Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo Caught Installing Adware on New Computers

thenextweb.com

Post reply on HN
Print view View original

311–320 of 435 posts

Re: Lenovo Caught Installing Adware on New Computers

#311

Post by blumkvist »

userbinator wrote: post #281
jorgecastillo wrote: post #275

Earlier quoted context omitted.

No, no, no! We can't just dismiss this sort of behavior because you can reformat the computer and "Result: no bloat and no malware". They need to learn that people won't let them get away with this. So no this is unacceptable, I too will never buy nor recommend a Lenovo product in the foreseeable future!

Actually, it would be better to educate the masses they can reformat and install a clean OS, because that is what builds immunity and sends an even clearer message that the additional bloatware they ship is worth nothing.

OR, and I'm just speculating here, -500000 devices on their bottom line would be a clearer message.

Re: Lenovo Caught Installing Adware on New Computers

#312

Post by icebraining »

downandout wrote: post #108
kentonv wrote: post #5

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…

>They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. That's the odd part of this. Browser plugins can modify the DOM (insert ads, change search results, etc) without proxying anything. So why do it? I wonder if they were fishing for an NSA contract to further monetize the installs.

The proxy works for all browsers with a single codebase.

Re: Lenovo Caught Installing Adware on New Computers

#314

Post by rjaco31 »

redeemer wrote: post #228
kentonv wrote: post #219

Earlier quoted context omitted.

The NSA doesn't need this amateur-hour backdoor. They surely have control of one or more genuine certificate authorities already.

Impersonating a CA is not transparent and risks losing that CA if anyone finds out it's forging certs. They probably can do that, but it's a risky nuclear option. This is a transparent dragnet that can easily be blamed away, which has been shown to be much more preferable in the NSA's M.O.

I really don't agree. Every government has an official CA, and last time one was caught (France with fake Google certs IIRC), nothing happened at all. Most CAs are too big to fall anyway.

Re: Lenovo Caught Installing Adware on New Computers

#315

Post by kefka »

praptak wrote: post #183
pkulak wrote: post #95

Earlier quoted context omitted.

Is it even possible to buy a Windows laptop right now with only the OS installed? This is exactly why I've been recommending Chromebooks to anyone who asks my advice for about a year now.

With Windows even if you buy the boxed version it still doesn't mean you are free from hardware vendors fuckery. The necessary drivers are quite often bundled with shitware.

Yep. Especially with the fuckery that FTDI did.

What did they do? If they detect a "counterfeit" FTDI (in other words, a clone not necessarily claiming to be an FTDI), the driver bricks your chip!

Yeah, you can fix it using Linux, but it's a pain in the ass.

Or use Linux and be away from this cancer of MS Windows ecosystem.

Re: Lenovo Caught Installing Adware on New Computers

#316

Post by heyalexej »

grey-area wrote: post #199
Alphasite_ wrote: post #179

Earlier quoted context omitted.

Lenovo is a Chinese company, so it's possible, but you'd think they're more likely to be responsible.

Isn't superfish (or is it Phish?) a US/Israeli company? Some of the code inserted is pretty strange, including functions to checks for lenevo, bestbuy.com and isPayingCountry() with a list of country identifiers: http://pastebin.com/AQqWirba So apparently they work with some big companies, and I can't work out what the country check is for, perhaps for subsidiaries of a large customer?

The code you linked is nothing out of the ordinary as far as adware in Chrome plug-ins etc. go. For an example have a look at the source code[1] of "Awesome Screenshot"[2] which is used by ~1,4M users and also calls home to 7 different hosts[3]. This is just one of many many Chrome plug-ins that is injecting ads and Google encourages this[4]. It makes sense to limit injections to markets they can serve / are affiliates in.

[1] https://github.com/heyalexej/pretty-fucked-up/blob/master/ba...

[2] https://chrome.google.com/webstore/detail/awesome-screenshot...

[3] https://gist.github.com/mvirkkunen/89f61a06819530e48b53

[4] https://developer.chrome.com/webstore/program_policies#ads

Re: Lenovo Caught Installing Adware on New Computers

#317

Post by rjaco31 »

tedunangst wrote: post #21
kentonv wrote: post #5

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…

Remaining questions: Does the superfish proxy itself check the certificate of the site it's connecting to? One would hope, but that's also a pretty easy thing to screw up. If it does, does it trust its own cert? Probably (certainly?), but if not, that would leave one in the curious (perverse?) position of being safer by using the proxy. superfish can mitm your connection, but nobody else with the key could.

It's most likely not hard-failing on cert errors, otherwise any website with a self-signed or expired cert would be unaccessible. So that means you just lose warnings (and thus the ability to detect another MitM) in your browser.

Re: Lenovo Caught Installing Adware on New Computers

#318

Post by rjaco31 »

reidrac wrote: post #195
kentonv wrote: post #12

Earlier quoted context omitted.

Here's Lenovo trying to justify the presence of this software, naturally oblivious to the security implications: https://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Lenovo-...

"When using Superfish for the first time, the user is presented the Terms of User and Privacy Policy, and has option not to accept these terms, i.e., Superfish is then disabled." Brilliant! It is behind a "Terms of User and Privacy Policy" text.

And it's rather useless if the rogue CA is already in your trust store :(

Re: Lenovo Caught Installing Adware on New Computers

#319

Post by chinathrow »

mrsaint wrote: post #227

Some more URLs... https://www.superfish.com/ws/sf_code.jsp https://www.superfish.com/ws/sf_conduit.jsp https://www.superfish.com/ws/sf_conduit_mam.jsp https://www.superfish.com/ws/sfw.jsp https://www.superfish.com/ws/sf_main.jsp https://www.superfish.com/ws/getCouponsSupportedSites.action https://www.superfish.com/ws/getSupportedSitesJSON.action

If I were a company on one of those lists, I would start litigation immediately.

If you work for SuperFish and read this: I think it's time to learn about ethics and it's time to walk away from your job NOW.

Re: Lenovo Caught Installing Adware on New Computers

#320

Post by danielweber »

weland wrote: post #278
moe wrote: post #142

Earlier quoted context omitted.

Operations the size of Lenovo have a fairly intense vetting process before a product goes to market. I find it very hard to believe that no red flags were raised by any of the engineers, managers and especially lawyers who must have screened this "feature" for problems. It seems more plausible that the problem was known from the beginning (it is by design after all) and Lenovo decided to risk it.

My own experience makes me suspect the same thing. I used to work for a company that was, at the time, trying to develop a privacy-enhancing product (ironically enough...) which did something somewhat similar (although not on the size of this fuckup -- they'd be intercepting, but not tampering with, encrypted traffic, and storing encrypted private data). Virtually everyone in the engineering team raised a flag when t…

Once one vendor in your space says "we filter HTTPS traffic for nasty viruses!", it becomes a marketing weapon, and lots of customers think "well, why should I go with A when B protects me better?"
Post reply on HN