China’s Lenovo Group Ltd , the world’s largest PC maker, had pre-installed a virus-like software on laptops that makes the devices more vulnerable to hacking, cybersecurity experts said on Thursday.
Users reported as early as last June that a programme called Superfish pre-installed by Lenovo on consumer laptops was ‘adware’, or software that automatically displays adverts.
Robert Graham, CEO of U.S.-based security research firm Errata Security, said Superfish was malicious software that hijacks and throws open encrypted connections, paving the way for hackers to also commandeer these connections and eavesdrop, in what is known as a man-in-the-middle attack.
Lenovo had installed Superfish on consumer computers running Microsoft Corp’s Windows, he added. “This hurts (Lenovo’s) reputation,” Graham told Reuters. “It demonstrates the deep flaw that the company neither knows nor cares what it bundles on their laptops.”
An administrator on Lenovo’s official web forum said on January 23 that Superfish has been temporarily removed from consumer computers. Lenovo executives were not immediately available for comment during the Lunar New Year holiday in China.
Graham and other experts said Lenovo was negligent, and that computers could still be vulnerable even after uninstalling Superfish. The software throws open encryptions by giving itself authority to take over connections and declare them as trusted and secure, even when they are not.
“The way the Superfish functionality appears to work means that they must be intercepting traffic in order to insert the ads,” said Eric Rand, a researcher at Brown Hat Security. “This amounts to a wiretap.”
Concerns about cybersecurity have dogged Chinese firms, including telecoms equipment maker Huawei Technologies Ltd over ties to China’s government and smartphone maker Xiaomi Inc over data privacy.
Lenovo commanded one-fifth of the global PC market in the third quarter of 2014, according to data research firm IDC.
Reactions from Lenovo:
In our effort to enhance our user experience, we pre-installed a piece of third-party software, Superfish, on some of our consumer notebooks. In reality, we had customer complaints about the software. We acted swiftly and decisively once these concerns began to be raised. We apologize for causing any concern to any users for any reason.
We stopped the preloads beginning in January. We shut down the server connections that enable the software (also in January), and we are providing online resources to help users remove this software. Detailed information on these activities and tools for software removal are available here:
http://support.lenovo.com/us/en/product_security/superfish
http://support.lenovo.com/us/en/product_security/superfish_uninstall
To be clear: Lenovo never installed this software on any ThinkPad notebooks, nor any Lenovo desktops or smartphones. This software has never been installed on any enterprise product (servers or storage) and these products are in no way impacted. And, Superfish is no longer being installed on any Lenovo device. By the end of this month, we will announce a plan to help lead Lenovo and our industry forward with deeper knowledge, more understanding and even greater focus on issues surrounding adware, pre-installs and security .
– Lenovo
