So basically I have to pay for the hardware and then see annoying ads too?
Lenovo Caught Installing Adware on New Computers
191–200 of 435 posts
Re: Lenovo Caught Installing Adware on New Computers
#192So basically I have to pay for the hardware and then see annoying ads too?
Re: Lenovo Caught Installing Adware on New Computers
#193Just found this: Spy agencies ban Lenovo PCs on security concerns (27th July 2013) - http://www.afr.com/p/technology/spy_agencies_ban_lenovo_pcs_... "Multiple intelligence and defence sources in Britain and Australia confirmed there is a written ban on computers made by the Chinese company [Lenovo] being used in “classified” networks."
I thought that had to do with the fact that they're a chinese owned company and if say the CIA makes a large order (or any order really) the chinese government might step in and force malware to be installed.
I can't see why it would matter, since literally every laptop is made in China already. Plus the vast majority of computer components.
Re: Lenovo Caught Installing Adware on New Computers
#194Earlier quoted context omitted.
I'm confused; if Firefox doesn't use the system certificates, shouldn't Firefox users have been seeing visibly broken HTTPS from day one?
I was equally confused. I'm guessing Firefox doesn't use the OS proxy settings, therefor wasn't getting MITM-ed
That's my current best guess too. Which would imply that Firefox users are...fine? Hopefully?
Re: Lenovo Caught Installing Adware on New Computers
#195This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…
Here's Lenovo trying to justify the presence of this software, naturally oblivious to the security implications: https://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Lenovo-...
"When using Superfish for the first time, the user is presented the Terms of User and Privacy Policy, and has option not to accept these terms, i.e., Superfish is then disabled."
Brilliant! It is behind a "Terms of User and Privacy Policy" text.
Re: Lenovo Caught Installing Adware on New Computers
#196I have had first hand recent experience with this. I bought a new Lenovo laptop at the start of the month.
When I put a new webpage online using my webhost's cPanel to edit the raw HTML everything seemed fine, until a friend asked about a 'best-deals' script running on the page. The Malware / Adware was intercepting & inserting a script not only into pages I was viewing but also pages I was putting online.
Very, very concerning. I have since removed it completely from my system but it's still caused some paranoia. Thankfully it was only a hobby project which was affected & not paid.
Re: Lenovo Caught Installing Adware on New Computers
#197The Javascript code shown connects to "https://www.superfish.com/ws/". WHOIS for "superfish.com" gives names and addresses of people in Palo Alto, CA and in Israel.
The other URL in the code is "https://www.best-deals-products.com/ws/sf_preloader.jsp". That domain is being blocked by some DNS services right now, but it's up. It's a Domains by Proxy domain. That code is worth reading. You can tell what it's looking for as it examines the pages you are browsing. It has a detailed analyzer for car ad price comparisons, and a simpler one for hotels. It phones home to "http://ia1-p:10009", which isn't a valid domain, but there may be some conversion of that I haven't found. One out of every 10,000 times, it reports some debug info to "https://www.superfish.com/ws/trackSession.action".
There are long lists of sites, both blacklists it avoids and whitelists it messes with. There's a list of "paying countries: "IE|CH|ES|US|AU|BE|IT|AT|NO|CA|DE|NL|SE|GB|DK|FR|BR|NZ|AR|MX|CL|CO|RU".
Lots of comments and debug code; it's not obfuscated at all.
Javascript experts, please take a look at this. There might be something hostile embedded in this adware code, and it may bring in more Javascript.
Re: Lenovo Caught Installing Adware on New Computers
#198Earlier quoted context omitted.
I've had great experiences with the ThinkPad T420, but after this news I'll likely never be buying a Lenovo product again. A damn shame.
I'm tempted to believe that's the last great Thinkpad. Until this morning I was being tempted by the new X1 Carbon, even with its non-traditional keyboard. Not so much now.
Not sure what you mean with "non-traditional keyboard", but Lenovo did change the keyboard in the 3rd generation Thinkpad X1 Carbons, reverting the layout of the 2nd generation to a more conventional one: with six rows instead of five. Glad they did.
Ars Technica just reviewed the 3rd generation version: http://arstechnica.com/gadgets/2015/02/thinkpad-x1-carbon-re....
Re: Lenovo Caught Installing Adware on New Computers
#199Earlier quoted context omitted.
"National security" is such a fickle concept. You can bet that if the NSA manages to use this to hoover up some tasty HTTPS, this scandal will be lauded as a big boost to "national security" behind the scenes, and nobody will be punished. For all we know NSA had a hand in engineering this. Of course, if some government data is stolen as a result, then the whole thing will be thrown under the bus and deemed a threat t…
Lenovo is a Chinese company, so it's possible, but you'd think they're more likely to be responsible.
Isn't superfish (or is it Phish?) a US/Israeli company?
Some of the code inserted is pretty strange, including functions to checks for lenevo, bestbuy.com and isPayingCountry() with a list of country identifiers:
So apparently they work with some big companies, and I can't work out what the country check is for, perhaps for subsidiaries of a large customer?
Re: Lenovo Caught Installing Adware on New Computers
#200Earlier quoted context omitted.
I'm confused; if Firefox doesn't use the system certificates, shouldn't Firefox users have been seeing visibly broken HTTPS from day one?
I was equally confused. I'm guessing Firefox doesn't use the OS proxy settings, therefor wasn't getting MITM-ed
It does not. Firefox has it's own implementation, which is pretty great (supports all kind of proxies/socks).