stop there. And most of all it helped if there would be litigation. The thought goes if CTO goes on record admitting guilt that is a slam dunk case for anyone suing them. Therefore the typical corporate non-apology apology "I am very sorry you feel this way" kind of bullshit. The problem of course is information sources are a lot more diversified, with Twitter and other media bubbling up tech news to the top faster. The other problem they are facing is a lot of technical people were their proponents and would advocate and drive purchasing decision (in turn putting their own reputation on the line). This is where it is going to hurt them. Something to the effect of "We are very sorry, this was a mistake, here is how to remove the software, we'll send you free software or Lenovo.com discounts. We'll cut off our relationship with this company. Etc, etc.." I think would have been much better for them in the long run.
deleted 12y ago
[deleted]
- monochromatic 12y ago
  How is that any kind of a defense?
  - cordite 12y ago
    It's more like an "Everybody does it, but we got burned first"
- uptown 12y ago
  "In Lenovo defense, the crap that is shipped in the default configuration of every modern windows computers makes something like this inevitable." If only there was some way they could have known what was pre-installed on the machines they're selling. /s
- danieldk 12y ago
  Assuming that this isn't an intentional backdoor that they had to place, there is no defense, period. Intentionally weakening people's system, MITMing their traffic, and inserting ads in private communication. If an individual was doing this, let alone at this scale, they would be stamped 'hacker' and put in some dark prison for ten years. Now it's Lenovo, they will get away with an apology or a class action lawsuit at most. Whoever decided to include this belongs in jail.
  - mod 12y ago
    Says the guy who's never been to jail. Whoever decided to include this, I'm guessing, had ZERO idea what a MITM was. At best they knew it'd spam ads to hardware owners.
rcthompson 12y ago
I warned all my friends and colleagues who use Lenovos, and their answers were all the same. "Who'd be crazy enough to use the default install? First thing I did was (a fresh reinstall of Windows|install Linux)." (Edit: Obviously this is not representative of the general population, and I didn't mean to suggest it was. I was just noting that my efforts to warn people about the untrustworthiness of Lenovo were thwarted because none of them trusted Lenovo to begin with, not for software at least, and that seemed interesting.)
- tedks 12y ago
  You live in a bubble. There are plenty of people who use Lenovo products that are not tech people. By saying this, even though you don't intend to, you are minimizing the effect of this and being an apologist for lenovo.
  - rcthompson 12y ago
    Well, I wasn't trying to do that. I'll edit my comment to make my intent more clear.
  - stcredzero 12y ago
    An intellectual should always be wary of semantic equivalents to, "You're either for us, or against us." In greatest part, because this is one of the major symptoms that one's consciousness is partly clouded by group psychology.
  - philh 12y ago
    I don't like the attitude that if there's a problem, you aren't allowed to say anything along the lines of "here's something that makes it less of a problem than it might be".
- wfunction 12y ago
  I use a default install and I'm a techie. I just remove the bloatware first.
  - 12y ago
jhou2 12y ago
I was under the impression that Lenovo supplies a lot of computers to government and enterprise contracts around the world. Was Superfish only installed on consumer oriented devices, like the ones typically found at Best Buy? I realize most large enterprise would re-image their computers before deployment. I'm shocked that Lenovo would release such a statement. The damage to its credibility is significant.
- rdtsc 12y ago
  Yes, it was only installed on their consumer oriented machines. Their T model Thinkpad don't have it installed. Now the question is of course what else are they installing and what other yet undiscovered issues we'll find. It sounds like FUD but so far based on their response, they seem either incompetent (stupid) or malicious. And I don't exactly like either...
  - ZanyProgrammer 12y ago
    I never quite got this distinction between consumer and non consumer machines, when you can buy high end ThinkPads (but not the blocky T models) at a retailer, and are just as nice as big old blocky good old ThinkPads. I'm really interested if a high end (but "consumer") ThinkPad like http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo-ThinkPad-Yoga-i7-256GB-Signature-Edition-2-in-1-PC/productID.306276200 http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo-T... that you can buy at a retail store (in this case, a special MSFT Store version that has plain Windows supposedly on it) was infected.
    - rdtsc 12y ago
      I loved (well still do) my T model. It has a strong magnesium case. Very solid. Heck it lasted 7 years. Including travel and other abuse. It didn't have bloatware crap installed (as say US govt or big companies would not like that). It came with a smart card reader and such. Had a fingerprint scanner (back when there were not common). Initially also they didn't have all these "consumer" models (Y,G,W,...).
    - emodendroket 12y ago
buro9 12y ago
Microsoft is currently doing Lenovo's work for them: https://twitter.com/FiloSottile/status/568800260111388672 https://twitter.com/FiloSottile/status/568800260111388672 The latest version of Windows Defender is actively removing the Superfish software and the cert. The text of the definition is here: http://pastebin.com/raw.php?i=us7iXvkn http://pastebin.com/raw.php?i=us7iXvkn
- danielweber 12y ago
  15 years ago this would have led to rioting on slashdot and Usenet. How dare Microsoft remove someone else's software? I'm generally in favor of MS doing this specific thing, but there is potential for abuse here.
  - taylorwc 12y ago
    Agreed. Seems like the lesser of two evils in this case. I applaud MSFT for realizing that the vast majority of their users will not have the impetus nor the requisite skill to remove this from their machine.
  - rdtsc 12y ago
    No 15 years ago Microsoft would have been the ones installing it. I think Microsoft went from being a hated software giant to sort of an underdog vis-a-vis Google, Facebook, Amazon and Apple. They are very big and strong no doubt, but I think the attitude they are projecting since switching CEO recently, their open source efforts, and such make them look pretty good PR-wise among the tech crowd.
    - eggnet 12y ago
      Microsoft has done some shady things, but at no time in Microsoft's history would they have installed this.
      - na85 12y ago
        Seems more like a Sony/Samsung move than a Microsoft one.
fown9 12y ago
"Beijing-based computer maker Lenovo has reportedly been blacklisted for years by spy agencies worldwide, as concerns about government-sanctioned Chinese hacking persist. According to the Australian Financial Review, Australia, the UK, Canada, New Zealand, and the US have all rejected Lenovo machines for their top-secret networks since the mid-2000s, though the computers can be used for lower-security tasks that don't involve sensitive information" [1] Why buy a laptop from a company that has ties to the Chinese government [2], an authoritarian government that supports dictators in Africa and totalitarian government in Russia, oppressing women and children in those countries? [1] http://www.theverge.com/2013/7/30/4570780/lenovo-reportedly-banned-by-mi6-cia-over-chinese-hacking-fears http://www.theverge.com/2013/7/30/4570780/lenovo-reportedly-... [2] http://en.wikipedia.org/wiki/Lenovo http://en.wikipedia.org/wiki/Lenovo
