10 ms·

Lenovo hit with lawsuit over Superfish snafu

237 points by r721 12y ago

ChuckMcM 12y ago
While this makes for good copy I find it difficult to believe anyone could prove actual harm from the installation. I am not a lawyer so I certainly may have missed a big chunk of commercial law but the only thing I could find was would be around incidental damages which no doubt are expressly disclaimed and agreed to by buyers of the gear (software always disclaims all warranties). So these plaintiffs would seem to have two very large hurdles, one to prove some actual damage, and two to prove some sort of liability even if there was damage. When I first heard about Komodia it seemed pretty clear to me that anyone who employed their software was just asking for trouble. That advice about "Imagine this was on the front page of the NY Times" was pretty helpful.
- logn 12y ago
  Lenovo earns $600M/yr. Regardless of how small the damages are, the punitive damages if awarded would be in context of earnings, the severity of the situation, and what it would take to effectively punish them.
- rdtsc 12y ago
  From what I understand in individual "hacking" cases just circumventing the security and accessing data without copying/selling it would be enough to get someone in trouble. It is at least nice to fantasize how large companies would be held to such "standards" as well. In a civil cases I also wonder if banks, governments or other large institution would be able to file lawsuits as well, claiming perhaps that breaches that have occurred recently occurred because their clients/workers had been unknowingly running one of the this Komodia software installed by Lenovo.
  - 7952 12y ago
    I wonder if the DMCA anti-circumvention provisions could be used?
- exogen 12y ago
  I'm wondering if charges of criminal negligence come into play (1) only for cases of physical harm (all the examples on Wikipedia are people dying but I don't see why that would be necessary) and (2) only if actual harm comes to pass. If not, some kind of negligence certainly seems plausible to me.
  - dredmorbius 12y ago
    There's a lot in the Superfish / Lenovo / Komodia spyware which seems violates Federal law in the US and the California Penal Code. Specifically: 18 USC 1030 http://www.law.cornell.edu/uscode/text/18/1030 http://www.law.cornell.edu/uscode/text/18/1030 In part: a) Whoever ... (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (A) information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602 (n) [1] of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); (B) information from any department or agency of the United States; or (C) information from any protected computer; California's statute (applicable to Superfish) is CPC 502 http://www.leginfo.ca.gov/cgi-bin/displaycode?section=pen&group=00001-01000&file=484-502.9 http://www.leginfo.ca.gov/cgi-bin/displaycode?section=pen&gr... The statute's verbose, but much of the following looks promising: ------------------------------------- (c) Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense: (1) Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data. (2) Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network. (3) Knowingly and without permission uses or causes to be used computer services. (4) Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network. (5) Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network. (6) Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section. (7) Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network. (8) Knowingly introduces any computer contaminant into any computer, computer system, or computer network. (9) Knowingly and without permission uses the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damages or causes damage to a computer, computer data, computer system, or computer network. ------------------------------------- I'd say the US and CA AGs should be reviewing relevant statutes and priming action.
- DanBC 12y ago
  People have to remove the software and the certificate. That takes time, and costs money, and so bundling the software causes harm.
- belorn 12y ago
  In the early days, damages was counted based on engineers time to investigate, clean and fix the computer intrusion. Say the time to remove the adware cost 2hrs, 4hrs time spent to report a compromised credit card as a result of MiTM connection and get a new one. If its a work computer, add an addtional 48hrs to handle the potential of compromised work documents and emails, then the damages count can go quite high. It depend on the specifics that the person arguing for damages provides to the court. But to my knowledge, the laws around computer crime was mostly changed from civil to criminal in order to address the question of damages.
  - LLWM 12y ago
    Unlikely to be relevant here, then. Any business customers would likely have been buying Thinkpads, which were unaffected, and using their own images, not the ones with Lenovo's bundled crapware.
    - ashearer 12y ago
      Then there are employees who use their home laptops to connect to their secure enterprise email portal...
- easytiger 12y ago
  Cost of re-mediation is one
dredmorbius 12y ago
Plaintiff Bennett will find strong support for her "spyware" claim from the US-CERT security advisory over the Superfish / Lenovo / Komodia spyware. As that's precisely the language that the US Government advisory used: https://www.us-cert.gov/ncas/alerts/TA15-051A https://www.us-cert.gov/ncas/alerts/TA15-051A "Starting in September 2014, Lenovo pre-installed Superfish VisualDiscovery spyware on some of their PCs. However, Superfish was reportedly bundled with other applications as early as 2010. This software intercepts users’ web traffic to provide targeted advertisements. In order to intercept encrypted connections (those using HTTPS), the software installs a trusted root CA certificate for Superfish. All browser-based encrypted traffic to the Internet is intercepted, decrypted, and re-encrypted to the user’s browser by the application – a classic man-in-the-middle attack. Because the certificates used by Superfish are signed by the CA installed by the software, the browser will not display any warnings that the traffic is being tampered with. Since the private key can easily be recovered from the Superfish software, an attacker can generate a certificate for any website that will be trusted by a system with the Superfish software installed. This means websites, such as banking and email, can be spoofed without a warning from the browser." (Emphasis added.)
ghshephard 12y ago
