Security Issue for Lenovo Laptops

[bwanshoom]

Lenovo bundled adware that has a horrible security vulnerability. This impacts Lenovo branded laptops (although reportedly not Thinkpad) sold since at least October, although there are reports of laptops sold earlier being affected as well.

Essentially every HTTPS connection is intercepted and modified. The stated purpose was for advertising, but now it would allow any malware to mask as legitimate sites. This would allow someone to easily masquerade as your banking site and throw up no warnings or flags.

Here is a site that will tell you if you're at risk and gives instructions for removing the issue.

[rockhillmanor]

AsheGuy wrote:

RayJayco wrote:
People easily forget...
Turbo Tax, McAfee, Symantec, the list is too long of products that have or have had malware in them... Google is one to watch as well...

..Large companies like Apple, Google, Facebook, Microsoft, Lenovo, etc, etc, are very sensitive to maintaining their reputation..

They might be sensitive to maintaining THEIR reputation. But these companies are the very worst offenders of STEALING/SELLING your information.

Read the entire privacy policies on these it's all there in black and white as everyone mindlessly hits the 'I accept' button to gain access to a site.

I've taken an hour out of my life and read the 'entire' privacy policies on these and it is frighting what they state they WILL do with all your personal information knowing that everyone will just hit the 'i accept' button.

I just read of all things the privacy policy on the social security board where you input the most sensitive of sensitive personal info. They are even worse than google.

Click on I accept on the SS site and you've given them the right to hit your credit report each and every time you access the site, they sell your info to all credit card companies,and to each of your debits you have,etc etc., and if you are applying for food stamps they send all your personal info to your local sheriffs office data base!!!

[AsheGuy]

LANShark42: Do you have PMs blocked or just haven't checked? I sent you one a little after noon.

[LANShark42]

I lived through that era working in IT. But just because they left the market they had earlier created hardly makes them a failure. I saw a lot of IBM PCs, servers, laptops and even Token Ring in my day. As with WordPerfect and NetWare, sometimes the best technology didn't win the marketing wars.

And yes, he uses the term insidious. But, IMO, he goes on to defend the actions of those companies who are secretly loading dangerous software onto our PCs. To say that "The best we can do is learn to carefully use it." is wrong-thinking. We can (and I do) do more than that. We can decline to purchase products from those companies. That's one of the main things wrong with America today. Even when we recognize we are being harmed by Big Business (or the government) we shrug our shoulders and say "Oh well, there's nothing I can do about it so I'll just roll over and take it."

He also suggests company executives can deny culpability because they didn't know what the programmers were coding into their products. How is that not negligence?!?

I'll admit it's possible I'm misinterpreting his statements, but I really don't think so. Having worked for IBM for 36 years, I'm sure he is thoroughly indoctrinated in their "Big Business" mentality.

[bwanshoom]

LANShark42 wrote:
If that is the case, I'm all the more perplexed by your statement regarding IBM "failing" in the PC marketplace.

I think it's commonly believed that IBM did not do well in the PC marketplace over time. They dominated the consumer market for a while in the 80's, but started losing ground to the clones because they refused to license their architecture. They went from 75% to 25% market share in the consumer market in the 80's and they lost control of the industry they helped create. They continued to compete in the business market, but they're entirely out of hardware now so that says a lot.

The same thing happened to Word Perfect with word processing and Novell with networking - once dominant and now gone.

LANShark42 wrote:
But it might explain your sympathetic viewpoint and forgiveness of these large companies atrocities.

Are you reading the same messages I'm reading? AsheGuy described the recent actions as "insidious" - hard to see how that's sympathetic.

[LANShark42]

If that is the case, I'm all the more perplexed by your statement regarding IBM "failing" in the PC marketplace. But it might explain your sympathetic viewpoint and forgiveness of these large companies atrocities.

[AsheGuy]

LANShark42 wrote:
No, not everyone forgets... Maybe you need a bit of a history lesson. IBM started and OWNED the PC industry. There is a reason early PCs were known as "IBM compatible". To say they failed is laughable. It was Lenovo who has slowly driven the brand into the ground.

Maybe I do need a little history. I retired from IBM after working for them for 38 years.

And you need to do a little more research if you think Lenovo has driven the brand into the ground.

[LANShark42]

AsheGuy wrote:

RayJayco wrote:

People easily forget...
Turbo Tax, McAfee, Symantec, the list is too long of products that have or have had malware in them... Google is one to watch as well...

Exactly. We all enjoy many "free" benefits from the Internet but there is no free lunch.

The Internet is (in addition to its many benefits) one big marketing tool and those that don't realize this are naive. The best we can do is learn to carefully use it.