- mapleoin 12y ago
  Why buy a laptop from a company that has ties to the Chinese government [2], an authoritarian government that supports dictators in Africa and totalitarian government in Russia, oppressing women and children in those countries? I guess because they make good hardware.
  - nailer 12y ago
    Also (presuming grandparent is American, which may be incorrect) the US supports dictators and totalitarian governments that oppress women in Saudi Arabia.
- jamieb 12y ago
  Why buy a computer from a company that has ties to the US government, an authoritarian government that supports dictators in Africa, the Middle-East, South America, and East Asia, including torture, drug smuggling, misogyny, and has itself engaged in abduction, detention without trial, and in relation to this case, illegal interception of communications?
  - fown9 12y ago
    1.) Which US computer company has ties to US government? Literally owned by the government? 2.) How is US government authoritarian? Have you actually lived in a country that has no elected representative?
SideburnsOfDoom 12y ago
While we're at it, Lenovo's statement that we might enjoy the adware: "The relationship with Superfish is not financially significant; our goal was to enhance the experience for users" is self-evidently bullshit.
- eli 12y ago
  The key word is significant. They're not claiming they didn't preload this software for money, they're just saying it wasn't for very much money. Such a small amount of money that they have no problem ending the relationship now that it's causing them problems. My wild guess would be they got in the ballpark of $0.25 an install.
  - deleted 12y ago
    [deleted]
  - SideburnsOfDoom 12y ago
    For me the key word is "enhance". Why would Lenovo go to the trouble of bundling this, knowing full well that it doesn't actually enhance anything for end users? Hint: It starts with $ and ends with $.
    - ryandrake 12y ago
      "Enhance" is the weasel word you use when you want to try to convince someone something is better, but you can't actually explain in detail what's better about it. Whenever you see a marketing claim that something is "enhanced" the warning bells should be sounding.
  - deleted 12y ago
    [deleted]
  - CWuestefeld 12y ago
    A different way to frame the comment might be something like: "we were willing to sell out your privacy and security for a mere pittance, 'cause we're cheap whores".
argos 12y ago
They changed their statement. Now there is no mention of the issue not being "security concern" (http://news.lenovo.com/article_display.cfm?article_id=1929 http://news.lenovo.com/article_display.cfm?article_id=1929)
somerandomone 12y ago
That's one example of management being utterly technologically incompetent, which unfortunately is the case in a lot of Chinese companies.
- Phlarp 12y ago
  Thankfully American companies _never_ have technologically incompetent managers...
- r00fus 12y ago
  s/Chinese// It's not we haven't thought about replacing management with shell scripts...
- PhasmaFelis 12y ago
  Superfish is an American company. Lenovo may have been dumb enough to be suckered by it, but they weren't dumb enough to create it.
albertzeyer 12y ago
Note that Lenovo has now removed the statement from their article: “We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns.”
- nissehulth 12y ago
  Looks like they also removed a number of posts in the forum where the discussion started, including a post where a moderator wrote that customers asked Lenovo for this kind of service. The same moderator also pointed out that it was against the community rules to argue with moderators...
jhou2 12y ago
Kudos to MS, srsly. lol the amount of positive press that MS has been garnering recently on HN is impressive.
- engendered 12y ago
  Don't think it is purely happenstance. There is absolutely and unequivocally either brigading Microsoft fans, or paid shills, hitting HN hard. There was a garbage post on the front page yesterday and I left a completely benign post that didn't go with the pro-Microsoft/anti-Google narrative -- saw -11 within less than 60 seconds.
  - nailer 12y ago
    shrug. I thought someone needed to do machine learning as a service, especially that can be accessed from Python, so I upvoted an article on Azure. I think presentation should be separate from data, so I upvoted a comment on posh. I'm a OS X / Linux person (my name's probably in your distro somewhere) and sometimes Microsoft does good stuff.
    - engendered 12y ago
      And, strangely, I didn't say otherwise. I'm typing this message on Windows. My main development IDE is Visual Studio. My primary RDBMS platform is SQL Server, deploy of course on Windows. Yeah, the strawman that Microsoft can do no right is pretty easy to knock down, but has absolutely nothing to do with the context of this. Again, a post on the second page (a ridiculous, extremely low quality post that had to be flagged off the front page) saw my benign comment get -11 within 60 seconds. I've never seen that before, much less for a completely moderate comment. I've seen this extremely pro-Microsoft moderation hit other threads hard, and it seems pretty obvious that it isn't by accident.
      - john-waterwood 12y ago
        When startups choose tech these days based on what HN thinks is cool and hip at the day the decission is made, you can't blame tech companies noticing this and trying to turn the odds in their favour.
devy 12y ago
I found this whole Lenovo Adware-gate very hypocritical. Why everyone blames the messenger Lenovo but not the source Superfish? Why? Is it because Lenovo is a Chinese company whereas Superfish is a Iserali-American company based in Silicon Valley? Before this adware-gate, EVERY PC manufacturer bundles adware, HP, Dell, Acer, Lenovo, Asus to name a few top players(Apple perhaps is the only exception as I don't count them as a PC manufacturer). Did anyone bother to look if there were tons of similar security risks with those?
- JohnTHaller 12y ago
  Because there are all sorts of insecure malware/adware out there. They're all various levels of evil and a known quantity of badness. Lenovo is a company that you paid your money to to buy a laptop. It shouldn't come pre-infected with something that compromises your security and privacy.
- rdtsc 12y ago
  Lenovo had a chance to redeem itself by apologizing, removing the software and quickly distancing itself from the company. They screwed up by denying there was problem in the first place. Which means they were defending both their decision to install Superfish as well as, by proxy, Superfish itself. Thus they are seen to be either incompetent (can't trust them) or malicious (also can't trust them). Also consumers never bought Superfish. They paid for a relatively expensive piece of hardware from Lenovo and got screwed. They are right to blame Lenovo for it.
  - devy 12y ago
    They did. https://twitter.com/lenovoUS/status/568578319681257472 https://twitter.com/lenovoUS/status/568578319681257472
- engendered 12y ago
  Why everyone blames the messenger Lenovo but not the source Superfish? Because Lenova is the one who took your hundreds to thousand+ dollars and in return compromised your experience (for what has to be pennies). And in this case it caused a serious security compromise? "EVERY PC manufacturer bundles adware" Crapware/bloatware and adware are very different things. Dell installs some bloatware crap that I can uninstall (and even that is, truly, unacceptable. Again, they can't make more than a dollar or two on that junk, yet they compromise the user experience), but they don't MITM my secure communications, or compromise my security. This has nothing to do with Lenova being a Chinese company. Further, no one expects anything out of Superfish (some slimy adware company), but they do expect standards from Lenova.
