What a mess.
I guess there is something to be said about “clean” OS installs…even for brand-spanking-new hardware.
What I find interesting in this particular event (now that the initial dust seems to have settled) are both the analysis of the threat created and the removal techniques; especially the manual removal process.
For Cleanup
- Superfish Uninstall Instructions - Lenovo Support (US) – Automated tool and manual removal instructions from the folks who kindly made the mess to begin with.
- Lenovo redeems itself with open source Superfish removal tool – Betanews
- Lenovo and the Superfish fiasco - Malwarebytes Unpacked
- Removal instructions for Superfish - Malware Removal Guides and Self Help Guides - Malwarebytes Forum
- How to remove the Superfish malware: What Lenovo doesn’t tell you - Ars Technica
- Windows Defender now removes Superfish malware… if you’re lucky - Ars Technica
For Background
- Superfish: PC makers say crapware is for your own good [Updated x2] - TechBlog
- Superfish doubles down, says HTTPS-busting adware poses no security risk - Ars Technica
- Lenovo honestly thought you’d enjoy that Superfish HTTPS spyware - Ars Technica
- Man-in-the-Middle Attacks on Lenovo Computers – Schneier on Security
- Lenovo pre-installing Superfish adware on its notebooks, rendering them insecure [Updated x5] – TechBlog
- LEN-2015-010: Superfish Vulnerability - Lenovo Support (US)
Better bring an extra mop…
--Claus Valca
2 comments:
Remind me never to buy a Lenovo product again. Did own a Lenovo laptop when I returned to school in 2011. It was okay, didn't really work that well for what I needed (network simulation software) even with 8 GB of RAM, suspect it had to do with the small on board cache. I ended up passing it on to a family member who just uses it for Internet.
I was rather shocked to hear about this over the weekend though. Very bad move on their part.
@ FF Extension Guru - It looks like the mess is continuing to grow and spread with identification of other companies using a similar strategy.
I expect to see this get even more traction as deeper reviews are done of other similar "partnerships" with other software companies.
Stay tuned for details....this may be just as messy as the old Sony "rootkit" fiasco from many years ago.
May or may not make the front page but I think the security sharks will be circling.
Cheers!
--Claus V.
Post a Comment