Lenovo Caught Installing Adware on New Computers

Post by redeemer » Thu, Feb 19, 2015, 8:03 AM UTC

grecy wrote: post #51

kentonv wrote: post #5

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…

I'm curious what legal stance Lenovo customers have here - their secure HTTPS connections are being MITMed intentionally - surely that's hacking, or some national security violation?

Post by regularfry » Thu, Feb 19, 2015, 8:06 AM UTC

davidw wrote: post #129

erikschoster wrote: post #93

I don't see myself ever bothering to keep the default windows install on a thinkpad but this really hurts my impression of the company regardless. I've had my eye on the new X1s and had planned to upgrade my X201 this year but now I'm having second thoughts. Who if anyone has taken over the place of great laptop for linux / development?

The new Dell XPS 13 looks like a very nice laptop. I have the previous version and it works very well with Linux.

Post by EpicEng » Thu, Feb 19, 2015, 8:08 AM UTC

Untit1ed wrote: post #50

jamesmcq24 wrote: post #15

Was just about to purchase a lenovo... although I would have wiped it and installed linux immediately this has caused me to look elsewhere. when will companies learn this kind of behavior is toxic to their business?

Unfortunately a very small proportion of potential customers are going to hear or care about this... it's about as toxic to their business as stepping in some stinging nettles is toxic to me.

Post by technomancy » Thu, Feb 19, 2015, 8:11 AM UTC

BorisMelnik wrote: post #45

r721 wrote: post #25

I wonder what are the legal repercussions of this, can't someone sue them?

I think worse than that, I see criminal charges being brought up for this including fraud, theft, etc.

Post by tedunangst » Thu, Feb 19, 2015, 8:12 AM UTC

moe wrote: post #94

kentonv wrote: post #80

Earlier quoted context omitted.

Oh I'm sure they had lots of meetings about the contracts and pay structure, and they may have done testing to make sure it didn't break things, but apparently no one did a security review. Sadly, this doesn't surprise me that much. If they did know about the problem, they could have fixed it. If the app simply generated a new key as part of first-time use, then it would just be run-of-the-mill crapware rather than a…

but apparently no one did a security review It doesn't take a "security review" to spot a gaping security and privacy violation like this. Any engineer with even the slightest clue of how a browser and "the internet" works would have called this out during the first "How does this product work?"-presentation. Let's not pretend Lenovo is staffed with monkeys.