JumpCrisscross 12y ago
It tickles me that Superfish is a DFJ-funded [1] start-up based out of Palo Alto. Reporters are focussing on Lenovo's Chinese lineage. Yet this bubbled up out of our backyard, from our own lack of diligence (or scruples). [1] Edit: Draper Fisher Jurvetson, the $4 billion Menlo Park VC firm that backed Baidu, Hotmail, Tesla, SpaceX and Twitter.
- pkaye 12y ago
  What is DFJ?
  - jgrowl 12y ago
    http://en.wikipedia.org/wiki/Draper_Fisher_Jurvetson http://en.wikipedia.org/wiki/Draper_Fisher_Jurvetson
- nailer 12y ago
  Edit: confirmed https://www.crunchbase.com/organization/superfish https://www.crunchbase.com/organization/superfish links to their website, which links to https://twitter.com/superfishteam https://twitter.com/superfishteam
- deleted 12y ago
  [deleted]
- ghshephard 12y ago
  Looking over the executive team of Superfish (Which, creepily, refers people to their linkedin profiles - presumably so they can see who is looking at them.) I see that their Chief Product Officer (Cmpt. Science from Stanford, so obviously knew what was going on) is formerly from Zynga. Mark Pincus is (infamously?) known for his comments about how sometimes, when you are small, you have to do all these terrible things that you are really ashamed of, just so you can get big and never have to think about doing them again. In the case of Pincus, he was referring to a the zwinky toolbar that earns money by redirecting web searches to advertisements - oddly close to what just happened with Superfish/Lenovo.
- deleted 12y ago
  [deleted]
ghshephard 12y ago
How on earth can Lenovo/Superfish state: "But Superfish tells us it stands by Lenovo’s assessment. “Superfish is completely transparent in what our software does and at no time were consumers vulnerable—we stand by this today.” a company spokeswoman said. “Lenovo will be releasing a statement later today with all of the specifics that clarify that there has been no wrong doing on our end.” Now that an official CERT announcement has been released: https://www.us-cert.gov/ncas/alerts/TA15-051A https://www.us-cert.gov/ncas/alerts/TA15-051A I think their misleading comments are going to come back and bite them more than they have already. [EDIT - Looks like they are back peddling a little on: http://news.lenovo.com/article_display.cfm?article_id=1929 http://news.lenovo.com/article_display.cfm?article_id=1929 " Finally, we are working directly with Superfish and with other industry partners to ensure we address any possible security issues now and in the future. " " By the end of this month, we will announce a plan to help lead Lenovo and our industry forward with deeper knowledge, more understanding and even greater focus on issues surrounding adware, pre-installs and security. We are eager to be held accountable for our products, your experience and the results of this new effort" And on: http://support.lenovo.com/us/en/product_security/superfish http://support.lenovo.com/us/en/product_security/superfish "Vulnerabilities have been identified with the software, which include installation of a self-signed root certificate in the local trusted CA store. ... Superfish intercept HTTP(S) traffic using a self-signed root certificate. This is stored in the local certificate store and provides a security concern. " ]
- TillE 12y ago
  > back peddling Just because I've been seeing this mistake a lot lately: peddling is selling. Pedaling is the thing you do with your feet.
- vram22 12y ago
  Reminds me of story of "the ant letter". I'd describe it, but I'm interested to wait a bit to see if anyone else has heard/read it. Will describe it later if no one replies. I've not found via Google despite a search.
belorn 12y ago
Lenovo's response is not astonishingly in the least, its the expected behavior. They made a business decision to include adware in order to raise some extra revenue and then got caught. The default response is to underplay the importance of it, sweeping it under the rug and hope no legal action will happen. A few months ago there was a HN story about a car manufacturer who had made the decision to use cheaper parts for the ignition. They had the critical internal reports from engineers, and when the deaths started to pile up they did the same thing as lenovo. Act clueless, downplay the issue, make a fix, and silently move on. So long it just customer outrage, it is perfectly fine to do borderline illegal things in order to raise some revenue.
harrystone 12y ago
It is not astonishing that a company that would do this would also lie about it. They knew what they were doing.
whytry 12y ago
It's kind of hypocritical when USA loads backdoors into hardware that VisualDiscovery relies on.
mchahn 12y ago
Last night I fired up a brand new HP stream desktop with windows 8.1 (only $179!). It had a Superfish icon on the desktop. When I get home I'll check for the cert. So maybe Lenovo isn't the only offender. Edit: Duh. It was snapfish, not superfish. I've been reading about superfish so much that's what I saw.
halayli 12y ago
Can someone explains to me how Graham claims he can decrypt the intercepted traffic? The proxy communicates securely with the intended website. It's just the browser <-> proxy communication that's vulnerable but that's local on the machine, no ?
- shawkinaw 12y ago
  I'm wondering the same thing. As far as I understand, the proxy is local to the machine, so HTTPS traffic over Wi-Fi should be past the proxy and therefore encrypted using the real certificate.
  - Animats 12y ago
    The installed backdoor certificate is trusted as a root certificate. Its private key is contained in the MITM software, and is now known publicly. So anyone can now create phony certs signed by the backdoor cert, and Lenovo machines accept them as valid. Here is such a page: https://badfish.filippo.io/yes.png https://badfish.filippo.io/yes.png That's an image of the word "Yes" signed with the Superfish certificate. If your browser shows that image without warnings about an invalid cert, the backdoor exists.
    - halayli 12y ago
      Right but this only means you can decrypt data coming from websites using a starfish cert. It doesn't mean you can decrypt your bank traffic because you have this proxy installed which is what Graham is claiming.
      - Animats 12y ago
        Yes, it does mean others can decrypt your bank traffic. Here's how this type of MITM attack works. Situation: user is using laptop in public location with WiFi. Between WiFi device and net is a computer with MITM software. Client laptop requests "https://www.bigbank.com" https://www.bigbank.com". MITM box gets HTTPS request, sees it is for "bigbank.com", and generates a fake cert for that site. It then uses the Superfish root cert to sign the fake cert. MITM box acts as server for that connection and sees the user's traffic in the clear, unencrypted. The Lenovo client laptop sees a valid cert chain descending from the Superfish cert installed by Lenovo. The user sees a green bar and lock icon. MITM box then opens an HTTPS connection to "https://www.bigbank.com" https://www.bigbank.com", and acts as client for that connection. The two connections are connected together as a proxy, so that the user sees what looks like a valid HTTPS connection. The MITM box can log everything, including bank passwords. There's even open source software for doing MITM attacks: https://code.google.com/p/subterfuge/ https://code.google.com/p/subterfuge/
tonylemesmer 12y ago
komodia.com admits to be undergoing a DDoS attack at 2300hrs UTC (fri 20th Feb 2015) (komodia is apparently the underlying tech for the superfish thingy)
eire1130 12y ago
if anyone knows someone who has purchased an infected lenova with superfish, send me an email. My wife is a class action attorney and is conducting an investigation in the matter. Eire1130 (at) gmail (Dot) com

