Lenovo faced a public outcry after it emerged that some consumer laptops came preloaded with Superfish adware, known as VisualDiscovery. The software injected adverts into web pages and, to do so, intercepted encrypted HTTPS traffic in a way that undermined users’ security.
What happened
- Superfish installed its own root certificate and acted as a man-in-the-middle, replacing website certificates so that it could inspect encrypted traffic.
- The same certificate and easily cracked password were used on every affected machine, so attackers could impersonate secure websites without browsers warning users.
- Lenovo said it had preinstalled the software on dozens of consumer laptop and tablet models from late 2014, stopped doing so in January 2015, and disabled it server-side.
- In September 2017 Lenovo settled with the US Federal Trade Commission and 32 state attorneys general, agreeing to obtain consent for such software and to run a security programme with independent audits for 20 years.
Why it mattered
Superfish showed how preinstalled third-party software can silently weaken the security of new devices, and how a single shared secret can expose every customer at once.
Lessons for organisations
Build a clean, verified image for new devices rather than trusting factory builds, and apply security and privacy review to any third-party components bundled with your own products.
Sources: CNN Money, Federal Trade Commission
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
