[deleted]
Lenovo Caught Installing Adware on New Computers
161–170 of 435 posts
Re: Lenovo Caught Installing Adware on New Computers
#162Ugh. So for "developer-tier" laptops, i.e. not a netbook, does that pretty much leave Apple as the sole non-shit laptop maker? Is there a chromebook out there that runs linux pretty well if you pull chromeOS off? You pay a hefty premium for that backlit Apple logo on the lid, and I'd prefer to get something a little more down-to-earth.
The premium isn't as high as you think, particularly if you account for resale value. Didn't Priceonomics do a feature on this?
I'm not sure why anyone buys anything other than a home when accounting for resale value unless they're just trying to pull a pump-and-dump.
For laptops, at least, I buy them and use them until they die.
I've only owned three laptops in my life.
Re: Lenovo Caught Installing Adware on New Computers
#163This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…
I'm confused; if Firefox doesn't use the system certificates, shouldn't Firefox users have been seeing visibly broken HTTPS from day one?
I was equally confused. I'm guessing Firefox doesn't use the OS proxy settings, therefor wasn't getting MITM-ed
Re: Lenovo Caught Installing Adware on New Computers
#164Earlier quoted context omitted.
I'm confused; if Firefox doesn't use the system certificates, shouldn't Firefox users have been seeing visibly broken HTTPS from day one?
It's not broken, because the Firefox certificate storage isn't empty when you install it. It includes the ones recognized by Mozilla. https://www.mozilla.org/en-US/about/governance/policies/secu...
Sure, but I assume Mozilla doesn't recognize the Lenovo adware, so if all the web traffic is being routed through this proxy, shouldn't firefox have squawked?
Re: Lenovo Caught Installing Adware on New Computers
#165If you are a hardware seller, the dream is to get paid more than once. If your only revenue is from the sticker price, it way too easy to fall behind the competition, or inadvertently start a race to the bottom. A lot of focus has thus been done towards this goal, like adding adware, development license, a cut per sold app, data mining, DRM'ed required parts, and so on.
This is a standard consumer protection issue, as the sticker price fails to represent the actual price of the product. The seller is concealing the true price, hiding it in the terms and conditions, while putting the blame on the consumer for not being aware before buying. It's likely false advertisement, possible misrepresentation in the contract (if the consumer knew the truth, would that party have agreed?), and very likely a case of fraud. Lenovo seem to have opened themselves to be sued.
Re: Lenovo Caught Installing Adware on New Computers
#166Earlier quoted context omitted.
You're so optimistic it hurts "Any engineer" means something in HN, but we're not talking about "people who read HN" levels of engineer here, don't be mistaken. Some people that have had no or limited experience with software are assigned to software projects, and that's the issue with companies like Lenovo.
Operations the size of Lenovo have a fairly intense vetting process before a product goes to market. I find it very hard to believe that no red flags were raised by any of the engineers, managers and especially lawyers who must have screened this "feature" for problems. It seems more plausible that the problem was known from the beginning (it is by design after all) and Lenovo decided to risk it.
I doubt the usual lawyer assigned to this understands SSL and certificates well enough to say anything about it. They worry mostly about contracts, and this is a technical thing.
Re: Lenovo Caught Installing Adware on New Computers
#167I'm surprised that this is just now news. I received complaints from people participating in our beta trial ( http://sketchtogether.com ) from as early as October 22nd, 2014 that our website was broken, and it was because of Superfish being installed on their lenovo laptops. When they uninstalled Superfish, our webpage started working again. Superfish injected a line of code that referenced "sf_main.jsp" from a remot…
`https://www.best-deals-products.com/' sounds like the classic online store that will steal your CC :-)
Re: Lenovo Caught Installing Adware on New Computers
#168First thing I also do on a new PC is reinstall the OS from scratch and get rid of all the preinstalled shit.
Your strategy works only if you have a clean copy of the OS or you buy one (since the thread is about Lenovo I assume you are talking about Windows). Typically, a new PC doesn't come anymore with a copy of the OS, but with a hidden recovery partition that will basically let you do a factory reset (meaning all the crap will show up again).
I think you can just extract the OEM Windows key from Windows, download a clean retail .iso of the same version and activate it with the OEM key. I'm pretty sure that worked with Windows 7, no idea about 8+.
Re: Lenovo Caught Installing Adware on New Computers
#169Can someone with one of these laptops connect to https://www.howsmyssl.com/ and post what it says? I'm curious what cipher suites are used from the proxy to the real site.
not a laptop, a VM that I've built with a similar environment but: http://i.imgur.com/YyawOxc.png http://i.imgur.com/V33bYuv.png
I think that is because you're using IE 8...
Re: Lenovo Caught Installing Adware on New Computers
#170This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…
I thought that Chrome checks and reports that google.com certificate is a google issued certificate. How did this mitm attack not pop up massive warnings in chrome?