397 points by taylorwc 12y ago

billhendricksjr 12y ago

Great... I'm the last person in the startup world still using a PC, and it happens to be a Lenovo.

finnn 12y ago
And you're still running the OS that it came with? Even if you want to keep Windows, always reinstall fresh. It's far easier than trying to hunt down every piece of malware they put on it
- pjc50 12y ago
  This is repeatedly recommended, but I think it's overlooking that not all manufacturer customization is entirely evil. You then to hunt down all the drivers for bits of the motherboard. Are you sure your power consumption settings are optimal after you've done this?
  - joshuapants 12y ago
    Windows has gotten pretty good at finding and installing drivers for you. I'm not sure about 8.1 (only used it briefly on a tablet that came with it installed) but with the 10 preview it has found and installed all the drivers I needed for the two Thinkpads I tried it on. It didn't download the Lenovo power management utility which is key to really squeezing the most out of it, but in my experience it isn't significantly better than Windows power management + keeping the screen brightness down (which is what the Lenovo utility does anyway).
nkozyra 12y ago
The time period where Superfish was included was a relatively small chunk of 2014, so you may not be impacted. A good general guideline when buying an off-shelf Windows machine is to do a full wipe first. There may be some manufacturers who are immune to this, but assume everyone's included some bloatware. I find too many people who buy Windows machines start by attempting to manually remove this stuff, which is often a hopeless proposition. Clean wipe, reinstallation. This isn't the reason why most startups/devs have moved to Apple, but it sure helps.
- stcredzero 12y ago
  assume everyone's included some bloatware We programmers should use this as an analogy for dealing with everyday psychological issues.
secabeen 12y ago
Is it a Thinkpad, or a consumer model? The Thinkpads were never involved in this.
- danieldk 12y ago
  Well, given that they are morally corrupt enough to do this to their customers, why not expect them to have similar trojans or backdoors on Thinkpads? If we assume firmware is safe, wipe it and do a clean install from trusted media.
  - jgrowl 12y ago
    Can we assume their firmware is safe though?
    - stcredzero 12y ago
      No. Firmware has been a part of the "trusting trust" conundrum for several years now.
  - secabeen 12y ago
    Because the business and consumer teams at Lenovo are largely separate. I can't order a Yoga through my Thinkpad rep. I have to go to a retail vendor and us a credit card. I expect there are lots of people at the old IBM offices in New York who are as horrified as we are at when the consumer team agreed to.
- billhendricksjr 12y ago
  Thinkpad T430s. It's a year old so I'm in the clear upon more detailed reading of the article. I usually do a clean install but when I bought this box it came installed with Win 7 and the discs I got were Win 8 only. Didn't come with a Win 7 serial. This is what I get for buying from a reseller on Amazon.
  - gbl08ma 12y ago
    If you have Windows installed I think you can extract the license key from it (assuming Windows is genuine), then use it to do a clean install, or just save it for posterity in case the hard disk ever dies. As far as I know this is fine WRT Windows EULA.
vacri 12y ago
Hey, I use a desktop machine. That paints me as some kind of startup weirdo. Granted, it runs linux, but still, it doesn't fold in the middle or have it's own monitor and keyboard built in.

