HackDig : Dig high-quality web security articles for hacker

«No Previous
No Next

Lenovo honestly thought you’d enjoy that Superfish HTTPS spyware

2015-02-20 02:05

Imagine that you are a major global seller of laptop computers and that you were just caught preloading those machines with ultra-invasive adware that hijacks even fully encrypted Web sessions by using a self-signed root HTTPS certificate from a company called Superfish. How do you explain why you did it?

If you're Lenovo, you tell customers that you thought they would like having their visits to banking websites interfered with and their machines left open to potential man-in-the-middle attacks!

The company this morning issued an oddly tone-deaf statement addressing the controversy with equal parts innocence and chutzpah. The Superfish software, Lenovo says, was "to help customers potentially discover interesting products while shopping"—apparently by throwing up related ads while visiting encrypted retail sites, which would otherwise be invisible to the adware.

This might sound like garden-variety horse manure, but Lenovo doubles down with the claim that this purported consumer benefit was the primary reason for installing Superfish on its laptops. It wasn't—as cynics might suspect—about the cash at all! Well, not much, anyway.

"The relationship with Superfish is not financially significant," the statement says. "Our goal was to enhance the experience for users. We recognize that the software did not meet that goal and have acted quickly and decisively."

When you’re dancing on the razor’s edge of profitability, however, and selling low-margin, low-end products, these adware deals will remain a temptation to vendors.

Here, in its full glory, is the entire Lenovo statement:

Superfish was previously included on some consumer notebook products shipped in a short window between September and December to help customers potentially discover interesting products while shopping. However, user feedback was not positive, and we responded quickly and decisively:

  • Superfish has completely disabled server side interactions (since January) on all Lenovo products so that the product is no longer active. This disables Superfish for all products in market.
  • Lenovo stopped preloading the software in January.
  • We will not preload this software in the future.

We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. But we know that users reacted to this issue with concern, and so we have taken direct action to stop shipping any products with this software. We will continue to review what we do and how we do it in order to ensure we put our user needs, experience and priorities first.

To be clear, Superfish technology is purely based on contextual/image and not behavioral. It does not profile nor monitor user behavior. It does not record user information. It does not know who the user is. Users are not tracked nor re-targeted. Every session is independent. Users are given a choice whether or not to use the product. The relationship with Superfish is not financially significant; our goal was to enhance the experience for users. We recognize that the software did not meet that goal and have acted quickly and decisively.

We are providing support on our forums for any user with concerns. Our goal is to find technologies that best serve users. In this case, we have responded quickly to negative feedback, and taken decisive actions to ensure that we address these concerns. If users still wish to take further action, detailed information is available at http://forums.lenovo.com.

Update: Superfish has a statement, too. CEO Adi Pinhas tells Ars that "Superfish has not been active on Lenovo laptops since December. We standby this Lenovo statement: http://news.lenovo.com/article_display.cfm?article_id=1929.

"It is important to note: Superfish is completely transparent in what our software does and at no time were consumers vulnerable—we stand by this today. Lenovo will be releasing a statement later today with all of the specifics that clarify that there has been no wrongdoing on our end."

Source: wyps-sptth-hsifrepus-taht-yojne-duoy-thguoht-yltsenoh-ovonel/20/5102/ytiruces/moc.acinhcetsra

Read:3747 | Comments:0 | Tags:Risk Assessment adware Lenovo Superfish

“Lenovo honestly thought you’d enjoy that Superfish HTTPS spyware”0 Comments

Submit A Comment



Blog :

Verification Code:


Share high-quality web security related articles with you:)


Tag Cloud