Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo Caught Installing Adware on New Computers

thenextweb.com

Post reply on HN
Print view View original

201–210 of 435 posts

Re: Lenovo Caught Installing Adware on New Computers

#201

Post by zyx321 »

moe wrote: post #55
kentonv wrote: post #12

Earlier quoted context omitted.

Here's Lenovo trying to justify the presence of this software, naturally oblivious to the security implications: https://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Lenovo-...

naturally oblivious to the security implications Rest assured Lenovo was perfectly aware of the security and privacy implications of this feature from the beginning. They merely try to sound oblivious because their laywers hope that will soften the legal and media repercussions.

Someone has posted the actual script elsewhere in this thread [1]. Of particular interest is line 194:

  if (location.protocol === 'https:' && queryString.search(/dlsource=hdrykzc/i) !== -1) // Patch for Lenovo - do not run on https sites
So yes, it seems someone at Lenovo was security-aware enough to demand an exception for HTTPS. Unfortunately the fine folks at Superfish either didn't understand or didn't care.

[1] https://news.ycombinator.com/item?id=9072542

Re: Lenovo Caught Installing Adware on New Computers

#202

Post by HackinOut »

MBlume wrote: post #164
ptaipale wrote: post #141

Earlier quoted context omitted.

It's not broken, because the Firefox certificate storage isn't empty when you install it. It includes the ones recognized by Mozilla. https://www.mozilla.org/en-US/about/governance/policies/secu...

Sure, but I assume Mozilla doesn't recognize the Lenovo adware, so if all the web traffic is being routed through this proxy, shouldn't firefox have squawked?

Except if the adware just modify OS proxy settings, like madeofpalk mentioned. Firefox does not take those into account.

Re: Lenovo Caught Installing Adware on New Computers

#203

Post by vanderZwan »

djur wrote: post #102
SwellJoe wrote: post #76

Jebus, how far the might IBM laptop line has fallen under the leadership of Lenovo. There was a time when a ThinkPad was arguably the best laptop money could buy. Many companies, including Google, would offer a choice between a ThinkPad or a MacBook, because those were the really reliable choices that were free of shovelware. I even considered buying a Lenovo recently when a pretty nice looking ThinkPad was on sale,…

I've had great experiences with the ThinkPad T420, but after this news I'll likely never be buying a Lenovo product again. A damn shame.

My current T440s is pretty much all I ever wanted in a laptop. But yeah, this will make me think twice when the time comes to replace it. (hopefully not any time soon. Sweet sweet battery time!)

Then again, the first thing I did when I bought it was install an extra SSD and install Linux.

Re: Lenovo Caught Installing Adware on New Computers

#204

Post by cssmoo »

This is why I do a flat install on every new machine I get.

Also, why are we bitching just at Lenovo. There are software developers out there writing this shit. Name and shame the companies and staff. There needs to be a no hire and no do business with list.

Ethics go all the way down.

I'm rather disappointed though as I've recommended Lenovo hardware recently to people and use an X201 myself.

Re: Lenovo Caught Installing Adware on New Computers

#205

Post by SixSigma »

HackinOut wrote: post #184
kentonv wrote: post #5

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…

"Someone will extract the private key in the next few hours, and then HTTPS will be basically completely broken for all Lenovo users -- anyone will be able to spoof any site to them." Do you mean the proxy is remote? That is not the impression I have (otherwise having the private key locally makes no sense). If it's local, then even with the private key extracted, and considering a lot of website force https nowadays…

Having the private key means you can sign your own certificates to serve HTTPS with, so no MITM required.

Re: Lenovo Caught Installing Adware on New Computers

#206

Post by [deleted] »

moe wrote: post #142
raverbashing wrote: post #116

Earlier quoted context omitted.

You're so optimistic it hurts "Any engineer" means something in HN, but we're not talking about "people who read HN" levels of engineer here, don't be mistaken. Some people that have had no or limited experience with software are assigned to software projects, and that's the issue with companies like Lenovo.

Operations the size of Lenovo have a fairly intense vetting process before a product goes to market. I find it very hard to believe that no red flags were raised by any of the engineers, managers and especially lawyers who must have screened this "feature" for problems. It seems more plausible that the problem was known from the beginning (it is by design after all) and Lenovo decided to risk it.

[deleted]

Re: Lenovo Caught Installing Adware on New Computers

#207

Post by SixSigma »

erikschoster wrote: post #93

I don't see myself ever bothering to keep the default windows install on a thinkpad but this really hurts my impression of the company regardless. I've had my eye on the new X1s and had planned to upgrade my X201 this year but now I'm having second thoughts. Who if anyone has taken over the place of great laptop for linux / development?

I was tempted by the 4k Dell

http://www.dell.com/uk/p/xps-15-9530/pd?oc=cnx9525

But I bought a second hand X201 instead :)

Re: Lenovo Caught Installing Adware on New Computers

#208

Post by lmm »

HackinOut wrote: post #184
kentonv wrote: post #5

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…

"Someone will extract the private key in the next few hours, and then HTTPS will be basically completely broken for all Lenovo users -- anyone will be able to spoof any site to them." Do you mean the proxy is remote? That is not the impression I have (otherwise having the private key locally makes no sense). If it's local, then even with the private key extracted, and considering a lot of website force https nowadays…

> we should still have standard crypto between the lenovo computer and the website

Standard crypto using that website's certificate. Which could be legit. Or could be an attacker's certificate, signed with this Lenovo root certificate.

Some criminals are about to make a lot of money.

Re: Lenovo Caught Installing Adware on New Computers

#209

Post by lmm »

davidw wrote: post #129
erikschoster wrote: post #93

I don't see myself ever bothering to keep the default windows install on a thinkpad but this really hurts my impression of the company regardless. I've had my eye on the new X1s and had planned to upgrade my X201 this year but now I'm having second thoughts. Who if anyone has taken over the place of great laptop for linux / development?

The new Dell XPS 13 looks like a very nice laptop. I have the previous version and it works very well with Linux.

I used an XPS 13 for a little while. It had a horrible keyboard that I can only describe as "rubbery", and the battery lasted literally less than two hours. Have they fixed that in newer revisions?
Post reply on HN