Only, last week Marc Rogers, a Lenovo user and security researcher updated his blog with the detailed analysis of the Superfish MiTm adware on Lenovo’s models such as G Series, U Series, Y Series, Z Series, S Series, Flex, Miix, Yoga and E Series. This stirred up a strong reaction from the customers who were using the Lenovo models for most of their business purposes. Later in the day, Lenovo admitted to having pre installed the Superfish adware, but only to help their customers find similar products at a lower price. However the Lenovo users were still agitated because the Superfish adware gave Lenovo and its marketing partners an easy access to the their browsing details and this was a HTTPS man-in-the-middle attack. Facing a barrage of criticism, Lenovo finally accepted its blunder and also issued an open-source Superfish removing tool to uninstall this adware and remove the root HTTPS certificate which was actually collecting the data of all the websites which the user visited. While the barrage of complaints and abuses against Lenovo have subsided, California resident, Jessica N. Bennett doesnt think this is enough and Lenovo ought to pay more for invasion of her privacy and breach of trust. Jessica has filed Class Action lawsuit against this fraud of Lenovo and Superfish in U.S. District Court for the Southern District of California. As per Jessica’s complaint, the pre installed Superfish adware which she has referred to “spyware” has damaged her laptop. She has also indicted Lenovo and Superfish both of spying on her and using her browsing habits to make money. The lawsuit charges both the firms for their “fraud” business practices by pre-loading the adware which made Lenovo PC’s vulnerable to the malicious attacks. Bennett, had purchased a Yoga 2 Laptop for business purpose and she found some spam advertisements on her client’s website when she wrote a blog post for her customer. Her initial reaction was that her laptop has been hacked however when a detailed investigation was done, she could make it out it was the Superfish adware which intercepts encrypted traffic for every website a user visits and hence leaves the computer vulnerable to attacks. She also blamed that the malware took up internet bandwidth and slowed down her PC by using the memory resources just for making money. Superfish adware is basically a self-signed root HTTPS certificate installed to get the data of all the websites visited by users. Due to this Lenovo machines are vulnerable to attackers who could potentially use the certificate to create fake HTTPS websites which the Lenovo machines were not able to detect hence any hacker can easily steal user’s personal data like credit card details, etc. and use it to make illicit money. This can be termed as “remote monitoring of the Lenovo user’s web activity”. Lenovo said it had stopped installation of Superfish adware since Jan 2015 due to some complaints from its customers for interfering pop up ads in their browser however they did not have any idea regarding the security vulnerability. Superfish has something different to say, they are insisting that the software is safe however security issue was unintentionally introduced by a third party which is now identified as Kamodia. Komodia is a tech startup based in Israel that makes software for other companies, including tools for companies that show online ads and for programs parents can use to monitor their children’s Web surfing. The Komodia tool could jeopardize any company or program using the same code. “It’s not just Superfish, other companies may be vulnerable,” said Robert Graham, CEO of Errata Security. Ars Technica has meanwhile reported that there are dozen more Apps which are vulnerable to similar attacks because they use the same MiTm method. Infact one of the Apps has been categorized as a malicious trojan by Symantec and dubbed as Trojan.Nurjax. Looks like the Superfish adware saga will leave Lenovo fishing in deep bottomless sea.
