PSA: Lenovo Computers now ship with Nasty Adware

[aPanzerIV]

I use Tweakhound as my home page, and while the man hasn't been as active or intuitive as he used to, he still posts useful things: https://tweakhound.com/

Today it cropped up that Lenovo computers were shipped with nasty adware preinstalled:
http://arstechnica.com/security/2015/02 ... nnections/

And Lenovo's response did not go undocumented:
http://arstechnica.com/security/2015/02 ... s-spyware/

I think the fact that Lenovo now disregardes our personal privacy and security is a major issue, and the whole brand loyalty thing is something we need to start thinking twice about. If they did this to software, is the hardware much safer?

Thoughts? I hate Lenovo rage? Love pancakes? Let's hear it!

[JaneL]

Superfish was not preinstalled on ThinkPads, so...

[exTPfan]

See: http://forum.thinkpads.com/viewtopic.php?f=58&t=116934

[JaneL]

Saw that already. Still, wasn't installed on ThinkPads, so....

[nikki605]

You can test here to see if your Lenovo has Superfish

https://filippo.io/Badfish/

I have a Lenovo T410 laptop and an M83 desktop. I used the link to test both machines and neither one had Superfish installed.

[brchan]

The majority of these issues happen on lenovo's consumer laptops, not the business ones, so it doesn't bother me that much. Hopefully Thinkpads will stay clean.

[ajkula66]

The majority of these issues happen on lenovo's consumer laptops, not the business ones, so it doesn't bother me that much. Hopefully Thinkpads will stay clean.

The entire scenario bothers me as a matter of sheer principle.

I don't care if we're discussing a $249 netbook, or a $3K premium business model.

Why on Earth would anyone bundle such junk in the first place?

[Qing Dao]

The majority of these issues happen on lenovo's consumer laptops, not the business ones, so it doesn't bother me that much. Hopefully Thinkpads will stay clean.

The entire scenario bothers me as a matter of sheer principle.

I don't care if we're discussing a $249 netbook, or a $3K premium business model.

Why on Earth would anyone bundle such junk in the first place?

A couple of things about this fiasco seem rather worrisome. First is that it is hard to say that this was just an honest mistake. I just can't think of any good excuse for willfully installing a back door that is open to anybody to see "encrypted" network traffic. I also can't think of any reason for how this was able to go from development to infecting computers without anyone at Lenovo raising any eyebrows. I keep coming back to think that there was malicious intent somewhere along the line.

Second is that Lenovo tried downplaying the issue by saying direct lies about the security issue. They said that their internal investigation determined that there was no security risk. Hello! Within hours of the news coming out, people had shown how easy it is to use this back door to read encrypted network traffic. Not only is there a back door, but it was left wide open. If that isn't a security risk, I don't know what is. Strike two for Lenovo...

[brchan]

Now that you mention it, this issue is quite concerning in ethics. I wonder if Lenovo or any other companies have put spyware or backdoors at the firmware level.

[rumbero]

I wonder if Lenovo or any other companies have put spyware or backdoors at the firmware level.

Ever heard of Computrace/Lojack? I would much prefer to have a BIOS which does not have this (and possibly other undocumented) stuff embedded, waiting for it to be remotely activated by some external entity.

At a bare minimum, the manufacturers should provide downloadable BIOS variants without such low level embedded spying software, in order to overwrite and thus eliminate it once and for all. Currently the only possibility to get rid of such stuff consists in overwriting the official BIOS with something like Coreboot or Libreboot.

While also the source code is available, only a very limited number of Thinkpads are supported by Coreboot/Libreboot, and the whole process of completely replacing the Lenovo BIOS is not for the faint of heart.

[exTPfan]

Why on Earth would anyone bundle such junk in the first place?

Money. It would be interesting to know for how much Lenovo sold out the security of its customers.

[twistero]

I can certainly see the initial bundling of adware as an honest mistake - "honest" in the sense that some higher-level management decided to bundle the Superfish adware for the money alone and not for intentionally compromising security, because they didn't know the security of said adware is such crap. After all, a piece of software that transparently MITM HTTPS traffic can be written in a secure manner so that it cannot be exploited en masse like this, simply by generating the root CA certificate per machine.
It's the subsequent downplaying of security risks, the "internal investigation" and all that strikes me as unethical.

I will be wiping the hard drive of every brand name Windows PC and reinstalling the operating system from scratch in the future. Fortunately, Win8 upwards make this vastly simpler than Win7 and below.

[JalopyBob]

Superfish on Lenovos just illustrates that Lenovo in not an honorable company. How sad.
I wonder what they would put in my bbq fried rice if they had the opportunity?
A.M.F. Lenovo. You have tainted a once great line of computers.