Didn't they also install some malware in UEFI at one point? Which is even worse, since you can install Linux on Lenovo laptops wiping out their pre-installed (but non refundable) Windows, but you can't easily replace UEFI there.
Lenovo to pay $7.3M for installing adware in laptops
21–30 of 131 posts
Re: Lenovo to pay $7.3M for installing adware in laptops
#22Earlier quoted context omitted.
So yes, in a normal case, one would expect to be safe because they are using their own built image. But Lenovo went much further than simply installing crapware, they added a firmware that updates files on startup in the OS to ensure that they had a way to install whatever they wanted onto your system [1]. [1] https://www.theregister.co.uk/2015/08/12/lenovo_firmware_nas...
To add to this, while the Superfish issue only affected their consumer laptop lines (e.g. IdeaPad), the LSE issue was found on their enterprise lineup (e.g. ThinkPad).
Wasn't aware of the LSE issue on enterprise models! This is a feature that would get enterprises angry if it messes with the OS by injecting bins full of vulnerabilities from BIOS. Gross!
Re: Lenovo to pay $7.3M for installing adware in laptops
#23I'm always surprised that Lenovo use in the enterprise space didn't take a hit after all this came to light. I would have thought competitors like Dell and HPE would have used that opportunity to disparage Lenovo.
No enterprise is using the base windows image that came from Lenovo with the superfish malware. They all build their own standard operating environment image that would not include the Lenovo bloatware. I would be surprised if Lenovo enterprises even realized they were shipping this way and have no reason to react negatively. Their competitors also live in glass houses and so cannot throw stones.
No enterprise would use the factory image, but a lot of small businesses would and they were put at risk as a result.
We can of course say they shouldn't have trusted it, but honestly, should it be normal to expect the manufacturer of the machine to be malicious?
Not to mention the other commenters pointed out that they used the firmware to reinstall the malware even on otherwise clean images, so even enterprises could've been at risk.
Re: Lenovo to pay $7.3M for installing adware in laptops
#24IBM Thinkpad t43p was my first heavy duty laptop. In 2005 IBM made a mistake that someone in their management must regret to date, selling Thinkpad laptop line to Lenovo. Things went downhill for Thinkpads and I lasted 3-4 more generations before finally giving up.
Thinkpad had a shot at being the world's most loved laptop, by developers and businessman on the go.
Passion for great products and great user experience is clearly not what drives the thinkpad product line today, and that is regretful. It is one of those business that I would love to run.
Re: Lenovo to pay $7.3M for installing adware in laptops
#25Earlier quoted context omitted.
[flagged]
Maybe nationalization should be an option when a company, say PG&E for example, has poorly maintained equipment that starts forest fires. It seems reasonable that an option like that should be on that table as a deterrent reserved for the worst actors. I don't think that anything like that should have happened here, but the fine of ~$10 a laptop does seem a bit low for MitM.
Why would nationalization ensure that the equipment is well maintained?
Re: Lenovo to pay $7.3M for installing adware in laptops
#26Earlier quoted context omitted.
Maybe nationalization should be an option when a company, say PG&E for example, has poorly maintained equipment that starts forest fires. It seems reasonable that an option like that should be on that table as a deterrent reserved for the worst actors. I don't think that anything like that should have happened here, but the fine of ~$10 a laptop does seem a bit low for MitM.
Why would nationalization ensure that the equipment is well maintained?
This descends pretty quickly into politics, but Nationalised infrastructure should be managed by a government organisation who's goal is to deliver a quality product at (or slightly above) cost.
These organisations in turn report to the executive government of the day, who's interests should be aligned with that of the citizens they were elected to represent.
Re: Lenovo to pay $7.3M for installing adware in laptops
#27IBM Thinkpad t43p was my first heavy duty laptop. In 2005 IBM made a mistake that someone in their management must regret to date, selling Thinkpad laptop line to Lenovo. Things went downhill for Thinkpads and I lasted 3-4 more generations before finally giving up. Thinkpad had a shot at being the world's most loved laptop, by developers and businessman on the go. Passion for great products and great user experience…
To this day I want an older 16:10 thinkpad to run xubuntu on. Happy with my 2013 mbpr, however.
Re: Lenovo to pay $7.3M for installing adware in laptops
#28Earlier quoted context omitted.
[flagged]
Maybe nationalization should be an option when a company, say PG&E for example, has poorly maintained equipment that starts forest fires. It seems reasonable that an option like that should be on that table as a deterrent reserved for the worst actors. I don't think that anything like that should have happened here, but the fine of ~$10 a laptop does seem a bit low for MitM.
> Maybe nationalization should be an option
This turns a problem company into a problem government bureaucracy. Cleaner to fine the company into oblivion, put it into bankruptcy--thereby teaching its shareholders and creditors a hard lesson--and then let the market figure out if it's worth more liquidated, split up into bits, or sold to a new owner.
Re: Lenovo to pay $7.3M for installing adware in laptops
#29Earlier quoted context omitted.
Why would nationalization ensure that the equipment is well maintained?
This descends pretty quickly into politics, but Nationalised infrastructure should be managed by a government organisation who's goal is to deliver a quality product at (or slightly above) cost. These organisations in turn report to the executive government of the day, who's interests should be aligned with that of the citizens they were elected to represent.
Nationalized infrastructure is a good way to create poor service, and a long lasting debt. Look at pretty much every country in Europe with national railtracks and rail lines: massively bleeding money, with worse and worse service and low levels of investements because there is no incentive to do so.
Re: Lenovo to pay $7.3M for installing adware in laptops
#30Earlier quoted context omitted.
To add to this, while the Superfish issue only affected their consumer laptop lines (e.g. IdeaPad), the LSE issue was found on their enterprise lineup (e.g. ThinkPad).
Wasn't aware of the LSE issue on enterprise models! This is a feature that would get enterprises angry if it messes with the OS by injecting bins full of vulnerabilities from BIOS. Gross!
Only a quick read, but both the lenovo pressroom and the guardian stated the thinkpads were not affected.
pressroom: https://news.lenovo.com/pressroom/press-releases/lenovo-stat...
the guardian: https://www.theguardian.com/technology/2015/aug/14/lenovo-se...