As much as I dislike class action law-suit trolling - I'll make an exception when it comes to multi-billion dollar companies installing spyware as part of their bloat-ware add-ons, particularly when it injects MitM attacks on the browsers SSL links, particularly when it does so in a way that jeopardizes the data confidentiality/integrity of individuals trying to use that computer. Ideally, the next time a laptop/desktop vendor is looking at the bloatware they are going to load onto a system, they'll do a cost-benefit analysis against the (potential) punitive damages associated with a lawsuit, and decide not to install the stuff. I'm willing to pay the extra $0.65 for the laptop (or whatever tiny amount the vendors are paid to include this crud) in order to avoid that sort of exposure, I suspect most consumers (these days) are as well.
- skuhn 12y ago
  I don't see this suit as trolling. There exists a large group of people who were sold a product which did not perform its primary function of "doing what its owner told it to do". It turns out that this was intentional on the part of the manufacturer. The nature of the problem is such that returning the product for a refund will not suffice, so the consumers should sue. The most effect way to handle a large body of plaintiffs against a single defendant is with a class action suit. Lenovo will inevitably settle or go to trial and be found guilty, there is no other possible outcome. I personally hope that this erases their profits from Superfish, and quite a bit more for the flagrant and willful violation of consumer trust.
  - laumars 12y ago
    I think you may have misread the OP because you're tone is one of disagreement while your content is a near-reiteration of his post.
    - skuhn 12y ago
      I'm mainly responding to the first part: "As much as I dislike class action law-suit trolling", as in I don't like their methods but I like the results in this particular situation. I also don't see how I have simply re-iterated the same post, OP and I are looking at different angles of the same issue. Fundamentally I think we do agree: Lenovo did a shitty thing and should pay for it. I simply don't think there is anything wrong with the method or the result here. This is exactly what a class action lawsuit is intended for, there's no trolling about it.
throwawayaway 12y ago
Terrible news for the brand! I really would like to think highly of Lenovo and their products, but sadly they let themselves down time and again. I am hesitant to recommend their non thinkpad models on the basis of their construction - and this just adds to that on a different level.
MisterNegative 12y ago
Lets hope the judge chooses the side of Lenovo, It would be devastating if windows/gnu/linux/apple gets sued every time they have a security flaw in a product.
- madaxe_again 12y ago
  When were you last sold a machine with Linux and spyware pre-loaded? Right, never.
  - MisterNegative 12y ago
    Ubuntu
    - iopq 12y ago
      Which is why people shouldn't use Ubuntu and vendors shouldn't pre-install it.
    - skuhn 12y ago
      The difference between Lenovo's use of Superfish and Ubuntu providing anonymized search data to Amazon is night and day in terms of "spyware". I don't like either, but Lenovo's actions were negligent to the point where they have exposed themselves to a justified lawsuit -- Ubuntu did not.
    - madaxe_again 12y ago
      You bought a machine with Ubuntu pre-loaded?
      - iagooar 12y ago
        Does it look strange to you? Have seen this a lot these days, at least in the EU.
      - dagw 12y ago
        Not personally, but it's not like they're that hard to find.
bradleyjg 12y ago
My guess is this is settled quickly: a few million for the attorneys, a few thousand for the lead plaintiff, and either a coupon for each of the class members or nothing at all (cy pres).
- joosters 12y ago
  A class action that it settled quickly? Do they exist?
- rayiner 12y ago
  Appellate courts have been cracking down on cy pres awards recently: http://www.forbes.com/sites/wlf/2014/11/26/seventh-circuit-continues-scrutiny-of-class-action-settlements-and-cy-pres http://www.forbes.com/sites/wlf/2014/11/26/seventh-circuit-c.... As the Seventh Circuit recently clarified in overturning an approved settlement, a cy pres award is only proper if it's impractical to find and compensate the class members directly. Here, there will be sales records to allow easy identification of affected purchasers. That aside, a permanent injunction and a coupon would be a reasonable result here. Civil lawsuits aren't intended to punish people, they're intended to compensate people for their injuries. Who was actually harmed here?
  - bradleyjg 12y ago
    These type of class actions do consumers more harm than good. The exorbitant legal fees are ultimately reflected in prices. If there's wrongdoing with extremely diffuse consequences, that's what the government with its GS scale attorneys are for. Lawsuits, like email marketing, should be opt-in not opt-out.
    - rayiner 12y ago
      > The exorbitant legal fees are ultimately reflected in prices. Prices are set by supply and demand. If companies had the market power to raise prices to pass on the costs of defending class action lawsuits, they would do so with or without the lawsuit.
belorn 12y ago
Why is it called a snafu when a large international company installs malware into customers devices, and a cyber attack if its the Russian mafia? The mafia might also use stronger attacks than just installing adware, but adware is still one of the more common way binaries are infected with malware. It would be interesting to hear from a anti-virus company on how much resources is spent yearly on adware research.
- tragic 12y ago
  "situation normal": OEMs looking for a way to make a quick greasy buck. "All fked up": self-explanatory. Not "cyber-attack": despite conspiracy theories I've heard about the Chinese government, my belief is that the intent behind this debacle was the aforementioned quick greasy buck, not backdooring users' computers for subsequent criminal or military exploitation. It's the distinction between murder and manslaughter.
  - belorn 12y ago
    It is most likely a quick greasy buck, but I would guess that many entry level criminals start by infecting binaries with adware and then spread them through download sites. I would not be surprised if a significant portion of revenue for the Russian mafia does come from adware, just because its so easy to do and has almost no risk associated with it. This is why I suspect the police would call it a cyber-attack if they busted a ring that earned money this way. A computer security researchers might find a distinction between a trojan, a virus, and adware, which is why I wondered how much resources a anti-virus company spends on adware alone. That number would provide a good hint as to the seriousness of such malware.
