35 ms·
Class action lawsuit filed against Lenovo over Superfish
- belorn 11y agoGoing through the list of complaints, it really sound as it should have been a criminal procedure, not civil. One then wonder why that isn't the case here.
- michaelhoffman 11y agoIn the U.S., private prosecutions are not usually allowed. Additionally, government officials with prosecutorial authority have some amount of discretion in choosing which cases to prosecute and limited resources that prevent them from prosecuting every possible case. A private citizen cannot force prosecution, no matter how meritorious the case.
- deleted 11y ago[deleted]
- mfisher87 11y agoThis is true, but one still wonders why government officials haven't pursued a criminal case.
- roel_v 11y agoBecause it's such a minor issue.
- jellicle 11y agoHacking several million computers is minor? What qualifies as major, then? The Morris worm infected 2-3 orders of magnitude fewer computers... http://en.wikipedia.org/wiki/Morris_worm http://en.wikipedia.org/wiki/Morris_worm
- deleted 11y ago[deleted]
- tragic 11y agoWell, there are surely more than three orders of magnitude more computers connected to the internet today than the 60,000 Paul Graham reports people guessing at in 1988. Put another way, as dreadful as it is, Superfish was never at risk of partitioning the internet. The harm is restricted to those luckless individuals who purchased a Lenovo laptop in the particular time frame at issue; quite possibly a crime, but not, playing devil's advocate for reluctant prosecutors, a 'something must be seen to be done or I'll be lynched' level crime.
- mfisher87 11y agoUh, why?
- seanp2k2 11y agoConsider what the outcome here would be if, instead of Lenovo expressly doing this, it was a single rogue employee who e.g. Modified the system image used by the factory with the exact same software in the exact same way and took the ad profits. Whatever would happen in that situation should happen here. I would guess prison time would be involved.
- task_queue 11y agoYou do not abuse the user's trust like that.
- rhino369 11y agoOne strategy the DOJ uses is to let a civil case go forward and then piggy back off it. Let the private attorneys do the heavy lifting and then swoop in for an easy victory. Also, the way the law is structured, it's typically easier to get information in a civil suit since defendants have fewer rights.
- neurotech1 11y agoUS Judges in civil cases can be obligated for the court to be informed that a crime has been committed, which is then referred to the prosecuting authority. The prosecuting authority still has discretion and is not forced to prosecute the matter. I found a reference to a case in Utah. http://e-discoveryteam.com/2011/04/10/judge-refers-defendant%E2%80%99s-e-discovery-abuse-to-u-s-attorney-for-criminal-prosecution-of-the-company-and-four-of-its-top-officers/ http://e-discoveryteam.com/2011/04/10/judge-refers-defendant...
- cmattoon 11y agoWith the amount of frivolous cases brought under the Computer Fraud and Abuse Act (http://www.networkworld.com/article/2908555/opensource-subnet/florida-teen-charged-with-felony-hacking-for-using-password-his-teacher-showed-him.html http://www.networkworld.com/article/2908555/opensource-subne...), it'd be nice to see some charges filed for this.
- cmattoon 11y agoOh, look, another one: http://www.pcmag.com/article2/0,2817,2484018,00.asp http://www.pcmag.com/article2/0,2817,2484018,00.asp
- a3n 11y agoIt would seem to be a violation of the DMCA, as it is software preinstalled to allow the eventual side-stepping of the end-user's security measures (using an HTTPS-capable browser). "It also criminalizes the act of circumventing an access control, whether or not there is actual infringement of copyright itself." https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_A... EDIT: Considering the huge number of victims systematically targeted on an ongoing basis, perhaps RICO would apply too. Certainly RICO is brought to bear by prosecutors when trying to intimidate less resourced individuals. https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corrupt_Organizations_Act https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...
- seanp2k2 11y agoIt would make my day to see companies (or the individuals who called for this retarded project) get punished under DMCA / RICO / CFAA. I bet we'd see those repealed real quick due to lobbying pressure if that kind of thing actually worked.
- a3n 11y agoNah, they'd just get revised by Congress, as part of the War on Citizens.
- rhino369 11y agoDoes superfish circumvent copyright media protection? Not really. It's a huge stretch to call https a form of drm.
- Lawtonfogle 11y agoAs big of a stretch as punishing teachers changing question answers under RICO?
