Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo Statement on Superfish

news.lenovo.com

Post reply on HN
Print view View original

301–310 of 312 posts

Re: Lenovo Statement on Superfish

#301

Post by JimmyM »

tempestn wrote: post #200
eropple wrote: post #4

> We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. I try to be measured around here, as hard as I can. I can't formulate a polite way to respond to this claim. Lenovo, you are full of shit, and maliciously so. There is no excuse, nor forgiveness, for what you've done here.

Speaking of Lenovo being full of shit, there's also this gem: > The relationship with Superfish is not financially significant; our goal was to enhance the experience for users. Right. You loaded adware onto users' computers, not for financial gain, but to enhance the experience for them.

I've been thinking about this. If I put my tinfoil hat on, I think they're telling the truth.

> The relationship with Superfish is not financially significant;

Again, with my tinfoil hat on, I believe this. I believe that either Israeli (check out Superfish's background and connections) or Chinese governmental groups have forced Lenovo into loading this awful malware onto its machines.

> our goal was to enhance the experience for users.

Not their goal in loading adware, but their goal in general. They are drawing a line (or semicolon) between what they wanted to do, and what the dark and mysterious forces behind Superfish forced them to do.

Again, tinfoil hat. This is all very conspiracy theory-ish.

Re: Lenovo Statement on Superfish

#302

Post by dm2 »

somerandomness wrote: post #300
chinathrow wrote: post #65

Earlier quoted context omitted.

Indeed. I have been buying IBM and then Lenovo Thinkpads for ages. I hate the thought that my next machine will be another brand. Lenovo: One customer lost. More to be lost.

This actually never affected Thinkpads.

You'd think people would at least check to see if they were even affected, it clearly states "Lenovo never installed this software on any ThinkPad notebooks, nor any Lenovo desktops or smartphones." and no enterprise products or servers.

I'm giving Lenovo the benefit of the doubt here. Look at all the potentially malicious crap Dell, HP, Compaq, and others have installed on computers over the years.

Any experienced computer user should know and want to wipe the hard-drive and reinstall as soon as you get the computer, preferably from trusted sources, I'm not sure Microsoft's rules on customizing their reinstall disk. I wouldn't trust the reinstall partition either.

You have to also consider that the Chinese government might see all the news about NSA and US government hacking and intercepting hardware and they could require or secretly implement bugs into almost any Chinese made product, that's always been an unfortunate concern with Lenovo.

If Lenovo would push for more open standards of all computer components and have independent parties verify their internal processes, then that would go a long way to improving their credibility after this incident.

Re: Lenovo Statement on Superfish

#303

Post by dhimes »

Alupis wrote: post #257
dhimes wrote: post #248

Earlier quoted context omitted.

I've always been curious about how this work. If I buy a Win machine and want to keep Win (say to dual-boot), how do I do this? Buy a second OS disk? Torrent one and use my key? I get it if I'm wiping out and putting on Linux or something, but that always seems like I'm wasting something I've already bought.

You don't have to "waste" the windows license key you purchased... it allows you to do a fresh install and just use that key. You can use any windows ISO or disk to do the fresh install. In fact I think somewhere you can download the Windows 7, 8, and 8.1 ISO's directly from Microsoft.

OK great- that was exactly what I was asking. The 'backup' files they ask me to make re-installs the original state of the machine- I assume that includes crapware. Thanks.

Re: Lenovo Statement on Superfish

#304

Post by serverhorror »

talkingquickly wrote: post #135
notsony wrote: post #118

Earlier quoted context omitted.

Why stop buying Thinkpads? Lenovo have acknowledged the issue and are now trying to resolve it. Everybody makes mistakes but how they fix those problems tells you a lot about the culture of the company. Lenovo also made a terrible mistake in removing the physical click buttons, but is now reintroducing them across their entire laptop range for 2015. What I see is a company willing to listen and admit their mistakes.…

I'd argue that so far, that's exactly the point, their response makes it worse. "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns" is a laughable statement to have issued. I can understand the legal reasons for not admitting to the security issues. But outright saying that they can't find anything to suggest they exist indicates a company I wouldn't want t…

> "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns" is a laughable statement to have issued.