    - jameshart 12y ago
      The problem with this software is, sadly, not that it was adware at all, but that it was adware which contained a critical security flaw that compromised the computers Lenovo was selling. If Lenovo had sold the machines with secure adware, there'd be no real problem.
- 12y ago
DanBC 12y ago
I'm kind of surprised that superfish (and similar) products are legal. I don't understand why someone would willingly install such software. The reasons the software makers list are deceptive.
louhike 12y ago
A little off topic: Komodia (the company behind a part of the technology used for Superfish) is currently facing a DDOS (http://www.komodia.com/ http://www.komodia.com/)
- ptaipale 12y ago
  Or that is what they say. I don't expect they are facing a real DDOS, they are just facing so many embarrassing questions that it is convenient to call the flood a DDOS.
SwellJoe 12y ago
I would expect even more aggressive approaches in nations with better privacy protections than the US. If systems effected by this were sold in Sweden or Germany or other places with relatively strong privacy laws I would not be surprised to see a criminal investigation. I also wouldn't be unhappy to see such an approach. This is such a serious breach of trust that it really shouldn't be taken casually, lest other companies take it as consent to do the same (while fixing the glaring security bug, but keeping the basic premise of hijacking traffic for profit). If Lenovo doesn't go home thoroughly bloody from this fight (figuratively speaking), then they didn't get what they deserve, and it's likely we will be dealing with it again from them or another unscrupulous company in a few short months or years. It wasn't so long ago that Sony did something similar. And Samsung, as far as I know is, still shipping TVs that silently spy on their owners. Not a reassuring trend.
- jameshart 12y ago
  Why would this be an issue of privacy laws? It's more just a case of faulty merchandise. The complaint is not that Lenovo shipped adware, it's that they shipped computers which were unable to make secure network connections over HTTPS. That's like selling a car whose brakes don't work, not a privacy issue.
  - mcwidget 12y ago
    "The complaint is not that Lenovo shipped adware, it's that they shipped computers which were unable to make secure network connections over HTTPS" The thing is, the computers are capable of making those https connections. It's that they shipped with extra software on them that gets in the middle of those connections, undermining the security of the laptop in the process, to allow Lenovo and Superfish an extra revenue stream. "That's like selling a car whose brakes don't work, not a privacy issue" That's not how I see it. I think of it like a courier service. You're getting a letter from your bank that's sent through Lenovo Couriers Ltd (or any other courier service) that's sealed and private. Lenovo Couriers Ltd allow (and gain financially, presumably, from allowing) a third-party, who we'll call Superfish to get access to that letter. Superfish open it, read it and see if there's anything in the contents that could allow them to upsell a.n.other product to you. Then, they seal it all up again and deliver it to your door pretending to be from the bank. To me, that's a breach of privacy. Not sure I agree with a lawsuit here though. I'd be happy to see AV firms rate all these types of applications as spyware / PUPs and get rid of them accordingly.
elcct 12y ago
If it was inserting adverts into 3rd party websites I think those websites could sue Lenovo for stealing their advertising space, no?
- mcwidget 12y ago
  This is a valid point. However, technically, nothing is changing on the third party site. Those sites are changed locally on the user's laptop. I don't think that's much different from something like AdBlock. I'm not sure there's much any third party site could do about this.
deleted 12y ago
[deleted]
smoyer 12y ago
"The software plugs product recommendations into search results" One of the most interesting parts of this whole debacle is that what the software does is so far removed from the description of the company's software.
Tharkun 12y ago
I don't think "snafu" quite cuts it. This is a fuckup of epic proportions. They screwed up quite badly by installing this crap and then made it worse by lying about it and pretending that it's not a security issue ...
_pmf_ 12y ago
If Microsoft had any residues of a spinal cord, they should react with a steep increase in license fees for Lenovo, otherwise it's setting a precedent that any vendor can mess with OS internals as they like.
- mcintyre1994 12y ago
  Wouldn't this trigger antitrust craziness if framed as an increased license fee for their choice of pre-installed programs?
- LLWM 12y ago
  Fining vendors for which software they choose to bundle is a terrible precedent to set and a terrible idea in general. Firefox uses its own cert store too.
rayiner 12y ago
Proving damages will be a major hurdle in this case. The LinkedIn data breach lawsuit, which pertained to the 2012 compromise of 6.5 million user passwords because the company didn't salt stored passwords, was dismissed because the plaintiffs couldn't prove any concrete damages from the password disclosures: https://nakedsecurity.sophos.com/2013/03/08/linkedin-lawsuit-data-breach https://nakedsecurity.sophos.com/2013/03/08/linkedin-lawsuit.... A related LinkedIn lawsuit, based on California consumer protection law, did go forward and end up settling, though for a very small sum. The theory in that case was that LinkedIn advertised that they used "industry standard security" in their privacy policy, and that people wouldn't have purchased Premium had they known that LinkedIn ignored industry-standard practices like salting their passwords. But only about 20,000 people actually read the privacy policy, meaning that damages were fairly nominal. So are there any damages to support a class action lawsuit here? Did anyone in fact get their PC's compromised as a result of the pre-installed software? It seems like Windows Defender has been removing the software within a few days after the vulnerability was disclosed. Business users might have a stronger case based on their costs of having to remove the software and check that nothing was compromised as a result. But they probably didn't buy the consumer-grade Lenovos this was installed on in the first place.
