Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo Caught Installing Adware on New Computers

thenextweb.com

Post reply on HN
Print view View original

21–30 of 435 posts

Re: Lenovo Caught Installing Adware on New Computers

#21

Post by tedunangst »

kentonv wrote: post #5

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…

Remaining questions: Does the superfish proxy itself check the certificate of the site it's connecting to? One would hope, but that's also a pretty easy thing to screw up.

If it does, does it trust its own cert? Probably (certainly?), but if not, that would leave one in the curious (perverse?) position of being safer by using the proxy. superfish can mitm your connection, but nobody else with the key could.

Re: Lenovo Caught Installing Adware on New Computers

#22

Post by toomuchtodo »

acadien wrote: post #19
faster wrote: post #13

This reinforces my policy of buying laptops with the cheapest drive offered and replacing the drive with an SSD before the first boot. I run Linux anyway, so booting Windows has no value for me.

Can't you just write all 0's to the drive or just reformat it? Genuine question here, why would you need to physically replace the drive to ensure security when you can write to the whole thing?

Would have to re-write/re-flash the firmware as well.

Re: Lenovo Caught Installing Adware on New Computers

#23

Post by viraptor »

acadien wrote: post #19
faster wrote: post #13

This reinforces my policy of buying laptops with the cheapest drive offered and replacing the drive with an SSD before the first boot. I run Linux anyway, so booting Windows has no value for me.

Can't you just write all 0's to the drive or just reformat it? Genuine question here, why would you need to physically replace the drive to ensure security when you can write to the whole thing?

> with the cheapest drive offered and replacing the drive with an SSD

I expect the "cheapest drive" is not an SSD.

Re: Lenovo Caught Installing Adware on New Computers

#26

Post by michaelelliot »

Just found this: Spy agencies ban Lenovo PCs on security concerns (27th July 2013) - http://www.afr.com/p/technology/spy_agencies_ban_lenovo_pcs_...

"Multiple intelligence and defence sources in Britain and Australia confirmed there is a written ban on computers made by the Chinese company [Lenovo] being used in “classified” networks."

Re: Lenovo Caught Installing Adware on New Computers

#27

Post by nfmangano »

I'm surprised that this is just now news. I received complaints from people participating in our beta trial (http://sketchtogether.com) from as early as October 22nd, 2014 that our website was broken, and it was because of Superfish being installed on their lenovo laptops. When they uninstalled Superfish, our webpage started working again.

Superfish injected a line of code that referenced "sf_main.jsp" from a remote site into all webpages (including ours) that interfered with our code. Here's a pastebin of the sf_main.jsp javascript file it linked to: http://pastebin.com/bZFkfRd5 (I assume the linked code is not copyrighted, if it is, please let me know and I can take it down).

Re: Lenovo Caught Installing Adware on New Computers

#28

Post by acadien »

toomuchtodo wrote: post #22
acadien wrote: post #19

Earlier quoted context omitted.

Can't you just write all 0's to the drive or just reformat it? Genuine question here, why would you need to physically replace the drive to ensure security when you can write to the whole thing?

Would have to re-write/re-flash the firmware as well.

What is it that the firmware can achieve? Is the firmware capable hijacking data, communicating with the NIC and transmitting data? Or is it somehow injecting harmful code? I feel like I'm missing something here.

Re: Lenovo Caught Installing Adware on New Computers

#29

Post by kentonv »

BrainInAJar wrote: post #7
kentonv wrote: post #6

Earlier quoted context omitted.

Well, the other possibility is that Superfish is routing and MITMing all traffic through its own servers, which is arguably worse.

arguably? That's orders of magnitude worse

Well, I dunno. In one case Superfish can see all your data and store it on their servers, in the other case _anyone on the internet_ can spoof any site (as soon as someone extracts the key). Either way is pretty bad.

But proxying all traffic from all Lenovo laptop owners through a third-party server without someone immediately noticing a problem is just not feasible, so I think we can assume that's not what they're doing.

Re: Lenovo Caught Installing Adware on New Computers

#30

Post by AlexeyBrin »

andrewchambers wrote: post #17

First thing I also do on a new PC is reinstall the OS from scratch and get rid of all the preinstalled shit.

Your strategy works only if you have a clean copy of the OS or you buy one (since the thread is about Lenovo I assume you are talking about Windows). Typically, a new PC doesn't come anymore with a copy of the OS, but with a hidden recovery partition that will basically let you do a factory reset (meaning all the crap will show up again).
Post reply on HN