Lenovo caught installing adware on new computers

[RoasterMen]

It looks like Lenovo has been installing adware onto new consumer computers from the company that activates when taken out of the box for the first time.

The adware, named Superfish, is reportedly installed on a number of Lenovo’s consumer laptops out of the box. The software injects third-party ads on Google searches and websites without the user’s permission.


More here: Lenovo Caught Installing Adware On New Computers

 

[whs]

Unbelievable. We'll have to put Lenovo on the blacklist. But that seems to be the trend of the times. Everybody does what they want without asking the customer. I hope someone goes after them - e.g. the EU is good at customer protection.

 

[Indianatone]

Superfish: Lenovo ditches adware - but that doesn't fix SSL megavuln – researcher



From The Register:
Superfish: Lenovo ditches adware - but that doesn't fix SSL megavuln â

 

[Borg 386]

Just another attempt by a company trying to grab as much user data as possible to sell to the highest bidder. And putting people at risk while denying it

Users always disliked Superfish. As early as September 2014, Lenovo buyers were complaining about Superfish's fishy search results. Lenovo, however, didn't admit to installing Superfish, and its problems, until January 2015.

I've noticed an escalation in objects needing to be allowed for a page to operate correctly. I noticed this over the past few months, based on my usage of NoScript. Pages that only needed maybe 1 or 2 scripts allowed a few months ago, now won't function properly without several more or all scripts allowed. And it's not just a few sites, it's a wide variety of pages ranging from weather sites to news sites to entertainment sites. Seems like everyone's out to grab your data nowadays......

How to remove Superfish malware from Lenovo PCs

How to find out if your Lenovo is infected with the Superfish adware and remove it

How to find out if your Lenovo is infected with the Superfish adware and remove it - CNET

 

[Arelem]

Unbelievable. We'll have to put Lenovo on the blacklist. But that seems to be the trend of the times. Everybody does what they want without asking the customer. I hope someone goes after them - e.g. the EU is good at customer protection.

Its just the consumer Lenovo line, not the ThinkPad/Centre computers. Not sure why anyone would want to buy anything but Think stuff from Lenovo, other than on price point.

 

[carwiz]

Before IBM sold out, we use to call them "StinkPads". I don't think they are any better under a new brand.

 

[ThrashZone]

I doubt any manufactures are any better they all do it.
The worst usually is the pre-installed security.
I remember first starting mine the shear number of popups to register was unbelievable
Thought it was a e-bomb went off

 

[whs]

I doubt any manufactures are any better they all do it.
The worst usually is the pre-installed security.
I remember first starting mine the shear number of popups to register was unbelievable
Thought it was a e-bomb went off

That 3 months trial for Norton or McAfee was very useful in the Vista days because Vista had no real AV program of it's own. At least Newbies were made aware of the fact that they needed some sort of AV program.

Nowadays though where W8.1 and W10 comes with a pretty good MSE/Defender, this practice is no more useful. If the user does nothing, there is still a reasonable level of protection.

Now they should put more emphasis on imaging and install 3 month trials of Macrium or Paragon because the default Windows imaging is too weak in function and reliability.

 

[Lady Fitzgerald]

Looks like I'm going to luck out. Based on the list Lenovo released, none of the three notebooks I have are affected. The one I'm currently using (B590) when traveling I had already checked before the list came out; it isn't on the list and it also checked out ok. My older notebook, a G510, is on the list but I bought that in June of 2013 and, according to Lenovo, they didn't start installing the fishy malware until mid-2014. I haven't bothered to dig it out to check it yet but eventually will just to be on the safe side. I also bought a B50, which also isn't on the list, back in November but haven't even fired that one up yet (I was out of town for two months right after getting it and have been in catch-up mode ever since I got back) but once I get around to setting it up, I'll check it out just to be safe.

Window's Defender will now remove the fishy program and the certificate it generates but most AVs block Defender.

 

[indianacarnie]

While Lenovo doesn't really make the types of Laptops I use, I'll be buying a new one in the next 6 months or less. (Digital Storm or IBuyPower have the lead at the moment! This is just a reminder to doublecheck everything .....right out the box!