- ptaipale 12y ago
  Domestic users also have to spend effort to check that nothing was compromised by this malware. That is in fact quite hard, and people will spend a substantial amount of time on it.
- ihnorton 12y ago
  Couldn't this be considered tortuous misrepresentation? Then the "damages" would be the full value of each laptop purchased.
- pbhjpbhj 12y ago
  In the corresponding criminal case, as this is clearly in breach of 18 USC 1030 (eg a(2)(C), https://www.law.cornell.edu/uscode/text/18/1030#a https://www.law.cornell.edu/uscode/text/18/1030#a) couldn't the court require reparations be made? Presumably anyone with a computer with spyware can get their money back under consumer protection laws as a bare minimum? USA law really can't consider that there should be no compensation if a company secretly MitM people's bank transactions as long as there is no provable financial damages, can it? Cost of replacing the computer is an actual damage as is administration of that. Lenovo should also be liable for costs of having a financial audit (to make sure no breeches have followed the MitM of banking transactions) and cost of a full security audit of any computer equipment connected that might also be affected. Plus the cost of changing all passwords used on the computer. The need to get these done is actual damage, the payout should be predicated on costs that reasonably are incurred to recover from the tortuous actions (that also means poor people don't get stiffed). IMO punishment for this sort of contemptuous action by corporations should be of the order that threatens to shut down the company. Like the average of all profits from the past 5 years is taken and a fine is levied to that amount and paid in to the public purse. Each customer's purchases should be refunded in full and paid damages as above and paid compensation. The FBI should be at Lenovo headquarters now taking copies of hard-drives so they can put the directors responsible in court to answer for this crime. AFAIK Superfish can be charged too under supply clauses of 18 USC 1030. This wasn't an accident. It didn't require someone else to commit a crime to become a problem, LinkedIn were negligent but this action by Lenovo's directors was a wilful criminal act; it's nothing like the LinkedIn breach. LinkedIn did the equivalent of leaving your details open in a file on their desk, but only using a Yale on the door so that someone was able to break in and get your details. Lenovo have done the equivalent of breaking in to your home, finding your files marked "private", copying them and then posting them in public so that everyone can get them. Sure criminals may not have read the details about your bank accounts or whatever but that making them available was OK.
derekp7 12y ago
I see a lot of calls for punishing Lenovo over this. However, I'd like to see a few more facts established before getting out the pitchforks. First, did Lenovo commission the writing of Superfish, or did Superfish approach Lenovo (or most likely their marketing dept) with a request to be included? Do vendors normally perform a full security audit of programs they include? Is there an expectation that they would give closer scrutiny to smaller outfits vs. top tier software vendors? Also, is the bulk of the outrage over this incident due to the fact that Superfish serves no purpose that is in the interest of the users (i.e., its whole reason for being is to spam users with advertisements)? In other words, lets say that instead of adware, what if they included a malware detector that used the same https busting trick, yet was just as poorly designed (leaving the private key exposed) -- would there be just as much call for lawsuits and boycotts then?
- z92 12y ago
  First, did Lenovo commission the writing of Superfish, or did Superfish approach Lenovo (or most likely their marketing dept) with a request to be included? Lenovo can go sue Superfish all they want to coverup their expenses. Let the court figure out who cheated whom in a three way lawsuit.
- IgorPartola 12y ago
  I think the court case will answer all of these questions for you. Whether Lenovo is guilty or innocent here, it'd be great to establish a precedent to protect consumers from this type of thing.
- cplease 12y ago
  > Do vendors normally perform a full security audit of programs they include? Is there an expectation that they would give closer scrutiny to smaller outfits vs. top tier software vendors? OEMs absolutely should own up to responsibility for the crapware they load on their boxes. Saying "it wasn't built in-house" makes about as much sense as an automaker washing its hands of the airbags or other critical parts in the cars they build. As for how deep of an audit, Komodia's own description of their product should have raised massive alarm bells. Anytime I see websites rewritten without my permission I get incredibly spooked, and that's when it's just HTTP over a network. Intercepting SSL/TLS is just not something any OEM should ever contemplate loading on a consumer machine. It's willful recklessness and engineering malpractice of the worst kind.
rebootthesystem 12y ago
This is the reason for which we have always done clean OS installs on any Windows machine we buy (mostly just laptops as every single desktop we have was self-built). It is unfortunate that the PC world hasn't shaken off this practice of adding crapware to store-bought machines. Microsoft could bring this into the realm of the sensible by adding a clause in their licencing agreement that requires a clean install and allows a single popup that prompts the user for authorization to install various add-ons along with full disclosure of their intent and function. In other words, "Welcome to your new Windows N PC. Here's the crap you can choose to install and what it does." If the user selects "NO" everything is deleted and you get an absolutely clean OS install. That would be fair. Give OEM's an opportunity to make some money and users the ability to purchase potentially useful stuff during first power-up. The point is to give users full control of the machine they just purchased and not be surprised with crapware they were not looking for.
ytdht 12y ago
not that I approve of this bandit behavior, but they could have injected ads using a browser extension without screwing with certificates, no?