- deleted 11y ago[deleted]
- bhartzer 11y agoJust bought a Lenovo laptop over the weekend for my wife. Sounds to me like it's no longer being installed on the laptops, but will check it to make sure Superfish isn't there.
- stanmancan 11y agoI'd format it with a fresh version of whatever OS came on it just to be safe. I actually have always done this when buying pre-built computers just to get rid of all the junk that comes from the manufacturer.
- rplnt 11y agoI wish we had this option for mobile (android) phones which are preloaded with crapware (oftentimes permanently) even more than PCs are.
- JupiterMoon 11y agoWell one can void one's warranty root and install cyanogen mod...
- click170 11y agoOne shouldn't have to void the warranty of one's device to be rid of malicious software.
- esMazer 11y agoand then have it freeze and restart every day -__- (I guess is just my particular experience and might not apply to everyone)
- JupiterMoon 11y agoTo be fair. I didn't do this I'm running what came on it and mine freezes and restarts several times a day anyway...
- rshaban 11y ago"Notably, Lenovo did not preinstall the Superfish program on any of its computer models that were marketed to businesses or more sophisticated computer users." That's a particularly damning accusation.
- davis_m 11y agoNot necessarily. Many of the higher end and business models come without spyware of any kind, not just this particular piece of software.
- danielweber 11y agoYes, when a major company orders 3000+ laptops, they say exactly what they want on them, and that's what they get.
- rdudek 11y agoCouple of things here. Large companies most likely reimage the devices with enterprise license. For example, we order based on hardware configuration. Our company uses HP for everything, so we purchase the business class equipment with 3 year warranty on everything. Also, we don't use the version of Windows that comes with the devices, we reimage all our systems with our own using System Center Configuration Manager.
- ChristianBundy 11y agoI'm curious, are you concerned with the fact that you can't get HP updates after your warranty is up?
- rdudek 11y agoOnly updates we may be concerned for are BIOS ones with our full disk encryption compatibility with Check Point. None of our systems have any HP software so we don't need updates for those. We also control updates like java, flash, and windows ones too via SCCM.
- jakewalker 11y agoThere were a number of lawsuits that were filed against Lenovo as a result of Superfish. I believe the Joint Panel For Multidistrict Litigation will soon (May 28) hear argument about whether and where those cases should be consolidated for pre-trial matters. See: http://www.jpml.uscourts.gov/sites/jpml/files/Hearing%20Order-5-28-15.pdf http://www.jpml.uscourts.gov/sites/jpml/files/Hearing%20Orde...
- rshaban 11y agoI'm pretty curious about who this "Sterling International Consulting Group" suing Lenovo is, their website (http://www.sterling-consulting.com/ http://www.sterling-consulting.com/) 404s...
- stanmancan 11y agoLink works fine for me. "Your source of Microsoft expertise and specialists in Sharepoint"
- verytrivial 11y agoWorks for me too, but I wish it didn't after having that lady walk on the bottom right every time I click a link.
- kabdib 11y agoSharePoint. That explains everrrrything.
- deleted 11y ago[deleted]
- mfisher87 11y ago404 is probably for the best. It's one of those sites that immediately starts playing loud video when you open it. EDIT: omg, it's a unicorn of bad web design. The video loads on every page of this website.
- arenaninja 11y ago> EDIT: omg, it's a unicorn of bad web design. The video loads on every page of this website. I've explained time and time again why this is a bad idea, but some people really want their video on every page..
- mfisher87 11y agoWhat I'm confused about is why anyone needs another human to explain to them that watching the same woman repeating the same verbatim speech in reaction to every user action is stupid.
- lessthunk 11y ago.. reinstall any computer you get from scratch; Firmware Bios spying is of course much harder to get rid from.
- rubbingalcohol 11y agoMany of these computers don't even come with OS reinstallation media. They tend to have recovery partitions on the hard drives which will only restore the computer to its initial spyware-ridden state. I downvoted your comment because of your implication that spyware wouldn't be a problem if only everyone were as sophisticated as you.
- abandonliberty 11y agoYou're setting a good standard for downvote etiquette. It's kind to not leave people guessing and I think it strengthens our community.
- mikeash 11y agoI don't think the comment implies any such thing. Suggesting mitigations for the current state of things doesn't in any way imply acceptance of the current state. At most, it implies resignation.
- tokenizerrr 11y agoYou can just reacquire the installation media from elsewhere and reuse the serial key.
