{"id":9124,"date":"2015-02-19T11:13:34","date_gmt":"2015-02-19T16:13:34","guid":{"rendered":"http:\/\/thundercloud.net\/infoave\/new\/?p=9124"},"modified":"2015-02-19T16:11:55","modified_gmt":"2015-02-19T21:11:55","slug":"lenovo-installs-adware-on-new-computers","status":"publish","type":"post","link":"https:\/\/www.thundercloud.net\/infoave\/new\/lenovo-installs-adware-on-new-computers\/","title":{"rendered":"Lenovo Installs Adware on New Computers"},"content":{"rendered":"
\n

The following article appeared in Gizmodo, February 19, 2015<\/em><\/p>\n

\n

Lenovo Installs Adware\u00a0on New Computers\u00a0That Could Steal\u00a0Private Data<\/h1>\n<\/blockquote>\n<\/header>\n
\n
\n
\n
\n
\n

\"Lenovo<\/span><\/p>\n

Oh no, Lenovo. Users are reporting on the company’s\u00a0forums<\/a>,\u00a0its computers are coming installed with adware straight out of the box\u2014that can monitor secure connections.<\/p>\n

According to a number of Lenovo users, the software called Superfish is installed on factory-fresh laptops. The adware injects third-party ads into Google searches and on to websites without the user’s permission\u2014on Chrome and Internet Explorer, at least. That, alone, is bad but not awful. But other users have pointed out<\/a> that the adware can also install its own self-signed certificate authority\u2014creating spurious SSL certificates\u2014allowing it to monitor secure connections.<\/p>\n

Security expert Kenn White<\/a> has posted images on Twitter showing that, as an example, the software provides a certificate issued to<\/em> Bank of America, but issued by<\/em> Superfish\u2014wheras usually that would be done by a trusted body like VeriSign. Given Superfish’s whole purpose is to check and forward browsing data to ad companies, allowing it access secure content in this way is clearly a Bad Thing.But it gets worse. It seems Superfish uses the same private key for its root certificate on every machine it’s installed on, explains <\/a>The Verge<\/a><\/em>. If someone could crack that key, it would be possible to create certificates that any Superfish-fuelled Lenovo computer\u2014probably, at this point, most of them\u2014would trust, allowing malicious code to wriggle in unannounced.<\/p>\n

Appearing in forums in January, a Lenovo community administrator called Mark Hopkins wrote that Lenovo has “temporarily removed Superfish from our consumer systems” but defended its presence, explaining that it “helps users find and discover products visually” and “instantly analyzes images on the web and presents identical and similar product offers that may have lower prices.” Now a rather serious security hole has been identified, it might think differently.<\/p>\n

We’ve got in touch with Lenovo to find out what its current stance on Superfish is. [The Next Web<\/a>, Verge<\/a>]<\/p><\/blockquote>\n

Source Gizmodo<\/strong><\/a><\/p>\n

Note: If you want to check your computer for Superfish adware, visit\u00a0https:\/\/lastpass.com\/superfish\/<\/a><\/span><\/strong><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"

The following article appeared in Gizmodo, February 19, 2015 Lenovo Installs Adware\u00a0on New Computers\u00a0That Could Steal\u00a0Private Data Oh no, Lenovo. Users are reporting on the company’s\u00a0forums,\u00a0its computers are coming installed with adware straight out of the box\u2014that can monitor secure connections. According to a number of Lenovo users, the software called Superfish is installed on factory-fresh laptops. The\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1655,1670,1656,1654,1674],"tags":[],"_links":{"self":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/9124"}],"collection":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/comments?post=9124"}],"version-history":[{"count":3,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/9124\/revisions"}],"predecessor-version":[{"id":9131,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/posts\/9124\/revisions\/9131"}],"wp:attachment":[{"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/media?parent=9124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/categories?post=9124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thundercloud.net\/infoave\/new\/wp-json\/wp\/v2\/tags?post=9124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}