237 points by r721 12y ago

While this makes for good copy I find it difficult to believe anyone could prove actual harm from the installation. I am not a lawyer so I certainly may have missed a big chunk of commercial law but the only thing I could find was would be around incidental damages which no doubt are expressly disclaimed and agreed to by buyers of the gear (software always disclaims all warranties). So these plaintiffs would seem to have two very large hurdles, one to prove some actual damage, and two to prove some sort of liability even if there was damage. When I first heard about Komodia it seemed pretty clear to me that anyone who employed their software was just asking for trouble. That advice about "Imagine this was on the front page of the NY Times" was pretty helpful.

logn 12y ago
Lenovo earns $600M/yr. Regardless of how small the damages are, the punitive damages if awarded would be in context of earnings, the severity of the situation, and what it would take to effectively punish them.
rdtsc 12y ago
From what I understand in individual "hacking" cases just circumventing the security and accessing data without copying/selling it would be enough to get someone in trouble. It is at least nice to fantasize how large companies would be held to such "standards" as well. In a civil cases I also wonder if banks, governments or other large institution would be able to file lawsuits as well, claiming perhaps that breaches that have occurred recently occurred because their clients/workers had been unknowingly running one of the this Komodia software installed by Lenovo.
- 7952 12y ago
  I wonder if the DMCA anti-circumvention provisions could be used?
exogen 12y ago
I'm wondering if charges of criminal negligence come into play (1) only for cases of physical harm (all the examples on Wikipedia are people dying but I don't see why that would be necessary) and (2) only if actual harm comes to pass. If not, some kind of negligence certainly seems plausible to me.
- dredmorbius 12y ago
  There's a lot in the Superfish / Lenovo / Komodia spyware which seems violates Federal law in the US and the California Penal Code. Specifically: 18 USC 1030 http://www.law.cornell.edu/uscode/text/18/1030 http://www.law.cornell.edu/uscode/text/18/1030 In part: a) Whoever ... (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (A) information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602 (n) [1] of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); (B) information from any department or agency of the United States; or (C) information from any protected computer; California's statute (applicable to Superfish) is CPC 502 http://www.leginfo.ca.gov/cgi-bin/displaycode?section=pen&group=00001-01000&file=484-502.9 http://www.leginfo.ca.gov/cgi-bin/displaycode?section=pen&gr... The statute's verbose, but much of the following looks promising: ------------------------------------- (c) Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense: (1) Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data. (2) Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network. (3) Knowingly and without permission uses or causes to be used computer services. (4) Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network. (5) Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network. (6) Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section. (7) Knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network. (8) Knowingly introduces any computer contaminant into any computer, computer system, or computer network. (9) Knowingly and without permission uses the Internet domain name or profile of another individual, corporation, or entity in connection with the sending of one or more electronic mail messages or posts and thereby damages or causes damage to a computer, computer data, computer system, or computer network. ------------------------------------- I'd say the US and CA AGs should be reviewing relevant statutes and priming action.
DanBC 12y ago
People have to remove the software and the certificate. That takes time, and costs money, and so bundling the software causes harm.
belorn 12y ago
In the early days, damages was counted based on engineers time to investigate, clean and fix the computer intrusion. Say the time to remove the adware cost 2hrs, 4hrs time spent to report a compromised credit card as a result of MiTM connection and get a new one. If its a work computer, add an addtional 48hrs to handle the potential of compromised work documents and emails, then the damages count can go quite high. It depend on the specifics that the person arguing for damages provides to the court. But to my knowledge, the laws around computer crime was mostly changed from civil to criminal in order to address the question of damages.
- LLWM 12y ago
  Unlikely to be relevant here, then. Any business customers would likely have been buying Thinkpads, which were unaffected, and using their own images, not the ones with Lenovo's bundled crapware.
  - ashearer 12y ago
    Then there are employees who use their home laptops to connect to their secure enterprise email portal...
easytiger 12y ago
Cost of re-mediation is one

dredmorbius 12y ago

Plaintiff Bennett will find strong support for her "spyware" claim from the US-CERT security advisory over the Superfish / Lenovo / Komodia spyware. As that's precisely the language that the US Government advisory used: https://www.us-cert.gov/ncas/alerts/TA15-051A https://www.us-cert.gov/ncas/alerts/TA15-051A "Starting in September 2014, Lenovo pre-installed Superfish VisualDiscovery spyware on some of their PCs. However, Superfish was reportedly bundled with other applications as early as 2010. This software intercepts users’ web traffic to provide targeted advertisements. In order to intercept encrypted connections (those using HTTPS), the software installs a trusted root CA certificate for Superfish. All browser-based encrypted traffic to the Internet is intercepted, decrypted, and re-encrypted to the user’s browser by the application – a classic man-in-the-middle attack. Because the certificates used by Superfish are signed by the CA installed by the software, the browser will not display any warnings that the traffic is being tampered with. Since the private key can easily be recovered from the Superfish software, an attacker can generate a certificate for any website that will be trusted by a system with the Superfish software installed. This means websites, such as banking and email, can be spoofed without a warning from the browser." (Emphasis added.)

