Earlier quoted context omitted.
I was equally confused. I'm guessing Firefox doesn't use the OS proxy settings, therefor wasn't getting MITM-ed
That's my current best guess too. Which would imply that Firefox users are...fine? Hopefully?
Lenovo Caught Installing Adware on New Computers
251–260 of 435 posts
Re: Lenovo Caught Installing Adware on New Computers
#252This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…
Looks like the certificate and encrypted private key has been found in "Visual Discovery.exe" - http://pastebin.com/N42Qfm5p (credit to @paul_pearce)
More context at https://twitter.com/supersat
Re: Lenovo Caught Installing Adware on New Computers
#253Jebus, how far the might IBM laptop line has fallen under the leadership of Lenovo. There was a time when a ThinkPad was arguably the best laptop money could buy. Many companies, including Google, would offer a choice between a ThinkPad or a MacBook, because those were the really reliable choices that were free of shovelware. I even considered buying a Lenovo recently when a pretty nice looking ThinkPad was on sale,…
Is it even possible to buy a Windows laptop right now with only the OS installed? This is exactly why I've been recommending Chromebooks to anyone who asks my advice for about a year now.
Yes it is, you can even buy laptops with no OS pre-installed or a gnu/linux distro.
Chromebooks are the worst possible thing, I tell everyone to stay away from these crippled google branded piece of slavery.
I advise either a second hand quality laptop or a brand new one while budgeting a little extra for cleaning the crap that manufacturers preload inside to allow for such a low selling price.
Re: Lenovo Caught Installing Adware on New Computers
#254Earlier quoted context omitted.
naturally oblivious to the security implications Rest assured Lenovo was perfectly aware of the security and privacy implications of this feature from the beginning. They merely try to sound oblivious because their laywers hope that will soften the legal and media repercussions.
No, this is an example of the Lenovo sales / marketing people making distribution deals with dodgy third-party companies. The people who design the machines don't make the decision to ship MITM proxies on them. I honestly don't know why Lenovo (and others) still make these third party deals. Just ship the machine with a blank OS, or install a vetted selection of open-source software (7zip, VLC, LibreOffice if they wa…
For low-end machines these bundling deals likely form a sizeable chunk of the profit margin. (I've heard eyebrow-raising numbers for e.g. the default browser spot.)
Re: Lenovo Caught Installing Adware on New Computers
#255I quite like my new Lenovo M73 "Tiny" desktop [1]. It's fast and silent and really is tiny.
But as far as adware/malware is concerned, that's a non-issue for me as the first thing I did when I got the machine was to replace the Windows drive with an Ubuntu SSD.
[1] http://shopap.lenovo.com/au/en/desktops/thinkcentre/tinys/m7...
Re: Lenovo Caught Installing Adware on New Computers
#256Earlier quoted context omitted.
Anyway to see if that certificate is on a Lenovo computer? Anyway to remove it? I bought a Lenovo laptop recently, and I was appalled at the amount of crapware that was installed. It's a wonderful laptop at a great price, just too bad about the software.
> It's a wonderful laptop at a great price, just too bad about the software. Lenovo's hardware support for Linux is great so unless there's something keeping you on Windows switching to a good Linux distro usually works fine on these laptops.
Screen rotation is borked on the Yoga, apparently.
Re: Lenovo Caught Installing Adware on New Computers
#257Earlier quoted context omitted.
hence "replacing the drive with an SSD"
I don't understand the downvotes. The gp probably asked why not just zero-out the bytes. Sure, there's the firmware modification issue. But what I was responding to is why replace. This is the easiest option.
Post says "buy the laptop with the cheapest drive; then replace that cheapest drive with an SSD".
You said "the cheapest drive is not an SSD".
The point is to minimise the money spent on the drive supplied with the machine because you're not going to use that drive, you're going to throw it away.
Re: Lenovo Caught Installing Adware on New Computers
#258Earlier quoted context omitted.
I thought that Chrome checks and reports that google.com certificate is a google issued certificate. How did this mitm attack not pop up massive warnings in chrome?
Chrome ignores Trusted Root Certificates when checking certificate pinning.
More precisely, Chrome doesn't enforce certificate pinning if the certificate is signed by an unknown root (like one installed by your system administrator, or apparently your laptop manufacturer).
https://code.google.com/p/chromium/codesearch#chromium/src/n...
Re: Lenovo Caught Installing Adware on New Computers
#259Earlier quoted context omitted.
The new Dell XPS 13 looks like a very nice laptop. I have the previous version and it works very well with Linux.
I have one of the Ubuntu XPS 13s. It is a nice machine but battery is woeful after < 2 years of use.
The battery is not awesome. It's supposed to be better in the new version.
Re: Lenovo Caught Installing Adware on New Computers
#260Earlier quoted context omitted.
The new Dell XPS 13 looks like a very nice laptop. I have the previous version and it works very well with Linux.
I used the XPS 13 as my main machine from 2013 to late 2014 (when I switched to a MBPr). It was a nice machine initially but I found that it ended up looking pretty tattered (particularly the plastic edge, which looks and feels cheap and a bit fragile in the long run). Most annoyingly, it had a tendency to overheat, particularly when dual booting into Ubuntu. After about 20 minutes, I couldn't leave the thing on my k…
Yeah, I just can't stomach the thought of paying more for something where Linux isn't officially supported, so not only do I pay more, but have to deal with getting rid of MacOS and installing Linux. I can't stand the lack of focus follows mouse in MacOS X and a lot of the other little things I'm used to in Linux.