If you have a connection to the internet, you probably haven’t been able to turn around twice this week without hearing about the Superfish adware that’s appeared on Lenovo’s systems.
Users of Windows machines have long since grown accustomed to the practice of various hardware vendors installing all manner of bloatware on their products prior to purchase. Dell ShareZone, Samsung Music Thing, HP Print Something or Other, all forgettable pieces of software that only our grandparents use -but until now they were generally innocuous enough not to raise an alarm.
Now all that has changed with the introduction of Superfish, which Lenovo was bundling as part of the stock softare installed on laptops and desktops brandishing its logo. The software broke the SSL chain between a browser and the Internet, so it could inject ads into everyday browsing destinations. That’s bad enough, but it also means anyone who hijacks the adware’s security certificate, which is protected by a single password that’s already cracked, can inject other, even more malicious content or read data that’s supposed to be encrypted.
Related: Lenovo PCs with Superfish adware contain critical security vulnerability
Luckily, Microsoft was lightning quick to respond to the problem, and has updated its Microsoft Security Essentials suite with a patch that can root out the problem post haste.
Following the dust-up, Lenovo’s CTO Peter Hortensius has come out to publicly apologize for the debacle in an interview with PCWorld, where he readily admits that his company “messed up, and added “going forward, we feel quite strongly that we made a significant mistake here.”
The company responsible for developing Superfish, Komodia, has come under fire from Internet vigilantes in the form of a massive denial of service attack which has apparently shut down the company’s operations. Komodia has so far refused to admit any wrong-doing, which is not unexpected. Adware is the company’s product, after all, so disowning Superfish would mean abandoning a key piece of software.
Lenovo, however, has posted updated uninstall instructions that allegedly remove not only the software, but also the HTTPS security certificate exploit which made Superfish a problem in the first place.