ghshephard 12y ago

As much as I dislike class action law-suit trolling - I'll make an exception when it comes to multi-billion dollar companies installing spyware as part of their bloat-ware add-ons, particularly when it injects MitM attacks on the browsers SSL links, particularly when it does so in a way that jeopardizes the data confidentiality/integrity of individuals trying to use that computer. Ideally, the next time a laptop/desktop vendor is looking at the bloatware they are going to load onto a system, they'll do a cost-benefit analysis against the (potential) punitive damages associated with a lawsuit, and decide not to install the stuff. I'm willing to pay the extra $0.65 for the laptop (or whatever tiny amount the vendors are paid to include this crud) in order to avoid that sort of exposure, I suspect most consumers (these days) are as well.

skuhn 12y ago
I don't see this suit as trolling. There exists a large group of people who were sold a product which did not perform its primary function of "doing what its owner told it to do". It turns out that this was intentional on the part of the manufacturer. The nature of the problem is such that returning the product for a refund will not suffice, so the consumers should sue. The most effect way to handle a large body of plaintiffs against a single defendant is with a class action suit. Lenovo will inevitably settle or go to trial and be found guilty, there is no other possible outcome. I personally hope that this erases their profits from Superfish, and quite a bit more for the flagrant and willful violation of consumer trust.
- laumars 12y ago
  I think you may have misread the OP because you're tone is one of disagreement while your content is a near-reiteration of his post.
  - skuhn 12y ago
    I'm mainly responding to the first part: "As much as I dislike class action law-suit trolling", as in I don't like their methods but I like the results in this particular situation. I also don't see how I have simply re-iterated the same post, OP and I are looking at different angles of the same issue. Fundamentally I think we do agree: Lenovo did a shitty thing and should pay for it. I simply don't think there is anything wrong with the method or the result here. This is exactly what a class action lawsuit is intended for, there's no trolling about it.

throwawayaway 12y ago

Terrible news for the brand! I really would like to think highly of Lenovo and their products, but sadly they let themselves down time and again. I am hesitant to recommend their non thinkpad models on the basis of their construction - and this just adds to that on a different level.

MisterNegative 12y ago

Lets hope the judge chooses the side of Lenovo, It would be devastating if windows/gnu/linux/apple gets sued every time they have a security flaw in a product.

madaxe_again 12y ago
When were you last sold a machine with Linux and spyware pre-loaded? Right, never.
- MisterNegative 12y ago
  Ubuntu
  - iopq 12y ago
    Which is why people shouldn't use Ubuntu and vendors shouldn't pre-install it.
  - skuhn 12y ago
    The difference between Lenovo's use of Superfish and Ubuntu providing anonymized search data to Amazon is night and day in terms of "spyware". I don't like either, but Lenovo's actions were negligent to the point where they have exposed themselves to a justified lawsuit -- Ubuntu did not.
  - madaxe_again 12y ago
    You bought a machine with Ubuntu pre-loaded?
    - iagooar 12y ago
      Does it look strange to you? Have seen this a lot these days, at least in the EU.
    - dagw 12y ago
      Not personally, but it's not like they're that hard to find.

bradleyjg 12y ago

My guess is this is settled quickly: a few million for the attorneys, a few thousand for the lead plaintiff, and either a coupon for each of the class members or nothing at all (cy pres).

joosters 12y ago
A class action that it settled quickly? Do they exist?
rayiner 12y ago
Appellate courts have been cracking down on cy pres awards recently: http://www.forbes.com/sites/wlf/2014/11/26/seventh-circuit-continues-scrutiny-of-class-action-settlements-and-cy-pres http://www.forbes.com/sites/wlf/2014/11/26/seventh-circuit-c.... As the Seventh Circuit recently clarified in overturning an approved settlement, a cy pres award is only proper if it's impractical to find and compensate the class members directly. Here, there will be sales records to allow easy identification of affected purchasers. That aside, a permanent injunction and a coupon would be a reasonable result here. Civil lawsuits aren't intended to punish people, they're intended to compensate people for their injuries. Who was actually harmed here?
- bradleyjg 12y ago
  These type of class actions do consumers more harm than good. The exorbitant legal fees are ultimately reflected in prices. If there's wrongdoing with extremely diffuse consequences, that's what the government with its GS scale attorneys are for. Lawsuits, like email marketing, should be opt-in not opt-out.
  - rayiner 12y ago
    > The exorbitant legal fees are ultimately reflected in prices. Prices are set by supply and demand. If companies had the market power to raise prices to pass on the costs of defending class action lawsuits, they would do so with or without the lawsuit.

belorn 12y ago

Why is it called a snafu when a large international company installs malware into customers devices, and a cyber attack if its the Russian mafia? The mafia might also use stronger attacks than just installing adware, but adware is still one of the more common way binaries are infected with malware. It would be interesting to hear from a anti-virus company on how much resources is spent yearly on adware research.

tragic 12y ago
"situation normal": OEMs looking for a way to make a quick greasy buck. "All fked up": self-explanatory. Not "cyber-attack": despite conspiracy theories I've heard about the Chinese government, my belief is that the intent behind this debacle was the aforementioned quick greasy buck, not backdooring users' computers for subsequent criminal or military exploitation. It's the distinction between murder and manslaughter.
- belorn 12y ago
  It is most likely a quick greasy buck, but I would guess that many entry level criminals start by infecting binaries with adware and then spread them through download sites. I would not be surprised if a significant portion of revenue for the Russian mafia does come from adware, just because its so easy to do and has almost no risk associated with it. This is why I suspect the police would call it a cyber-attack if they busted a ring that earned money this way. A computer security researchers might find a distinction between a trojan, a virus, and adware, which is why I wondered how much resources a anti-virus company spends on adware alone. That number would provide a good hint as to the seriousness of such malware.
  - jameshart 12y ago
    The problem with this software is, sadly, not that it was adware at all, but that it was adware which contained a critical security flaw that compromised the computers Lenovo was selling. If Lenovo had sold the machines with secure adware, there'd be no real problem.
12y ago

