March 5, 2015 By Shane Schick 2 min read

Barely a week after becoming the poster child for preinstalling insecure adware, Lenovo says it is changing what it puts on its machines to avoid another Superfish fiasco — though not in time to avoid further investigation by authorities.

Picking Up the Pieces

As detailed in a story on CIO Today, Lenovo pledged to provide McAfee antivirus software to its PC customers free of charge for half a year. It also said it would cut back on software such as Superfish that comes preinstalled on its hardware in a bid to improve the overall security of its products and its users’ data.

Lenovo has been caught in the cross hairs of security critics over Superfish, software that is designed to improve Web browsing experiences by replacing generic online ads with more contextual ones. This opened up a hole through which cybercriminals could bypass the security of HTTPS connections and steal personal information via man-in-the-middle attacks. Lenovo created a tool to automatically deal with the problem within days of it being discovered.

Superfish Investigation

Just as it promises to get its act together, however, Lenovo stands to face greater scrutiny over how this insecure software managed to end up on its PCs in the first place. As Reuters reported, the Connecticut Attorney General’s Office is launching a probe that will delve into Lenovo and the firm that created the Superfish adware.

Though the results of that investigation may not be known for months, Lenovo’s strategy in the meantime appears to be educating everyday PC users about what they’re getting into when they boot up their system for the first time. The company plans to provide a listing of preloaded applications, IT PRO said, which theoretically shifts the onus onto consumers. However, this assumes consumers would recognize the risks, but it may take security researchers or PC reviewers to flag anything that should concern them.

Unfortunately, the worst may not be over for Lenovo. As VPN Creative reported, the network of cybercriminals-for-hire known as Lizard Squad has apparently been boasting about taking down the firm’s site and releasing secrets at a later date. In the meantime, an expert on ZDNet has called for PC manufacturers to publicly disclose how much money they earn by using preinstalled software on their products. For Lenovo and a host of others, admitting those kinds of financial details could mean they have to prove the security of their customers’ personal data is worth even more.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today