Barely a week after becoming the poster child for preinstalling insecure adware, Lenovo says it is changing what it puts on its machines to avoid another Superfish fiasco — though not in time to avoid further investigation by authorities.
Picking Up the Pieces
As detailed in a story on CIO Today, Lenovo pledged to provide McAfee antivirus software to its PC customers free of charge for half a year. It also said it would cut back on software such as Superfish that comes preinstalled on its hardware in a bid to improve the overall security of its products and its users’ data.
Lenovo has been caught in the cross hairs of security critics over Superfish, software that is designed to improve Web browsing experiences by replacing generic online ads with more contextual ones. This opened up a hole through which cybercriminals could bypass the security of HTTPS connections and steal personal information via man-in-the-middle attacks. Lenovo created a tool to automatically deal with the problem within days of it being discovered.
Superfish Investigation
Just as it promises to get its act together, however, Lenovo stands to face greater scrutiny over how this insecure software managed to end up on its PCs in the first place. As Reuters reported, the Connecticut Attorney General’s Office is launching a probe that will delve into Lenovo and the firm that created the Superfish adware.
Though the results of that investigation may not be known for months, Lenovo’s strategy in the meantime appears to be educating everyday PC users about what they’re getting into when they boot up their system for the first time. The company plans to provide a listing of preloaded applications, IT PRO said, which theoretically shifts the onus onto consumers. However, this assumes consumers would recognize the risks, but it may take security researchers or PC reviewers to flag anything that should concern them.
Unfortunately, the worst may not be over for Lenovo. As VPN Creative reported, the network of cybercriminals-for-hire known as Lizard Squad has apparently been boasting about taking down the firm’s site and releasing secrets at a later date. In the meantime, an expert on ZDNet has called for PC manufacturers to publicly disclose how much money they earn by using preinstalled software on their products. For Lenovo and a host of others, admitting those kinds of financial details could mean they have to prove the security of their customers’ personal data is worth even more.