DanBC 12y ago

I'm kind of surprised that superfish (and similar) products are legal. I don't understand why someone would willingly install such software. The reasons the software makers list are deceptive.

louhike 12y ago

A little off topic: Komodia (the company behind a part of the technology used for Superfish) is currently facing a DDOS (http://www.komodia.com/ http://www.komodia.com/)

ptaipale 12y ago
Or that is what they say. I don't expect they are facing a real DDOS, they are just facing so many embarrassing questions that it is convenient to call the flood a DDOS.

SwellJoe 12y ago

I would expect even more aggressive approaches in nations with better privacy protections than the US. If systems effected by this were sold in Sweden or Germany or other places with relatively strong privacy laws I would not be surprised to see a criminal investigation. I also wouldn't be unhappy to see such an approach. This is such a serious breach of trust that it really shouldn't be taken casually, lest other companies take it as consent to do the same (while fixing the glaring security bug, but keeping the basic premise of hijacking traffic for profit). If Lenovo doesn't go home thoroughly bloody from this fight (figuratively speaking), then they didn't get what they deserve, and it's likely we will be dealing with it again from them or another unscrupulous company in a few short months or years. It wasn't so long ago that Sony did something similar. And Samsung, as far as I know is, still shipping TVs that silently spy on their owners. Not a reassuring trend.

jameshart 12y ago
Why would this be an issue of privacy laws? It's more just a case of faulty merchandise. The complaint is not that Lenovo shipped adware, it's that they shipped computers which were unable to make secure network connections over HTTPS. That's like selling a car whose brakes don't work, not a privacy issue.
- mcwidget 12y ago
  "The complaint is not that Lenovo shipped adware, it's that they shipped computers which were unable to make secure network connections over HTTPS" The thing is, the computers are capable of making those https connections. It's that they shipped with extra software on them that gets in the middle of those connections, undermining the security of the laptop in the process, to allow Lenovo and Superfish an extra revenue stream. "That's like selling a car whose brakes don't work, not a privacy issue" That's not how I see it. I think of it like a courier service. You're getting a letter from your bank that's sent through Lenovo Couriers Ltd (or any other courier service) that's sealed and private. Lenovo Couriers Ltd allow (and gain financially, presumably, from allowing) a third-party, who we'll call Superfish to get access to that letter. Superfish open it, read it and see if there's anything in the contents that could allow them to upsell a.n.other product to you. Then, they seal it all up again and deliver it to your door pretending to be from the bank. To me, that's a breach of privacy. Not sure I agree with a lawsuit here though. I'd be happy to see AV firms rate all these types of applications as spyware / PUPs and get rid of them accordingly.

elcct 12y ago

If it was inserting adverts into 3rd party websites I think those websites could sue Lenovo for stealing their advertising space, no?

mcwidget 12y ago
This is a valid point. However, technically, nothing is changing on the third party site. Those sites are changed locally on the user's laptop. I don't think that's much different from something like AdBlock. I'm not sure there's much any third party site could do about this.

deleted 12y ago

[deleted]

smoyer 12y ago

"The software plugs product recommendations into search results" One of the most interesting parts of this whole debacle is that what the software does is so far removed from the description of the company's software.

Tharkun 12y ago

I don't think "snafu" quite cuts it. This is a fuckup of epic proportions. They screwed up quite badly by installing this crap and then made it worse by lying about it and pretending that it's not a security issue ...

_pmf_ 12y ago

If Microsoft had any residues of a spinal cord, they should react with a steep increase in license fees for Lenovo, otherwise it's setting a precedent that any vendor can mess with OS internals as they like.

mcintyre1994 12y ago
Wouldn't this trigger antitrust craziness if framed as an increased license fee for their choice of pre-installed programs?
LLWM 12y ago
Fining vendors for which software they choose to bundle is a terrible precedent to set and a terrible idea in general. Firefox uses its own cert store too.

rayiner 12y ago

Proving damages will be a major hurdle in this case. The LinkedIn data breach lawsuit, which pertained to the 2012 compromise of 6.5 million user passwords because the company didn't salt stored passwords, was dismissed because the plaintiffs couldn't prove any concrete damages from the password disclosures: https://nakedsecurity.sophos.com/2013/03/08/linkedin-lawsuit-data-breach https://nakedsecurity.sophos.com/2013/03/08/linkedin-lawsuit.... A related LinkedIn lawsuit, based on California consumer protection law, did go forward and end up settling, though for a very small sum. The theory in that case was that LinkedIn advertised that they used "industry standard security" in their privacy policy, and that people wouldn't have purchased Premium had they known that LinkedIn ignored industry-standard practices like salting their passwords. But only about 20,000 people actually read the privacy policy, meaning that damages were fairly nominal. So are there any damages to support a class action lawsuit here? Did anyone in fact get their PC's compromised as a result of the pre-installed software? It seems like Windows Defender has been removing the software within a few days after the vulnerability was disclosed. Business users might have a stronger case based on their costs of having to remove the software and check that nothing was compromised as a result. But they probably didn't buy the consumer-grade Lenovos this was installed on in the first place.