- dagw 11y agoGenerally not. Unless Microsoft has changed their policy, you cannot use an OEM key to install a retail copy of Windows.
- yesplorer 11y agoI was reading HN on mobile but decided to pull my laptop over and upvote you (then comment; can't comment on mobile app) not because I agree with you or agree/disagree with parent comment but because you were highly civilized with your comment and your downvote. You made a counterpoint, you didn't insult (the use of the word 'nonsense' is really common on HN counterpoints), you downvoted, then you explained your reason for the downvote. In all this now flame-wars were set. I hope a lot of us will follow your path and make HN pleasant for everyone. Thank you.
- wehadfun 11y agoSuprise that no market their computers as "crapware free".
- greenjellybean 11y agoI don't buy Apple computers but isn't that a main selling point with osx?
- rdsnsca 11y agoIt is one of the selling points. It has been over 5 years since Apple has sold a computer with any third party software on it.
- mahouse 11y agoOut of curiosity, what 3rd-party sw did Apple bundle over 5 years ago?
- drak0n1c 11y agoJava
- dagw 11y agoApple used to bundle demo apps and games with their computers. I for example remember getting a demo of a Tony Hawk skating game and a couple of other apps with an iBook.
- wiredfool 11y agoOddly enough, I have a fresh install of Os9.2 here, from 2001. It's got IE5, Stuffit Expander, Netscape Communicator 4.7.7, and Outlook Express 5.0.2, and Java.
- NelsonMinar 11y agoDepends on whether you consider iTunes crapware :-)
- patcheudor 11y ago"Additionally, the large security hole created by the Superfish program can easily be breached, because the security key for the single self-signed root certificate used by the Superfish program has been broken and published on the internet. It took one computer security researcher less than 15 seconds on-line to obtain the security key for the Superfish root certificate." It's interesting that they are sticking to the original narrative when the situation was actually far worse as I originally disclosed here on HN & which was later written about by Filippo Valsorda on his blog. Original discovery: https://news.ycombinator.com/item?id=9078536 https://news.ycombinator.com/item?id=9078536 Filippo's blog post: https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/ https://blog.filippo.io/komodia-superfish-ssl-validation-is-...
- kazinator 11y agoThe allegations here are of a criminal nature. If true, people need to go to jail here, in addition to any civil remedies arising out of the class action suit.
- tgbrter 11y agoIs it possible that the "cyber" laws are designed to be effective towards individuals.
- pavel_lishin 11y agoBut corporations are individuals! Could two wrongs make a right?
- seanp2k2 11y agoSo put the corporation in jail; take its personal items and lock them away, don't allow any outside communications except through visits, no access to bank accounts, etc. On a more serious note, what happens to the author[ing company] of the software used to inject ads? http://www.komodia.com/about http://www.komodia.com/about
- anonbanker 11y agoOr, direct 100% of net profits to the state, in order to pay the prisoner's fines. The articles of incorporation should be sufficient to imprison. Think this insane? Look up in rem jurisdiction. You'll see cool lawsuits such as "UNITED STATES V. $50,000 IN CASH". I'd consider that precedent.
- kazinator 11y agoCorporations are not people. They are arrays of people. Specifically, they are C-style arrays of people. In C, if you try to qualify (const or volatile) an array, it's actually the element-type that gets qualified. (The straight syntax doesn't support it at all; the above applies if you try to create an typedef for the array type and then use it as a declaration specifier, side by side with qualifiers.) In the same way that qualifiers on C arrays slide down to the elements, certain attributes, including responsibilities, have to shift from corporations to the member individuals.
- rebootthesystem 11y agoRule #1 of buying any pre-packged Windows computer: Clean install the OS from original MS disks, not from what might come with the computer. If you are running a business the cost is insignificant when compared with the aggravation and risk of crapware. This is also the reason we still build our own desktop computers: You know exactly what's in them, you can service them and generally get more performance and quality per dollar spent.
- seanp2k2 11y agoIt's also amusing to me how many of the people who do this will install Windows from a "cracked" distro, as that is now more secure than what most manufacturers provide out-of-the-box. Sad when random ISO from public torrent tracker is more trustworthy than Official Disk Image from publicly-traded corporation.
- TeMPOraL 11y agoIt's the same as with anti-piracy warnings and ads you can't skip on original movies. The pirates don't have financial incentives to milk you, and they have all the incentives to get the best version working as soon as possible. So that's why you often get better stuff from them than you can buy.