leereeves 12y ago

The more they deny this is a problem, the more it damages their reputation. They should just admit the problem, thank the security experts, and develop an easy fix.

Ronsenshi 12y ago
They did admit the problem and linked page describing how to remove SuperFish. > We're sorry. We messed up. We're owning it. And we're making sure it never happens again. Fully uninstall Superfish: http://lnv.gy/182BW8g http://lnv.gy/182BW8g https://twitter.com/lenovoUS/status/568578319681257472 https://twitter.com/lenovoUS/status/568578319681257472
- scott_s 12y ago
  Then there's a disconnect between the PR people who handle that Twitter account, and the PR people who are quoted in this story.
- rdtsc 12y ago
  Only after various rounds of denials followed by backlash against them. Even their "removal" instruction initially failed to fully remove the root certificate. Every single step they made PR-wise was too slow and just reactionary to the backlash. Somebody up there should be fired and replaced.
  - Ronsenshi 12y ago
    Oh, OK. Was not aware about that.
rdtsc 12y ago
Their PR style is a bit outdated. Denying and minimizing worked before very well -- major news sources would publish the official denials only and it would kind of stop there. And most of all it helped if there would be litigation. The thought goes if CTO goes on record admitting guilt that is a slam dunk case for anyone suing them. Therefore the typical corporate non-apology apology "I am very sorry you feel this way" kind of bullshit. The problem of course is information sources are a lot more diversified, with Twitter and other media bubbling up tech news to the top faster. The other problem they are facing is a lot of technical people were their proponents and would advocate and drive purchasing decision (in turn putting their own reputation on the line). This is where it is going to hurt them. Something to the effect of "We are very sorry, this was a mistake, here is how to remove the software, we'll send you free software or Lenovo.com discounts. We'll cut off our relationship with this company. Etc, etc.." I think would have been much better for them in the long run.

deleted 12y ago

[deleted]

monochromatic 12y ago
How is that any kind of a defense?
- cordite 12y ago
  It's more like an "Everybody does it, but we got burned first"
uptown 12y ago
"In Lenovo defense, the crap that is shipped in the default configuration of every modern windows computers makes something like this inevitable." If only there was some way they could have known what was pre-installed on the machines they're selling. /s
danieldk 12y ago
Assuming that this isn't an intentional backdoor that they had to place, there is no defense, period. Intentionally weakening people's system, MITMing their traffic, and inserting ads in private communication. If an individual was doing this, let alone at this scale, they would be stamped 'hacker' and put in some dark prison for ten years. Now it's Lenovo, they will get away with an apology or a class action lawsuit at most. Whoever decided to include this belongs in jail.
- mod 12y ago
  Says the guy who's never been to jail. Whoever decided to include this, I'm guessing, had ZERO idea what a MITM was. At best they knew it'd spam ads to hardware owners.

rcthompson 12y ago

I warned all my friends and colleagues who use Lenovos, and their answers were all the same. "Who'd be crazy enough to use the default install? First thing I did was (a fresh reinstall of Windows|install Linux)." (Edit: Obviously this is not representative of the general population, and I didn't mean to suggest it was. I was just noting that my efforts to warn people about the untrustworthiness of Lenovo were thwarted because none of them trusted Lenovo to begin with, not for software at least, and that seemed interesting.)

tedks 12y ago
You live in a bubble. There are plenty of people who use Lenovo products that are not tech people. By saying this, even though you don't intend to, you are minimizing the effect of this and being an apologist for lenovo.
- rcthompson 12y ago
  Well, I wasn't trying to do that. I'll edit my comment to make my intent more clear.
- stcredzero 12y ago
  An intellectual should always be wary of semantic equivalents to, "You're either for us, or against us." In greatest part, because this is one of the major symptoms that one's consciousness is partly clouded by group psychology.
- philh 12y ago
  I don't like the attitude that if there's a problem, you aren't allowed to say anything along the lines of "here's something that makes it less of a problem than it might be".
wfunction 12y ago
I use a default install and I'm a techie. I just remove the bloatware first.
- 12y ago

jhou2 12y ago

I was under the impression that Lenovo supplies a lot of computers to government and enterprise contracts around the world. Was Superfish only installed on consumer oriented devices, like the ones typically found at Best Buy? I realize most large enterprise would re-image their computers before deployment. I'm shocked that Lenovo would release such a statement. The damage to its credibility is significant.