ptaipale 12y ago
Domestic users also have to spend effort to check that nothing was compromised by this malware. That is in fact quite hard, and people will spend a substantial amount of time on it.
ihnorton 12y ago
Couldn't this be considered tortuous misrepresentation? Then the "damages" would be the full value of each laptop purchased.
pbhjpbhj 12y ago
In the corresponding criminal case, as this is clearly in breach of 18 USC 1030 (eg a(2)(C), https://www.law.cornell.edu/uscode/text/18/1030#a https://www.law.cornell.edu/uscode/text/18/1030#a) couldn't the court require reparations be made? Presumably anyone with a computer with spyware can get their money back under consumer protection laws as a bare minimum? USA law really can't consider that there should be no compensation if a company secretly MitM people's bank transactions as long as there is no provable financial damages, can it? Cost of replacing the computer is an actual damage as is administration of that. Lenovo should also be liable for costs of having a financial audit (to make sure no breeches have followed the MitM of banking transactions) and cost of a full security audit of any computer equipment connected that might also be affected. Plus the cost of changing all passwords used on the computer. The need to get these done is actual damage, the payout should be predicated on costs that reasonably are incurred to recover from the tortuous actions (that also means poor people don't get stiffed). IMO punishment for this sort of contemptuous action by corporations should be of the order that threatens to shut down the company. Like the average of all profits from the past 5 years is taken and a fine is levied to that amount and paid in to the public purse. Each customer's purchases should be refunded in full and paid damages as above and paid compensation. The FBI should be at Lenovo headquarters now taking copies of hard-drives so they can put the directors responsible in court to answer for this crime. AFAIK Superfish can be charged too under supply clauses of 18 USC 1030. This wasn't an accident. It didn't require someone else to commit a crime to become a problem, LinkedIn were negligent but this action by Lenovo's directors was a wilful criminal act; it's nothing like the LinkedIn breach. LinkedIn did the equivalent of leaving your details open in a file on their desk, but only using a Yale on the door so that someone was able to break in and get your details. Lenovo have done the equivalent of breaking in to your home, finding your files marked "private", copying them and then posting them in public so that everyone can get them. Sure criminals may not have read the details about your bank accounts or whatever but that making them available was OK.

derekp7 12y ago

I see a lot of calls for punishing Lenovo over this. However, I'd like to see a few more facts established before getting out the pitchforks. First, did Lenovo commission the writing of Superfish, or did Superfish approach Lenovo (or most likely their marketing dept) with a request to be included? Do vendors normally perform a full security audit of programs they include? Is there an expectation that they would give closer scrutiny to smaller outfits vs. top tier software vendors? Also, is the bulk of the outrage over this incident due to the fact that Superfish serves no purpose that is in the interest of the users (i.e., its whole reason for being is to spam users with advertisements)? In other words, lets say that instead of adware, what if they included a malware detector that used the same https busting trick, yet was just as poorly designed (leaving the private key exposed) -- would there be just as much call for lawsuits and boycotts then?

z92 12y ago
First, did Lenovo commission the writing of Superfish, or did Superfish approach Lenovo (or most likely their marketing dept) with a request to be included? Lenovo can go sue Superfish all they want to coverup their expenses. Let the court figure out who cheated whom in a three way lawsuit.
IgorPartola 12y ago
I think the court case will answer all of these questions for you. Whether Lenovo is guilty or innocent here, it'd be great to establish a precedent to protect consumers from this type of thing.
cplease 12y ago
> Do vendors normally perform a full security audit of programs they include? Is there an expectation that they would give closer scrutiny to smaller outfits vs. top tier software vendors? OEMs absolutely should own up to responsibility for the crapware they load on their boxes. Saying "it wasn't built in-house" makes about as much sense as an automaker washing its hands of the airbags or other critical parts in the cars they build. As for how deep of an audit, Komodia's own description of their product should have raised massive alarm bells. Anytime I see websites rewritten without my permission I get incredibly spooked, and that's when it's just HTTP over a network. Intercepting SSL/TLS is just not something any OEM should ever contemplate loading on a consumer machine. It's willful recklessness and engineering malpractice of the worst kind.

rebootthesystem 12y ago

This is the reason for which we have always done clean OS installs on any Windows machine we buy (mostly just laptops as every single desktop we have was self-built). It is unfortunate that the PC world hasn't shaken off this practice of adding crapware to store-bought machines. Microsoft could bring this into the realm of the sensible by adding a clause in their licencing agreement that requires a clean install and allows a single popup that prompts the user for authorization to install various add-ons along with full disclosure of their intent and function. In other words, "Welcome to your new Windows N PC. Here's the crap you can choose to install and what it does." If the user selects "NO" everything is deleted and you get an absolutely clean OS install. That would be fair. Give OEM's an opportunity to make some money and users the ability to purchase potentially useful stuff during first power-up. The point is to give users full control of the machine they just purchased and not be surprised with crapware they were not looking for.

ytdht 12y ago

not that I approve of this bandit behavior, but they could have injected ads using a browser extension without screwing with certificates, no?