When Lenovo preinstalled Superfish adware on its laptops, it betrayed its customers and sold out their security. It did it for no good reason, and it may not even have known what it was doing. I’m not sure which is scarier. The various news reports of this catastrophe don’t quite convey the sheer horror and disbelief with which any technically minded person is now reacting to Lenovo’s screw-up. Security researcher Marc Rogers wrote that it’s “quite possibly the single worst thing I have seen a manufacturer do to its customer base. … I cannot overstate how evil this is.” He’s right. The Lenovo Superfish security hole is really, really bad.
To recap: Since at least September, Lenovo has been shipping OEM Windows laptops preloaded with Superfish “adware,” which would rudely inject its own shopping results into your browser when you searched on Google, Amazon, and other websites. This sort of behavior is associated more with spyware than with factory-shipped operating-system installs, and by itself would be a new low for Lenovo. But Superfish is more than just pesky. It’s the most virulent, evil adware you could find.
By installing a single self-signed root certificate (trust me: That’s really bad) across all of Lenovo’s affected machines, Superfishintentionally pokes a gigantic hole into your browser security and allows anyone on your Wi-Fi network to hijack your browser silently and collect your bank credentials, passwords, and anything else you might conceivably type there. As Errata Security’s Robert Graham put it, “I can intercept the encrypted communications of SuperFish’s victims (people with Lenovo laptops) while hanging out near them at a cafe wifi hotspot.” If you have a Lenovo laptop that has Superfish on it (try Filippo Valsorda’s Superfish test to see), I would advise nothing short of wiping the entire machine and installing vanilla Windows—not Lenovo’s Windows. Then change all of your passwords.
So ghastly a perversion is Superfish’ self-signed root certificate that many of us have practically been walking around with our jaws on the floor since the news broke Wednesday night. My Facebook wall is filled with outraged profanity from software engineers. Installing Superfish is one of the most irresponsible mistakes an established tech company has ever made. Reckless, careless, and appalling don’t even come close to covering it.
The closest antecedent is the Sony DRM rootkit scandal of 2005, in which Sony automatically installed malware onto users’ computers whenever someone loaded certain of their CDs. That rootkit malware could be hijacked by another hacker, and in its shortsighted greed Sony did nothing to stop piracy while compromising the security of millions of users. But at least Sony had a clear (though futile) motive—stopping people from freely ripping its CDs. Lenovo claims it installed Superfish to “enhance our users’ shopping experience.” Whatever commissions Lenovo mighthave received from Superfish must have been paltry, especially compared with the severity of Superfish’s root-certificate hole—which, stunningly, leaves users even more exposed than Sony’s rootkit did. Lenovo sold its soul to the devil and forgot to get much of anything in return. Homer Simpson would’ve made a better Faustian bargain.
Lenovo must have known about this problem since at least Jan. 21, when an apoplectic user posted a detailed description of Superfish and its problems to a Lenovo forum and incredulously requested a refund. His post went unanswered (until Thursday), leaving a month for hackers around the world to get busy trying to exploit this incredibly exploitable malware.
And sure enough, Lenovo’s subsequent behavior has reached “What, me worry?” levels of denial, with the company bringing the same skill to damage control that it brought to factory installations. Lenovo’s initial statement on Thursday was utter bull:It claimed Superfish had been disabled and posed no threat, even though merely uninstalling Superfish doesn’t remove the evil root certificate. As the outrage grew, Peter Hortensius, Lenovo’s chief technology officer, proceeded to insult my intelligence and yours in an interview with the Wall Street Journal in which he vaguely acknowledged a problem and then brushed it away: “We’re not trying to get into an argument with the security guys. They’re dealing with theoretical concerns. We have no insight that anything nefarious has occurred.” This is akin to saying that, yes, your security company left your house unlocked, but we just don’t know if anyone walked right in. Any self-respecting Lenovo security engineer would have vetoed those words, the disingenuous and infuriating statement of an unprepared executive who doesn’t care enough about the safety of his customers to get the facts straight.
There’s plenty more blame to go around. There is Superfish, a Palo Alto, California-based company that also makes visual search apps, and that would shock Edward Snowden and make the NSA blush. Led by shady surveillance veteran Adi Pinhas, the company has a long history of disseminating adware, spyware, malware, and crapware, as chronicled by Forbes’ Thomas Fox-Brewster, who traced Pinhas’ ties to a whole host of privacy-violating companies. Residing somewhere in the bottom-feeding nether-regions of the tech ecosystem, such companies contribute less to society than Farmville did. Pinhas denied any malfeasance on Thursday, agreeing with Lenovo’s initial statement and then going silent. With any luck, he’ll be a Cinnabon manager before long. Superfish had five primary enablers in the form of venture capital firms that financed the startup to the tune of $20 million: Vintage Investment Partners, Draper Fisher Jurvetson, DFJ Tamir Fishman Ventures, Xenia Venture Capital, and the Individuals’ Venture Fund. Did the VCs know they were fueling what is essentially an expensive Trojan horse? Did they care?