Lenovo is under fire for shipping its consumer laptops with pre-installed adware that opens up users to hackers.
The adware, made by a company named Superfish, is an add-on to Internet browsers that injects advertisements onto websites that the user visits. The danger in this software, which was intended to serve Lenovo laptop users with advertisements, is that it undermines basic security protocols in laptops.
To operate, the Superfish Visual Discovery software needs to tamper with a system of official certificates for websites. By doing so, the laptop finds it difficult to recognize fake websites while browsing.
Superfish is particularly bad, as explained by Errata Security's Robert Graham, because it is designed to be able to intercept all the encrypted connections that the adware is normally not allowed to see. This leaves the laptop wide open for hackers or spies to breach the device's security systems, such as spying on a user's private bank connections.
"If this software or any of its control infrastructure is compromised, an attacker would have complete and unrestricted access to affected customers banking sites, personal data and private messages," said Marc Rogers, a cyber security researcher, in a blog post.
According to Kevin Bocek, an executive for the cyber security firm Venafi, the technique is precisely "what bad guys do with trojans and other malicious software" to dupe users to access fake sites to "surveil/monitor private communications."
Users began discovering Superfish in their Lenovo laptops in the middle of last year, causing a buildup of fierce backlash from customers and cyber security experts against the company.
The negative feedback prompted Lenovo to stop pre-installing Superfish back in January. The company said that it has also shut down the server connections enabling the adware in that same month, and has provided users with online resources for the removal of the adware.
Lenovo stated 43 different devices released by the company that came with Superfish, mostly laptops but with several tablet computers as well.
The point of Superfish was to make shopping easier for users, as the software analyzed images that the user sees while browsing the Internet then presented similar products with lower prices.
While Lenovo stressed that Superfish was not used to monitor the behavior of laptop owners or record personal information, cyber security experts are saying that the damage has already been done.
"They have not only betrayed their customers' trust, but also put them at increased risk," said Tripwire security analyst Ken Westin.