rdtsc 12y ago
Yes, it was only installed on their consumer oriented machines. Their T model Thinkpad don't have it installed. Now the question is of course what else are they installing and what other yet undiscovered issues we'll find. It sounds like FUD but so far based on their response, they seem either incompetent (stupid) or malicious. And I don't exactly like either...
- ZanyProgrammer 12y ago
  I never quite got this distinction between consumer and non consumer machines, when you can buy high end ThinkPads (but not the blocky T models) at a retailer, and are just as nice as big old blocky good old ThinkPads. I'm really interested if a high end (but "consumer") ThinkPad like http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo-ThinkPad-Yoga-i7-256GB-Signature-Edition-2-in-1-PC/productID.306276200 http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo-T... that you can buy at a retail store (in this case, a special MSFT Store version that has plain Windows supposedly on it) was infected.
  - rdtsc 12y ago
    I loved (well still do) my T model. It has a strong magnesium case. Very solid. Heck it lasted 7 years. Including travel and other abuse. It didn't have bloatware crap installed (as say US govt or big companies would not like that). It came with a smart card reader and such. Had a fingerprint scanner (back when there were not common). Initially also they didn't have all these "consumer" models (Y,G,W,...).
  - emodendroket 12y ago

buro9 12y ago

Microsoft is currently doing Lenovo's work for them: https://twitter.com/FiloSottile/status/568800260111388672 https://twitter.com/FiloSottile/status/568800260111388672 The latest version of Windows Defender is actively removing the Superfish software and the cert. The text of the definition is here: http://pastebin.com/raw.php?i=us7iXvkn http://pastebin.com/raw.php?i=us7iXvkn

danielweber 12y ago
15 years ago this would have led to rioting on slashdot and Usenet. How dare Microsoft remove someone else's software? I'm generally in favor of MS doing this specific thing, but there is potential for abuse here.
- taylorwc 12y ago
  Agreed. Seems like the lesser of two evils in this case. I applaud MSFT for realizing that the vast majority of their users will not have the impetus nor the requisite skill to remove this from their machine.
- rdtsc 12y ago
  No 15 years ago Microsoft would have been the ones installing it. I think Microsoft went from being a hated software giant to sort of an underdog vis-a-vis Google, Facebook, Amazon and Apple. They are very big and strong no doubt, but I think the attitude they are projecting since switching CEO recently, their open source efforts, and such make them look pretty good PR-wise among the tech crowd.
  - eggnet 12y ago
    Microsoft has done some shady things, but at no time in Microsoft's history would they have installed this.
    - na85 12y ago
      Seems more like a Sony/Samsung move than a Microsoft one.

fown9 12y ago

"Beijing-based computer maker Lenovo has reportedly been blacklisted for years by spy agencies worldwide, as concerns about government-sanctioned Chinese hacking persist. According to the Australian Financial Review, Australia, the UK, Canada, New Zealand, and the US have all rejected Lenovo machines for their top-secret networks since the mid-2000s, though the computers can be used for lower-security tasks that don't involve sensitive information" [1] Why buy a laptop from a company that has ties to the Chinese government [2], an authoritarian government that supports dictators in Africa and totalitarian government in Russia, oppressing women and children in those countries? [1] http://www.theverge.com/2013/7/30/4570780/lenovo-reportedly-banned-by-mi6-cia-over-chinese-hacking-fears http://www.theverge.com/2013/7/30/4570780/lenovo-reportedly-... [2] http://en.wikipedia.org/wiki/Lenovo http://en.wikipedia.org/wiki/Lenovo

mapleoin 12y ago
Why buy a laptop from a company that has ties to the Chinese government [2], an authoritarian government that supports dictators in Africa and totalitarian government in Russia, oppressing women and children in those countries? I guess because they make good hardware.
- nailer 12y ago
  Also (presuming grandparent is American, which may be incorrect) the US supports dictators and totalitarian governments that oppress women in Saudi Arabia.
jamieb 12y ago
Why buy a computer from a company that has ties to the US government, an authoritarian government that supports dictators in Africa, the Middle-East, South America, and East Asia, including torture, drug smuggling, misogyny, and has itself engaged in abduction, detention without trial, and in relation to this case, illegal interception of communications?
- fown9 12y ago
  1.) Which US computer company has ties to US government? Literally owned by the government? 2.) How is US government authoritarian? Have you actually lived in a country that has no elected representative?

SideburnsOfDoom 12y ago

While we're at it, Lenovo's statement that we might enjoy the adware: "The relationship with Superfish is not financially significant; our goal was to enhance the experience for users" is self-evidently bullshit.

eli 12y ago
The key word is significant. They're not claiming they didn't preload this software for money, they're just saying it wasn't for very much money. Such a small amount of money that they have no problem ending the relationship now that it's causing them problems. My wild guess would be they got in the ballpark of $0.25 an install.
- deleted 12y ago
  [deleted]
- SideburnsOfDoom 12y ago
  For me the key word is "enhance". Why would Lenovo go to the trouble of bundling this, knowing full well that it doesn't actually enhance anything for end users? Hint: It starts with $ and ends with $.
  - ryandrake 12y ago
    "Enhance" is the weasel word you use when you want to try to convince someone something is better, but you can't actually explain in detail what's better about it. Whenever you see a marketing claim that something is "enhanced" the warning bells should be sounding.
- deleted 12y ago
  [deleted]
- CWuestefeld 12y ago
  A different way to frame the comment might be something like: "we were willing to sell out your privacy and security for a mere pittance, 'cause we're cheap whores".

argos 12y ago

They changed their statement. Now there is no mention of the issue not being "security concern" (http://news.lenovo.com/article_display.cfm?article_id=1929 http://news.lenovo.com/article_display.cfm?article_id=1929)

somerandomone 12y ago

That's one example of management being utterly technologically incompetent, which unfortunately is the case in a lot of Chinese companies.