Why o why does "investigated this technology" even imply that somebody (technical) looked at it?

Lead: Hey vendor, is your product secure?

Vendor: Sure it is. It helps people find products they want.

Lead: Aye! That's cool. Deal!

Vendor: Aye! Let's hand it off to the mere mortals to implement the plan...

Customer (formerly known as lead): Nice doing business with you. I like we have a relationship based on trust and honesty.

Re: Lenovo Statement on Superfish

#306

Post by Alupis »

tunap wrote: post #298
Alupis wrote: post #281

Earlier quoted context omitted.

Windows Vista and up did away with special OEM ISO/Disks. You can use your OEM license with any official ISO/Disk. What you may of had issue with was your OEM license being activated too many times -- if that happens, the automatic online activation will not work. You must use the phone number to activate your license, and it will ask "how many computers is this license installed on"... of course you just give the an…

"Windows Vista and up did away with special OEM ISO/Disks. You can use your OEM license with any official ISO/Disk." Are you referring to all flavors(Home Basic/Home Premium/Pro/Ultimate) from one disk? Installing retail/OEM from one disk has never been the case in my experience, though I have limited experience with 'retail' installs. I joined TechNet ~6 years back to obtain ISOs to reload various x32/x64/Vista/7 in…

> Are you referring to all flavors(Home Basic/Home Premium/Pro/Ultimate) from one disk? Installing retail/OEM from one disk has never been the case in my experience

No, Home/Pro/Ultimate are separate disks -- but OEM/Retail are exactly the same thing. You have to phone in your activation however, since OEM keys usually do not automatically activate over the internet.

Vista and up, there is no such thing as an OEM ISO image. XP had that and it was a great pain for support...

If you mean OEM in the sense of the pre-installed image on your recovery partition... that's not an "OEM" install in the same sense as the XP disks were... that's a customized image either made by something like nLite or installed on a generic factory laptop, pre-loaded with garbage, ran sysprep (to genericsize it) and imaged to a file.

The recovery image/factory image does not use the license on the bottom of your laptop usually -- it uses a factory volume license key that is pre-activated on the image. However if you try to recover that key with some key extractor, and use it to activate another installation from an official ISO, it will not work -- ie. that license will only activate at the factory. If you use the license from the bottom of your laptop, you need a genuine microsoft iso.

So long as you have a Windows 7 Pro license key on the bottom of your laptop, and use a Windows 7 Pro ISO, it will work.. or Home and Home, etc...

Re: Lenovo Statement on Superfish

#307

Post by sjolsen »

waps wrote: post #295
sjolsen wrote: post #292

Earlier quoted context omitted.

In a company as big as Lenovo, I'd be kind of surprised if the person or persons who decide what bloatware to load onto the consumer image make any sort of hardware decisions. There's also that this particular kind of compromise is basically inapplicable to hardware. What are they going to do, put a 3G radio in your laptop that broadcasts your "data" via the cell network to Belarus?

This provides some details : http://thehackernews.com/2015/02/hard-drive-firmware-hacking... So no, they'll get a rootkit process running on your machine and (for instance) upload everything on your hard drive through your web browser. Another thing they've done is to upload hacked drivers to cause other hardware connected to the infected machine to physically destroy itself.

There's a big difference between Lenovo selling bloatware rights to an adware company and the NSA (or whoever) bugging some hard drives.

Is that spyware Windows-specific?

Re: Lenovo Statement on Superfish

#308

Post by tunap »

Alupis wrote: post #306
tunap wrote: post #298

Earlier quoted context omitted.