 

[Layback Bear]

To my understanding Lenove is going to figure out a way of stopping the popups but they still want the program installed to spy on the owner.
How many new owners will even know the spyware is installed without popups reminding them.
Which is exactly what Lenove wants.

 

[lehnerus2000]

Designed to thwart script blockers

I've noticed an escalation in objects needing to be allowed for a page to operate correctly. I noticed this over the past few months, based on my usage of NoScript. Pages that only needed maybe 1 or 2 scripts allowed a few months ago, now won't function properly without several more or all scripts allowed. And it's not just a few sites, it's a wide variety of pages ranging from weather sites to news sites to entertainment sites. Seems like everyone's out to grab your data nowadays......

I have noticed this too.
The other day I wanted to view a web comic and I had to allow 150 scripts!

It seems like a huge number of scripts do nothing except call other scripts.
Obviously this is designed to p*** off people who use script blockers.

If your PC gets infected by a dodgy script on a website, you should be able to sue the site's owner(s).

Script-based ads should be illegal (i.e. only fixed ads on websites).
All of this tracking should be illegal, unless the user has specifically opted in.

Does the 2nd Amendment allow US citizens to own and deploy software-based "self-defence" weaponry? :devil:

 

[andrew129260]

Nowadays though where W8.1 and W10 comes with a pretty good MSE/Defender, this practice is no more useful. If the user does nothing, there is still a reasonable level of protection...

Not true.

If the trial security software stays installed, windows defender never turns itself on. So the user is still unprotected because the trial deactivates, and no longer gets updates.

You know average users, they don't know they even should remove the trial software, or even know its trial software, Or even know they have it installed. Most people think the antivirus it comes with is for life. Sad but true. Most barely know how to even uninstall a program. Or they buy one and never remove the other antivirus product.


Also, I always clean install windows with every pc I get, so none of this is ever an issue. For average users? Yes. But they are infected already anyway.

Lenovo like every other company is just looking to make a quick buck. Whoops, we didn't know that was there

 

[whs]

Not true.

If the trial security software stays installed, windows defender never turns itself on. So the user is still unprotected because the trial deactivates, and no longer gets updates.

That is why I said:

Nowadays though where W8.1 and W10 comes with a pretty good MSE/Defender, this practice is no more useful.

The OEMs should stop putting the trial AVs on the system and stop confusing the innocent.

Also, I always clean install windows with every pc I get,

In general that is a good idea. I did that once on a Toshibe laptop with a backlit keyboard. After the clean install the backlighting of the keyboard did not work any more and I could not find the driver. Fortunately I had an image to which I could default.

 

[andrew129260]

Agreed.

 

[Callender]

Superfish traced to other apps - not just Lenovo users

On Thursday security researchers warned that an adware program called Superfish, which was preloaded on some Lenovo consumer laptops, opened computers to attack. However, it seems that the same poorly designed and flawed traffic interception mechanism used by Superfish is also used in other software programs.

Superfish vulnerability traced to other apps, too



Suggest checking all installed browsers for the presence of the Superfish MITM Certificates using the tool found here:

Superfish CA + Komodia vulnerability test (updated!)

 

[ThrashZone]

Funny the site has a unsigned security certificate

 

[Callender]

Unsigned security certificate

Funny the site has a unsigned security certificate

I thinks that's by design as part of the test. You are warned not to accept/ approve certificates if asked when running the test. Most likely scenario - if you run the test and the certificate is automatically accepted then you've got a problem.

​

 

[ThrashZone]

So it would seem

 

[Anak]

LastPass also has a checker: https://lastpass.com/superfish/ a little self-serving for LastPass as it asks you to download and use LastPass after your system is clean, but it also has instructions to remove superfish and the certificates. Site is signed/verified by thawte, Inc.

Oh, and about those certificates:

“You can’t just rerun CertMgr.msc directly because that only shows the user account, not the Computer Account cert store. The bad Superfish certificate lives at the Computer Account level,” he explains.

While that won’t remove every directory that Superfish ever inhabited or created, it shouldn’t cause any more dangerous issues. Affected users will also want to check the cache in their browsers for any lingering certificates from Superfish, and remove those as well.

Source and instructions: Want to Remove Superfish From Your Device? Good Luck... | TechBeat

Related:
Microsoft, LastPass and others post solutions to handle Superfish - gHacks Tech News