Phlarp 12y ago
Thankfully American companies _never_ have technologically incompetent managers...
r00fus 12y ago
s/Chinese// It's not we haven't thought about replacing management with shell scripts...
PhasmaFelis 12y ago
Superfish is an American company. Lenovo may have been dumb enough to be suckered by it, but they weren't dumb enough to create it.

albertzeyer 12y ago

Note that Lenovo has now removed the statement from their article: “We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns.”

nissehulth 12y ago
Looks like they also removed a number of posts in the forum where the discussion started, including a post where a moderator wrote that customers asked Lenovo for this kind of service. The same moderator also pointed out that it was against the community rules to argue with moderators...

jhou2 12y ago

Kudos to MS, srsly. lol the amount of positive press that MS has been garnering recently on HN is impressive.

engendered 12y ago
Don't think it is purely happenstance. There is absolutely and unequivocally either brigading Microsoft fans, or paid shills, hitting HN hard. There was a garbage post on the front page yesterday and I left a completely benign post that didn't go with the pro-Microsoft/anti-Google narrative -- saw -11 within less than 60 seconds.
- nailer 12y ago
  shrug. I thought someone needed to do machine learning as a service, especially that can be accessed from Python, so I upvoted an article on Azure. I think presentation should be separate from data, so I upvoted a comment on posh. I'm a OS X / Linux person (my name's probably in your distro somewhere) and sometimes Microsoft does good stuff.
  - engendered 12y ago
    And, strangely, I didn't say otherwise. I'm typing this message on Windows. My main development IDE is Visual Studio. My primary RDBMS platform is SQL Server, deploy of course on Windows. Yeah, the strawman that Microsoft can do no right is pretty easy to knock down, but has absolutely nothing to do with the context of this. Again, a post on the second page (a ridiculous, extremely low quality post that had to be flagged off the front page) saw my benign comment get -11 within 60 seconds. I've never seen that before, much less for a completely moderate comment. I've seen this extremely pro-Microsoft moderation hit other threads hard, and it seems pretty obvious that it isn't by accident.
    - john-waterwood 12y ago
      When startups choose tech these days based on what HN thinks is cool and hip at the day the decission is made, you can't blame tech companies noticing this and trying to turn the odds in their favour.

devy 12y ago

I found this whole Lenovo Adware-gate very hypocritical. Why everyone blames the messenger Lenovo but not the source Superfish? Why? Is it because Lenovo is a Chinese company whereas Superfish is a Iserali-American company based in Silicon Valley? Before this adware-gate, EVERY PC manufacturer bundles adware, HP, Dell, Acer, Lenovo, Asus to name a few top players(Apple perhaps is the only exception as I don't count them as a PC manufacturer). Did anyone bother to look if there were tons of similar security risks with those?

JohnTHaller 12y ago
Because there are all sorts of insecure malware/adware out there. They're all various levels of evil and a known quantity of badness. Lenovo is a company that you paid your money to to buy a laptop. It shouldn't come pre-infected with something that compromises your security and privacy.
rdtsc 12y ago
Lenovo had a chance to redeem itself by apologizing, removing the software and quickly distancing itself from the company. They screwed up by denying there was problem in the first place. Which means they were defending both their decision to install Superfish as well as, by proxy, Superfish itself. Thus they are seen to be either incompetent (can't trust them) or malicious (also can't trust them). Also consumers never bought Superfish. They paid for a relatively expensive piece of hardware from Lenovo and got screwed. They are right to blame Lenovo for it.
- devy 12y ago
  They did. https://twitter.com/lenovoUS/status/568578319681257472 https://twitter.com/lenovoUS/status/568578319681257472
engendered 12y ago
Why everyone blames the messenger Lenovo but not the source Superfish? Because Lenova is the one who took your hundreds to thousand+ dollars and in return compromised your experience (for what has to be pennies). And in this case it caused a serious security compromise? "EVERY PC manufacturer bundles adware" Crapware/bloatware and adware are very different things. Dell installs some bloatware crap that I can uninstall (and even that is, truly, unacceptable. Again, they can't make more than a dollar or two on that junk, yet they compromise the user experience), but they don't MITM my secure communications, or compromise my security. This has nothing to do with Lenova being a Chinese company. Further, no one expects anything out of Superfish (some slimy adware company), but they do expect standards from Lenova.

JumpCrisscross 12y ago

It tickles me that Superfish is a DFJ-funded [1] start-up based out of Palo Alto. Reporters are focussing on Lenovo's Chinese lineage. Yet this bubbled up out of our backyard, from our own lack of diligence (or scruples). [1] Edit: Draper Fisher Jurvetson, the $4 billion Menlo Park VC firm that backed Baidu, Hotmail, Tesla, SpaceX and Twitter.

pkaye 12y ago
What is DFJ?
- jgrowl 12y ago
  http://en.wikipedia.org/wiki/Draper_Fisher_Jurvetson http://en.wikipedia.org/wiki/Draper_Fisher_Jurvetson
nailer 12y ago
Edit: confirmed https://www.crunchbase.com/organization/superfish https://www.crunchbase.com/organization/superfish links to their website, which links to https://twitter.com/superfishteam https://twitter.com/superfishteam
deleted 12y ago
[deleted]
ghshephard 12y ago
Looking over the executive team of Superfish (Which, creepily, refers people to their linkedin profiles - presumably so they can see who is looking at them.) I see that their Chief Product Officer (Cmpt. Science from Stanford, so obviously knew what was going on) is formerly from Zynga. Mark Pincus is (infamously?) known for his comments about how sometimes, when you are small, you have to do all these terrible things that you are really ashamed of, just so you can get big and never have to think about doing them again. In the case of Pincus, he was referring to a the zwinky toolbar that earns money by redirecting web searches to advertisements - oddly close to what just happened with Superfish/Lenovo.
deleted 12y ago
[deleted]