"Windows Vista and up did away with special OEM ISO/Disks. You can use your OEM license with any official ISO/Disk." Are you referring to all flavors(Home Basic/Home Premium/Pro/Ultimate) from one disk? Installing retail/OEM from one disk has never been the case in my experience, though I have limited experience with 'retail' installs. I joined TechNet ~6 years back to obtain ISOs to reload various x32/x64/Vista/7 in…

> Are you referring to all flavors(Home Basic/Home Premium/Pro/Ultimate) from one disk? Installing retail/OEM from one disk has never been the case in my experience No, Home/Pro/Ultimate are separate disks -- but OEM/Retail are exactly the same thing. You have to phone in your activation however, since OEM keys usually do not automatically activate over the internet. Vista and up, there is no such thing as an OEM ISO…

To clarify, I was not speaking of recovery/restore, just clean installs of Windows sans vendor bloat... & h/w drivers.

And... you appear to be absolutely correct.

"Vista and up, there is no such thing as an OEM ISO image. XP had that and it was a great pain for support..."

I was not aware OEM & RETAIL installation media were merged, cannot locate any search results verifying this, but I cannot find any recent issues being discussed either. Site where I buy software still has the categories distinguished & separate, but I never considered the media became one and the same w/ only distinction being the key itself(and all rights afforded Retail over OEM). I had numerous problems installing 7 when it appeared on consumer devices before I did any machine builds w/ 7(and made images of installation media that came with their licenses), hence my subscribing to TechNet(R.I.P.) before Digital River links became ubiquitous... and yeah, I have a dozen+ variants of XP due both to it's OEM/RETAIL duality plus the never-ending sfc /scannow prompt: "please insert original installation media" if XP received any Service Packs since original installation.

I do now recall unlocking Vista & 7 disks to install any flavor now that you mention nLight... another contributor to my lapse. Plus, I did find official MS pages that support your last point on unique disks for each flavor... I thought it was just for Enterprise.

EDIT:

"You have to phone in your activation however, since OEM keys usually do not automatically activate over the internet."

After activation failure, you can opt to insert a different key & retype the same key a 2nd time for online activation. That always irked me, I thought it was a bug.

Re: Lenovo Statement on Superfish

#309

Post by username223 »

Alupis wrote: post #285
username223 wrote: post #271

Earlier quoted context omitted.

Plus, they have no reason to do so, because unlike Lenovo, they make a healthy profit on their hardware. (I believe IBM was in the same position with its ThinkPads back in the day.) In contrast, the bargain PC laptop makers have little or no profit margin on the hardware itself, so they're always looking for other ways to eke out a bit more money. This is why I'm willing to pay a bit more for things I rely upon and c…

Lenovo isn't a "bargin PC laptop maker"... the Thinkpad series are some of the most highly regarded laptops in the industry... And to that extent, just because you paid more for an aluminum case with exactly the same internal components doesn't somehow make it seriously better... Macbook Air's for example have notorious overheating issues that kill the laptop...

You kind of missed my point. Lenovo only put the spyware on their bargain laptops, not ThinkPads. ThinkPads and MacBooks may have unintended hardware bugs, but since they already make a profit, they're less likely to have intended crapware.

Re: Lenovo Statement on Superfish

#310

Post by BobCollins »

grecy wrote: post #42
eropple wrote: post #4

> We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. I try to be measured around here, as hard as I can. I can't formulate a polite way to respond to this claim. Lenovo, you are full of shit, and maliciously so. There is no excuse, nor forgiveness, for what you've done here.

> We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. I work at a large Telco/ISP and I understand how this kind of thing happens (though I'm not excusing it). First they come to the tech people and we explain exactly what's going on. Our managers translate it so they can understand it, and push it up with their name on it. Those Directors translate it so th…

> Our company puts out press releases all the time and us tech people just shake our heads at how inaccurate and plain wrong they are.

And that doesn't make it right, honest, or excusable.

Post reply on HN