- bradleyjg 11y agoA year or eighteen months from now look for a settlement in the case. Each of the affected class members will be entitled to a $5 discount on an anti-virus product plus up to $25 if they can provide detailed documentation showing actual economic losses. Any money left over after the coupons and payments are made will be given to a charity hand picked by the plaintiff's attorney. There will also be injunctive relief in the form of Lenovo promising never to do it again, seriously this time guys. The representative plaintiffs will each be awarded $5,000. The class attorneys will be awarded $4 million. $750,000 will be set aside to pay a class action settlement processing company which will put up a website, send out notices, and process claims. After a pro-forma hearing a judge will approve the settlement as fair, reasonable, and adequate.
- chime 11y agoAnd through all of this, the Lenovo name will continue to be tarnished. That's where the real damage is.
- mhurron 11y agoIn 18 months no one will remember this. Honestly, corporations face basically no repercussions from customers because of doing stupid or outright malicious things.
- pavs 11y agopeople who actually cared about the superfish incident will remember this, and thats where it counts and where it will hurt. Everyday joe couldn't care less about superfish.
- mhurron 11y agoLenovo doesn't care that your individual security minded person had an issue with it, Lenovo cares that their volume purchasers continue to purchase in volume. They weren't impacted and they don't care. There are basically no long term downsides to Lenovo for doing what they did.
- TEMPLEOS_DEV 11y agoI bought one of the effected laptops back in December. However, I put in a SSD with lunix and never booted into windows first thing when I got it. Lunix Rocks!
- digitalartcrew 11y agoTest
- rhino369 11y agoI wonder how the good the CFAA case will be. The software was pre-installed on the machines. I guess it probably depends on what the user terms were for it. The statue requires "without authorization." I'm surprised there isn't a negligence or products liability claim in here. Because one of the biggest problems, isn't' that they MTTM attacked HTTPS to inject ads, but they did it in a way that was recklessly insecure.
- Tharkun 11y agoCan we also get a class action lawsuit started for their insistence on making keyboards WORSE with every new product release?
- paul_langston 11y agoLaywers in a class-action should have to accept the same currency in the claim as their "clients"--they get a pile of discount vouchers instead of a pile of cash.
- api 11y agoNow can someone please do the same for Oracle and ask.com toolbar?
- superfished 11y agoI purchased a Lenovo laptop in December, and it was one of the ones with SuperFish. They refused to give me a refund, because it was outside of their 30 day refund policy. It would be impossible to get a refund for SuperFish because the info came out in February and they were only infecting systems between September and December. However, there is a happy ending to this story. I went through my credit card company to get a refund, and it was taken care of no problem. The CC company was incredibly responsive and shocked about SuperFish. I'm quite pleased, as SuperFish aside, this is the worst computer I've ever owned (Y50 UHD.)
- walterbell 11y agoYou filed a chargeback against Lenovo and kept the laptop, or returned it? Was the laptop purchased from a dealer or direct?
- superfished 11y agoIt was purchased directly from Lenovo with a Mastercard. I purchased the laptop in early December, though they did not deliver until after Christmas (first strike against Lenovo on this laptop.) The chargeback just went through successfully on Friday. I have not heard anything from Lenovo yet regarding returning the laptop. I can keep you updated on this if you like. The woman at MasterCard was very helpful and knowledgeable. She was surprised about SuperFish, but seemed to understand it. I use the laptop professionally and do systems work, so I explained how I basically could not use the laptop for work and had to spend time double-checking some of the work I had already done for clients. There are also annoying hardware issues with this laptop, various intermittent problems causing crashes. I didn't get into that though, and just stuck with the Lenovo omitting fraud / laptop unusable for work narrative. I always heard good things about Lenovo, but the late delivery, SuperFish, and hardware issues are enough to make me avoid the company like the plague.
- walterbell 11y agoThanks for sharing the details. If enough people do this, it will provide visible feedback to Lenovo. Historically, the Thinkpad brand was a gold standard in business notebooks, but they have sadly devolved into poor followers of Apple. Hopefully the Thinkpad brand can rediscover its innovative roots.
- Double_Cast 11y agoI found this article surprisingly clear. I expected to find an unreadable morass of legalese. Is the ill reputation towards legalese unjustified, or is the clarity of this article uncommon?