Lenovo pays $3.5 million fine for pre-installing Superfish adware

The Conflict Reaches its Climax

If you have purchased a Lenovo computer between the second half of 2014 and 2015, you are likely to have become one of the discontent users who found an unpleasant surprise on their devices – Superfish adware.

Due to obvious security flaws and its tendency to promote third party ads, on February 20, the US Department of Homeland Security warned users to uninstall the software for its weak CA certificate which grants the ability for perpetrators to hijack HTTPS.^[1]

Consumers who were unlucky enough to purchase the infected laptops, soon noticed the troublesome behavior of the software to plague their browsing sessions with ads and redirections to insecure domains.

Luckily, their fury was not wasted: the Federal Trade Commission (FTC) demanded Chinese-based Lenovo company to admit the fault. Finally, after a couple of years of litigation, Lenovo agreed to the charges. Is it a big win for the consumers?

What‘s Superfish?

Superfish alternatively known as VisualDiscovery serves as adware program which plagues your browsing with annoying commercial offers. However, it does so by acting as a proxy and accesses your network. In short, it starts monitoring which websites you are visiting and places its adware scripts there.

As a result, wherever you go, you might get distracted by “Powered by Visual Discovery” ads.^[2] Besides this annoyance, such phenomenon makes the entire device subject to vulnerabilities, and, therefore, to cyber assaults.

Changing Attitude

When users started complaining about such insidious software pre-installed in their brand new Lenovo laptops in the beginning of 2015, the company tried to shed any responsibility and denying the charges.

Unfortunately complaining in Lenovo forums did not do any good until IT experts discovered the insidious behavior of the app to replace websites’ security certificates with its code. In addition, the software made sensitive personal information vulnerable to data theft. Finally, the matter attracted US FTC attention.

Though Lenovo still claims of not being aware of the security flaws, it has agreed to make the fine amounting to $3.5 million and pay it to 32 US states.^[3] In addition, it also pledged to install a cyber security tool (under constant audit) in new devices for the next 20 years. Unfortunately, this is not the first case of when new computers get compromised with dubious applications.

A couple of months ago, malware was found in 38 new Android model devices and distributed by two companies.^[4] Unfortunately, one of the malicious program called Loki (Locky ransomware related?) was even able to get access to system administration rights.

Thus, regarding these past incidents, it makes perfect sense to scan your newly purchased computer with malware elimination tool. Mobile users might find restoring factory default settings quite useful as well.