NightTrain
02-21-2015, 12:28 PM
This is a pretty big deal.
Whenever I set up a new machine, I'll get rid of all of those pre-installs... I've never trusted them. Norton, McAffee, Wal-Mart, AOL, and any programs that jumped out at me like this one would have, "SuperFish". If it's not necessary to the function of a computer, it's gone.
Computer maker Lenovo has been forced to remove hidden adware that it was shipping on its laptops and PCs after users expressed anger.
The adware - dubbed Superfish - was potentially compromising their security, said experts.
The hidden software was also injecting adverts on to browsers using techniques more akin to malware, they added.
Lenovo faces questions about why and for how long it was pre-installed on machines - and what data was collected.
The company told the BBC in a statement: "Lenovo removed Superfish from the preloads of new consumer systems in January 2015. At the same time Superfish disabled existing Lenovo machines in the market from activating Superfish.
...
According to security experts, it appears that Lenovo had given Superfish permission to issue its own certificates, allowing it to collect data over secure web connections, known in malware parlance as a man-in-the-middle attack.
"If someone went to, say, the Bank of America then Superfish would issue its own certificate pretending to be the Bank of America and intercept whatever you are sending back and forth," said Prof Woodward.
Ken Westin, senior analyst at security company Tripwire, agreed: "If the findings are true and Lenovo is installing their own self-signed certificates, they have not only betrayed their customers' trust, but also put them at increased risk."
http://www.debatepolicy.com/attachment.php?attachmentid=7025&stc=1
http://www.bbc.com/news/technology-31533028
Whenever I set up a new machine, I'll get rid of all of those pre-installs... I've never trusted them. Norton, McAffee, Wal-Mart, AOL, and any programs that jumped out at me like this one would have, "SuperFish". If it's not necessary to the function of a computer, it's gone.
Computer maker Lenovo has been forced to remove hidden adware that it was shipping on its laptops and PCs after users expressed anger.
The adware - dubbed Superfish - was potentially compromising their security, said experts.
The hidden software was also injecting adverts on to browsers using techniques more akin to malware, they added.
Lenovo faces questions about why and for how long it was pre-installed on machines - and what data was collected.
The company told the BBC in a statement: "Lenovo removed Superfish from the preloads of new consumer systems in January 2015. At the same time Superfish disabled existing Lenovo machines in the market from activating Superfish.
...
According to security experts, it appears that Lenovo had given Superfish permission to issue its own certificates, allowing it to collect data over secure web connections, known in malware parlance as a man-in-the-middle attack.
"If someone went to, say, the Bank of America then Superfish would issue its own certificate pretending to be the Bank of America and intercept whatever you are sending back and forth," said Prof Woodward.
Ken Westin, senior analyst at security company Tripwire, agreed: "If the findings are true and Lenovo is installing their own self-signed certificates, they have not only betrayed their customers' trust, but also put them at increased risk."
http://www.debatepolicy.com/attachment.php?attachmentid=7025&stc=1
http://www.bbc.com/news/technology-31533028