Lenovo used very poor judgement in their version of spying on us and I think it was particularly insidious. But to think that turning to other companies will avoid corporations that pad their quarterly earnings statements by spying on us is wishful thinking.

Large companies like Apple, Google, Facebook, Microsoft, Lenovo, etc, etc, are very sensitive to maintaining their reputation. Those that don't do not remain successful. We will see how Lenovo fares. But they have managed to thrive where IBM failedin the PC marketplace so I would not count them out.

No, not everyone forgets... Maybe you need a bit of a history lesson. IBM started and OWNED the PC industry. There is a reason early PCs were known as "IBM compatible". To say they failed is laughable. It was Lenovo who has slowly driven the brand into the ground.

IBM to Quit Making PCs
Associated Press Email 12.03.04
NEW YORK -- IBM has reportedly put its personal computer business up for sale in a deal that could fetch as much as $2 billion and close an era for an industry pioneer that long ago shifted its focus to more lucrative segments of the computer business. Its stock rose 1.6 percent in early trading in the wake of the report.

AsheGuy wrote:

Right, and that is why I think insidious defines their action. I seriously doubt that if their execs had understood the system compromise that their spying technique would cause that they would have gone down this route. Of course, that is just my personal opinion.

Those execs have a responsibility to KNOW what is going on with their products. Ignorance is NO EXCUSE. We MUST vote with our dollars.

[bwanshoom]

Here is the statement by LavaSoft on the issue.

It appears that it was only their Web Companion product that was impacted, at least as far as they've disclosed.

Nothing on their website about this so I guess unless you just happen to stumble on this Facebook post you're not going to hear about the issue. Not exactly a full-disclosure situation.

[tbred]

Thanks so much! Just purchased new Lenovo laptop last night and am using it right now. Ran the test which said I was at risk, followed instructions and was able to remove it.

[bwanshoom]

I agree. One of the products found to include the same broken technology that Lenovo distributed is LavaSoft. They make Ad-Aware, an anti-virus/anti-malware product. So the people who purchased this, thinking they were securing their machines, were actually opening them up to be exploited. Someone in the product group made a decision to include the Komodia SDK and in this case they most certainly *should have known* exactly what they were bundling with their product. There's just no excuse.

Trust is difficultly earned and easily lost.

[AsheGuy]

bwanshoom wrote:
Even if you know you're being sold as the product to the companies providing products & services for free, I don't think anyone expects to have their systems made insecure in this way.

Right, and that is why I think insidious defines their action. I seriously doubt that if their execs had understood the system compromise that their spying technique would cause that they would have gone down this route. Of course, that is just my personal opinion.

[bwanshoom]

AsheGuy wrote:

Exactly. We all enjoy many "free" benefits from the Internet but there is no free lunch.

The Internet is (in addition to its many benefits) one big marketing tool and those that don't realize this are naive. The best we can do is learn to carefully use it.

Lenovo used very poor judgement in their version of spying on us and I think it was particularly insidious. But to think that turning to other companies will avoid corporations that pad their quarterly earnings statements by spying on us is wishful thinking.

Large companies like Apple, Google, Facebook, Microsoft, Lenovo, etc, etc, are very sensitive to maintaining their reputation. Those that don't do not remain successful. We will see how Lenovo fares. But they have managed to thrive where IBM failed in the PC marketplace so I would not count them out.

There is a big difference between collecting your information for advertising and breaking your security. Lenovo, and other companies whose products use the Komodia technology and now Comodo have broken their users' security and unnecessarily put them at risk. Even if you know you're being sold as the product to the companies providing products & services for free, I don't think anyone expects to have their systems made insecure in this way.

[AsheGuy]

RayJayco wrote:

People easily forget...
Turbo Tax, McAfee, Symantec, the list is too long of products that have or have had malware in them... Google is one to watch as well...

Exactly. We all enjoy many "free" benefits from the Internet but there is no free lunch.

The Internet is (in addition to its many benefits) one big marketing tool and those that don't realize this are naive. The best we can do is learn to carefully use it.

Lenovo used very poor judgement in their version of spying on us and I think it was particularly insidious. But to think that turning to other companies will avoid corporations that pad their quarterly earnings statements by spying on us is wishful thinking.

Large companies like Apple, Google, Facebook, Microsoft, Lenovo, etc, etc, are very sensitive to maintaining their reputation. Those that don't do not remain successful. We will see how Lenovo fares. But they have managed to thrive where IBM failed in the PC marketplace so I would not count them out.

[bwanshoom]

Now there's a new one called PrivDog, pushed by Comodo. Ironically, Comodo is a certificate authority but their product PrivDog subverts the entire CA trust chain and silently trusts every certificate it sees.