Lenovo Bloatware Superfish Found to Be Dangerous Malware

Lenovo! Look behind you!

Computer manufacturer, Lenovo, has apparently pre-loaded a number of their consumer laptops with adware that can potentially expose users to a variety of digital threats. The adware, called “Superfish”, injects third party ads on Google searches and websites without the user’s permission. Affected are Internet Explorer and Google Chrome on these machines.

If that isn’t bad enough, it is reported that Superfish can automatically install its own self-signed certificate, allowing the adware to look at secure connections, such as banking websites. Other websites are posting screenshots of just such an example.

If this proves to be the case, Lenovo is shipping software that uses a malicious "man-in-the-middle attack" technique, where the certificate — that the user is completely unaware of either being created or existing — can decrypt secure requests. Adware injecting third party ads is annoying and deceptive in its application, but this sounds like there is a bigger fish to fry here — Superfish could be extremely dangerous and potentially expose users to incredible online risk.

Mark Hopkins, a community administrator for Lenovo, defended the adware, stating that Superfish “helps users find and discover products visually” and “instantly analyzes images on the web and presents identical and similar product offers that may have lower prices.”

He went on to say that there is an option upon first setup to refuse the terms and conditions of Superfish, though most of us can attest to skipping the 40,000 word agreements they are presented with upon firing up a new machine or installing new software.

Over the years, users of both PCs and, to a lesser extent, Macs, have had to tiptoe through the world wide web in an effort to avoid infecting their expensive hardware with viruses, malware, adware, and other things haunting the dark corners of the internet.

Before that dance even occurs, the lustre of new machines is often tarnished by the oft-painful process of removing “bloatware” — the software OEMs load up their new machines with in an effort to sell you something, simplify a process, or point users toward using their services after the initial purchase.

In one fell swoop, Lenovo has saved us the trouble of tiptoeing around malware and adware, and has packaged up the threat in a series of new laptops.

 

For those who have purchased a P, Y or Z series Lenovo laptop, here is Lenovo's release and instructions to remove the software:

 

http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-Instructions-for-VisualDiscovery-Superfish-application/ta-p/2029206

Russ
Fairley
Fri, 02/20/2015 - 2:34pm