Security Issue for Lenovo Laptops

Watch Leo Laporte The Tech Guy starting at the 3 minute mark on the Lenovo disaster.

Gene&Ginny wrote:
Lenovo is now on my "Do Not Buy" list. Any company that resorts to preinstalled malware should not be allowed to stay in business.

People easily forget...
Turbo Tax, McAfee, Symantec, the list is too long of products that have or have had malware in them... Google is one to watch as well...

Now there's a new one called PrivDog, pushed by Comodo. Ironically, Comodo is a certificate authority but their product PrivDog subverts the entire CA trust chain and silently trusts every certificate it sees.

RayJayco wrote:

People easily forget...
Turbo Tax, McAfee, Symantec, the list is too long of products that have or have had malware in them... Google is one to watch as well...

Exactly. We all enjoy many "free" benefits from the Internet but there is no free lunch.

The Internet is (in addition to its many benefits) one big marketing tool and those that don't realize this are naive. The best we can do is learn to carefully use it.

Lenovo used very poor judgement in their version of spying on us and I think it was particularly insidious. But to think that turning to other companies will avoid corporations that pad their quarterly earnings statements by spying on us is wishful thinking.

Large companies like Apple, Google, Facebook, Microsoft, Lenovo, etc, etc, are very sensitive to maintaining their reputation. Those that don't do not remain successful. We will see how Lenovo fares. But they have managed to thrive where IBM failed in the PC marketplace so I would not count them out.

AsheGuy wrote:

Exactly. We all enjoy many "free" benefits from the Internet but there is no free lunch.

The Internet is (in addition to its many benefits) one big marketing tool and those that don't realize this are naive. The best we can do is learn to carefully use it.

Lenovo used very poor judgement in their version of spying on us and I think it was particularly insidious. But to think that turning to other companies will avoid corporations that pad their quarterly earnings statements by spying on us is wishful thinking.

Large companies like Apple, Google, Facebook, Microsoft, Lenovo, etc, etc, are very sensitive to maintaining their reputation. Those that don't do not remain successful. We will see how Lenovo fares. But they have managed to thrive where IBM failed in the PC marketplace so I would not count them out.

There is a big difference between collecting your information for advertising and breaking your security. Lenovo, and other companies whose products use the Komodia technology and now Comodo have broken their users' security and unnecessarily put them at risk. Even if you know you're being sold as the product to the companies providing products & services for free, I don't think anyone expects to have their systems made insecure in this way.

bwanshoom wrote:
Even if you know you're being sold as the product to the companies providing products & services for free, I don't think anyone expects to have their systems made insecure in this way.

Right, and that is why I think insidious defines their action. I seriously doubt that if their execs had understood the system compromise that their spying technique would cause that they would have gone down this route. Of course, that is just my personal opinion.

I agree. One of the products found to include the same broken technology that Lenovo distributed is LavaSoft. They make Ad-Aware, an anti-virus/anti-malware product. So the people who purchased this, thinking they were securing their machines, were actually opening them up to be exploited. Someone in the product group made a decision to include the Komodia SDK and in this case they most certainly *should have known* exactly what they were bundling with their product. There's just no excuse.

Trust is difficultly earned and easily lost.

Thanks so much! Just purchased new Lenovo laptop last night and am using it right now. Ran the test which said I was at risk, followed instructions and was able to remove it.

Here is the statement by LavaSoft on the issue.

It appears that it was only their Web Companion product that was impacted, at least as far as they've disclosed.

Nothing on their website about this so I guess unless you just happen to stumble on this Facebook post you're not going to hear about the issue. Not exactly a full-disclosure situation.

AsheGuy wrote:

RayJayco wrote:

People easily forget...
Turbo Tax, McAfee, Symantec, the list is too long of products that have or have had malware in them... Google is one to watch as well...

Exactly. We all enjoy many "free" benefits from the Internet but there is no free lunch.

The Internet is (in addition to its many benefits) one big marketing tool and those that don't realize this are naive. The best we can do is learn to carefully use it.

Lenovo used very poor judgement in their version of spying on us and I think it was particularly insidious. But to think that turning to other companies will avoid corporations that pad their quarterly earnings statements by spying on us is wishful thinking.

Large companies like Apple, Google, Facebook, Microsoft, Lenovo, etc, etc, are very sensitive to maintaining their reputation. Those that don't do not remain successful. We will see how Lenovo fares. But they have managed to thrive where IBM failedin the PC marketplace so I would not count them out.

No, not everyone forgets... Maybe you need a bit of a history lesson. IBM started and OWNED the PC industry. There is a reason early PCs were known as "IBM compatible". To say they failed is laughable. It was Lenovo who has slowly driven the brand into the ground.

IBM to Quit Making PCs
Associated Press Email 12.03.04
NEW YORK -- IBM has reportedly put its personal computer business up for sale in a deal that could fetch as much as $2 billion and close an era for an industry pioneer that long ago shifted its focus to more lucrative segments of the computer business. Its stock rose 1.6 percent in early trading in the wake of the report.

AsheGuy wrote:

Right, and that is why I think insidious defines their action. I seriously doubt that if their execs had understood the system compromise that their spying technique would cause that they would have gone down this route. Of course, that is just my personal opinion.

Those execs have a responsibility to KNOW what is going on with their products. Ignorance is NO EXCUSE. We MUST vote with our dollars.