Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo Caught Installing Adware on New Computers

thenextweb.com

Post reply on HN
Print view View original

81–90 of 435 posts

Re: Lenovo Caught Installing Adware on New Computers

#81

Post by BinaryIdiot »

WestCoastJustin wrote: post #75
kentonv wrote: post #65

Earlier quoted context omitted.

Honestly, I think that's unlikely. This is far too sloppy to have been intentional. There are much better ways to implement a backdoor when you control the OS image. This is just incompetence, plain and simple. Superfish looks like the kind of crapware that pays OEMs to include it in their bundle. Lenovo took the cash and didn't bother to review the code. Superfish, for its part, probably doesn't have the best and br…

Cannot see how this could possibly be true. Having been privy to OS bundling for products, I can assure you there is lengthy contracts, and negotiations, about exactly what is happening. You do no simply walk up to Lenovo and have your "software" installed into the OS without a very detailed contract and pay structure. There also looks to be js injected into pages, which is serving up the ads, and a comment about Len…

I don't know, I've worked on some large government projects where things like this could have possibly slipped through because an engineer or two thought it was a clever way to workaround the issue. Granted they should have known and may have known but I'm not convinced they had to have known.

Re: Lenovo Caught Installing Adware on New Computers

#82

Post by crimsonalucard »

ntakasaki wrote: post #20

I am guessing the Lenovo machines that are bought from the Microsoft Store are free of this, because of the Signature PC program, might be worth the extra cost if any and the trip there to get a crapware free machine.

why risk it.

Re: Lenovo Caught Installing Adware on New Computers

#83

Post by jamesmcq24 »

Untit1ed wrote: post #50
jamesmcq24 wrote: post #15

Was just about to purchase a lenovo... although I would have wiped it and installed linux immediately this has caused me to look elsewhere. when will companies learn this kind of behavior is toxic to their business?

Unfortunately a very small proportion of potential customers are going to hear or care about this... it's about as toxic to their business as stepping in some stinging nettles is toxic to me.

unfortunately you're completely correct.

Re: Lenovo Caught Installing Adware on New Computers

#84

Post by sliverstorm »

kentonv wrote: post #29
BrainInAJar wrote: post #7

Earlier quoted context omitted.

arguably? That's orders of magnitude worse

Well, I dunno. In one case Superfish can see all your data and store it on their servers, in the other case _anyone on the internet_ can spoof any site (as soon as someone extracts the key). Either way is pretty bad. But proxying all traffic from all Lenovo laptop owners through a third-party server without someone immediately noticing a problem is just not feasible, so I think we can assume that's not what they're d…

Are you sure? Android Chrome proxies all non-HTTPS traffic through a third-party server, by default. So it isn't like the traffic volume is impossible.

Re: Lenovo Caught Installing Adware on New Computers

#85

Post by sliverstorm »

panarky wrote: post #64
acadien wrote: post #28

Earlier quoted context omitted.

What is it that the firmware can achieve? Is the firmware capable hijacking data, communicating with the NIC and transmitting data? Or is it somehow injecting harmful code? I feel like I'm missing something here.

Ripped from yesterday's headlines ... ... rewrote the hard-drive firmware of infected computers—a never-before-seen engineering marvel that worked on 12 drive categories from manufacturers including Western Digital, Maxtor, Samsung, IBM, Micron, Toshiba, and Seagate. The malicious firmware created a secret storage vault that survived military-grade disk wiping and reformatting, making sensitive data stolen from victi…

That appears to be the act of a nation-state though. I don't really sweat those, because I'm pretty sure if the NSA really wants in to my machine, I can't stop them.

Re: Lenovo Caught Installing Adware on New Computers

#86

Post by cdr »

AlexeyBrin wrote: post #30
andrewchambers wrote: post #17

First thing I also do on a new PC is reinstall the OS from scratch and get rid of all the preinstalled shit.

Your strategy works only if you have a clean copy of the OS or you buy one (since the thread is about Lenovo I assume you are talking about Windows). Typically, a new PC doesn't come anymore with a copy of the OS, but with a hidden recovery partition that will basically let you do a factory reset (meaning all the crap will show up again).

Microsoft itself has provided Windows installation media for download since Windows 8, including Windows 7 media. All you have to do is read your key off BIOS or the sticker.

And of course Windows 10 will be a free download.

Re: Lenovo Caught Installing Adware on New Computers

#87

Post by tedunangst »

gradys wrote: post #69
kentonv wrote: post #5

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…

Is there reason to believe that the same key is used on all machines?

Click the first Twitter link?

Re: Lenovo Caught Installing Adware on New Computers

#88

Post by kentonv »

sliverstorm wrote: post #84
kentonv wrote: post #29

Earlier quoted context omitted.

Well, I dunno. In one case Superfish can see all your data and store it on their servers, in the other case _anyone on the internet_ can spoof any site (as soon as someone extracts the key). Either way is pretty bad. But proxying all traffic from all Lenovo laptop owners through a third-party server without someone immediately noticing a problem is just not feasible, so I think we can assume that's not what they're d…

Are you sure? Android Chrome proxies all non-HTTPS traffic through a third-party server, by default. So it isn't like the traffic volume is impossible.

Yes but that's Google. I'd be surprised if Superfish had resources like that, or could generate that much traffic from their servers and not be noticed (by, say, Google). I could be wrong.

Re: Lenovo Caught Installing Adware on New Computers

#90

Post by _Adam »

Stupid. I don't understand their motivations - are they making such a huge amount of money from this?

Lenovo doesn't stand out as much as they used to. Dell/HP/Apple make pretty great business laptops these days. If everything else is equal and I know the competitor (for example) won't install adware, then why would I ever buy Lenovo again?

Post reply on HN