ghshephard 12y ago

How on earth can Lenovo/Superfish state: "But Superfish tells us it stands by Lenovo’s assessment. “Superfish is completely transparent in what our software does and at no time were consumers vulnerable—we stand by this today.” a company spokeswoman said. “Lenovo will be releasing a statement later today with all of the specifics that clarify that there has been no wrong doing on our end.” Now that an official CERT announcement has been released: https://www.us-cert.gov/ncas/alerts/TA15-051A https://www.us-cert.gov/ncas/alerts/TA15-051A I think their misleading comments are going to come back and bite them more than they have already. [EDIT - Looks like they are back peddling a little on: http://news.lenovo.com/article_display.cfm?article_id=1929 http://news.lenovo.com/article_display.cfm?article_id=1929 " Finally, we are working directly with Superfish and with other industry partners to ensure we address any possible security issues now and in the future. " " By the end of this month, we will announce a plan to help lead Lenovo and our industry forward with deeper knowledge, more understanding and even greater focus on issues surrounding adware, pre-installs and security. We are eager to be held accountable for our products, your experience and the results of this new effort" And on: http://support.lenovo.com/us/en/product_security/superfish http://support.lenovo.com/us/en/product_security/superfish "Vulnerabilities have been identified with the software, which include installation of a self-signed root certificate in the local trusted CA store. ... Superfish intercept HTTP(S) traffic using a self-signed root certificate. This is stored in the local certificate store and provides a security concern. " ]

TillE 12y ago
> back peddling Just because I've been seeing this mistake a lot lately: peddling is selling. Pedaling is the thing you do with your feet.
vram22 12y ago
Reminds me of story of "the ant letter". I'd describe it, but I'm interested to wait a bit to see if anyone else has heard/read it. Will describe it later if no one replies. I've not found via Google despite a search.

belorn 12y ago

Lenovo's response is not astonishingly in the least, its the expected behavior. They made a business decision to include adware in order to raise some extra revenue and then got caught. The default response is to underplay the importance of it, sweeping it under the rug and hope no legal action will happen. A few months ago there was a HN story about a car manufacturer who had made the decision to use cheaper parts for the ignition. They had the critical internal reports from engineers, and when the deaths started to pile up they did the same thing as lenovo. Act clueless, downplay the issue, make a fix, and silently move on. So long it just customer outrage, it is perfectly fine to do borderline illegal things in order to raise some revenue.

harrystone 12y ago

It is not astonishing that a company that would do this would also lie about it. They knew what they were doing.

whytry 12y ago

It's kind of hypocritical when USA loads backdoors into hardware that VisualDiscovery relies on.

mchahn 12y ago

Last night I fired up a brand new HP stream desktop with windows 8.1 (only $179!). It had a Superfish icon on the desktop. When I get home I'll check for the cert. So maybe Lenovo isn't the only offender. Edit: Duh. It was snapfish, not superfish. I've been reading about superfish so much that's what I saw.

halayli 12y ago

Can someone explains to me how Graham claims he can decrypt the intercepted traffic? The proxy communicates securely with the intended website. It's just the browser <-> proxy communication that's vulnerable but that's local on the machine, no ?

shawkinaw 12y ago
I'm wondering the same thing. As far as I understand, the proxy is local to the machine, so HTTPS traffic over Wi-Fi should be past the proxy and therefore encrypted using the real certificate.
- Animats 12y ago
  The installed backdoor certificate is trusted as a root certificate. Its private key is contained in the MITM software, and is now known publicly. So anyone can now create phony certs signed by the backdoor cert, and Lenovo machines accept them as valid. Here is such a page: https://badfish.filippo.io/yes.png https://badfish.filippo.io/yes.png That's an image of the word "Yes" signed with the Superfish certificate. If your browser shows that image without warnings about an invalid cert, the backdoor exists.
  - halayli 12y ago
    Right but this only means you can decrypt data coming from websites using a starfish cert. It doesn't mean you can decrypt your bank traffic because you have this proxy installed which is what Graham is claiming.
    - Animats 12y ago
      Yes, it does mean others can decrypt your bank traffic. Here's how this type of MITM attack works. Situation: user is using laptop in public location with WiFi. Between WiFi device and net is a computer with MITM software. Client laptop requests "https://www.bigbank.com" https://www.bigbank.com". MITM box gets HTTPS request, sees it is for "bigbank.com", and generates a fake cert for that site. It then uses the Superfish root cert to sign the fake cert. MITM box acts as server for that connection and sees the user's traffic in the clear, unencrypted. The Lenovo client laptop sees a valid cert chain descending from the Superfish cert installed by Lenovo. The user sees a green bar and lock icon. MITM box then opens an HTTPS connection to "https://www.bigbank.com" https://www.bigbank.com", and acts as client for that connection. The two connections are connected together as a proxy, so that the user sees what looks like a valid HTTPS connection. The MITM box can log everything, including bank passwords. There's even open source software for doing MITM attacks: https://code.google.com/p/subterfuge/ https://code.google.com/p/subterfuge/

tonylemesmer 12y ago

komodia.com admits to be undergoing a DDoS attack at 2300hrs UTC (fri 20th Feb 2015) (komodia is apparently the underlying tech for the superfish thingy)

eire1130 12y ago

if anyone knows someone who has purchased an infected lenova with superfish, send me an email. My wife is a class action attorney and is conducting an investigation in the matter. Eire1130 (at) gmail (Dot) com