Security Issue for Lenovo Laptops

[bwanshoom]

Lenovo bundled adware that has a horrible security vulnerability. This impacts Lenovo branded laptops (although reportedly not Thinkpad) sold since at least October, although there are reports of laptops sold earlier being affected as well.

Essentially every HTTPS connection is intercepted and modified. The stated purpose was for advertising, but now it would allow any malware to mask as legitimate sites. This would allow someone to easily masquerade as your banking site and throw up no warnings or flags.

Here is a site that will tell you if you're at risk and gives instructions for removing the issue.

[RayJayco]

Gene&Ginny wrote:
Lenovo is now on my "Do Not Buy" list. Any company that resorts to preinstalled malware should not be allowed to stay in business.

People easily forget...
Turbo Tax, McAfee, Symantec, the list is too long of products that have or have had malware in them... Google is one to watch as well...

[8_1_Van]

Watch Leo Laporte The Tech Guy starting at the 3 minute mark on the Lenovo disaster.

[LANShark42]

bwanshoom wrote:

AsheGuy wrote:

Most consumer PCs are laden with bloatware when shipped and require "cleaning up" upon installation by the user (if they know how to do that). And, of course, all our smartphones and tablets monitor our every move. It' all part of milking as much profit as possible from the consumer.

Many companies don't own up to their mistakes when they make one, I think Lenovo has. I may be biased because I own a Lenovo Thinkpad that I have had about 4 years and a new Lenovo desktop that I just purchased this year. Both have been outstanding products. And I am planning to replace my laptop this year with another one from Lenovo, not withstanding this misstep on their part.

I strongly disagree. Lenovo's first step was to deny, deny, deny. Then they downplayed it and only when the publicity grew to a certain level did they "own up to it". Their original decision put all their users at risk and in my mind, that's the decision that counts. When it came down to chasing dollars or doing the right thing they opted to chase dollars. Only when they got caught and people yelled loud enough did they backtrack. Disgraceful.

As an IT professional, I have to go with BWanshoom on this one. "Fool me once, shame on you. Fool me twice, shame on me." I own 2 Lenovo laptops. Never again. And I will tell everyone I know to stay away from their products as well. I don't give 2nd chances when it comes to the security of my data.

[AsheGuy]

bwanshoom wrote:
Disgraceful.

I said your's was a perfectly reasonable reaction. I just reacted differently. To each, his own.

[bwanshoom]

AsheGuy wrote:

Most consumer PCs are laden with bloatware when shipped and require "cleaning up" upon installation by the user (if they know how to do that). And, of course, all our smartphones and tablets monitor our every move. It' all part of milking as much profit as possible from the consumer.

Many companies don't own up to their mistakes when they make one, I think Lenovo has. I may be biased because I own a Lenovo Thinkpad that I have had about 4 years and a new Lenovo desktop that I just purchased this year. Both have been outstanding products. And I am planning to replace my laptop this year with another one from Lenovo, not withstanding this misstep on their part.

I strongly disagree. Lenovo's first step was to deny, deny, deny. Then they downplayed it and only when the publicity grew to a certain level did they "own up to it". Their original decision put all their users at risk and in my mind, that's the decision that counts. When it came down to chasing dollars or doing the right thing they opted to chase dollars. Only when they got caught and people yelled loud enough did they backtrack. Disgraceful.

[bwanshoom]

wa8yxm wrote:
From what I have seen the first steps after you open a box with a computer in it are..

1 Install a GOOD Firewall, the one bundled is not as good as the one I use (Zone Alarm)
2: (here you can wait till the pre-paid subscription runs out) A good Anti Mal-ware program.. I have a few I use.. Install at least 2 (one right away, and that one should be Malware Bytes free edition) This one is run on demand. I also have a resident program which I will not name. Run Malware Bytes daily.

3: DE-CRAP-AFY.. Get rid of most all the bundled******ware they put on.

4: Instal Apache Open Office (Way better than any Windows product)

Now you can get your choice of Browser,, and News Reader and such.. Do not install a E-Mail client, use web mail (Far more secure and convenient since Web mail is shared across all your devices and even the library should you choose to use their machine)

In my case I also install radio control software (Controls my radios) and some other stuff I need or local use but that's goign to depend on local needs.

Those are good steps, but none of them would have helped in this instance. While your HTTPS connections would no longer be getting intercepted, the vulnerability for others to exploit you would have remained.

When possible, I reformat and re-install from scratch after taking note of what drivers are required. Still, that's a pain for most and beyond the abilities of most average users.

[wa8yxm]

From what I have seen the first steps after you open a box with a computer in it are..

1 Install a GOOD Firewall, the one bundled is not as good as the one I use (Zone Alarm)
2: (here you can wait till the pre-paid subscription runs out) A good Anti Mal-ware program.. I have a few I use.. Install at least 2 (one right away, and that one should be Malware Bytes free edition) This one is run on demand. I also have a resident program which I will not name. Run Malware Bytes daily.

3: DE-CRAP-AFY.. Get rid of most all the bundled******ware they put on.

4: Instal Apache Open Office (Way better than any Windows product)

Now you can get your choice of Browser,, and News Reader and such.. Do not install a E-Mail client, use web mail (Far more secure and convenient since Web mail is shared across all your devices and even the library should you choose to use their machine)

In my case I also install radio control software (Controls my radios) and some other stuff I need or local use but that's goign to depend on local needs.

[AsheGuy]

Gene&Ginny wrote:
Lenovo is now on my "Do Not Buy" list. Any company that resorts to preinstalled malware should not be allowed to stay in business.

A perfectly reasonable reaction. But, I think Lenovo has taken the high road in this incident:



Most consumer PCs are laden with bloatware when shipped and require "cleaning up" upon installation by the user (if they know how to do that). And, of course, all our smartphones and tablets monitor our every move. It' all part of milking as much profit as possible from the consumer.

Many companies don't own up to their mistakes when they make one, I think Lenovo has. I may be biased because I own a Lenovo Thinkpad that I have had about 4 years and a new Lenovo desktop that I just purchased this year. Both have been outstanding products. And I am planning to replace my laptop this year with another one from Lenovo, not withstanding this misstep on their part.

[Gene_Ginny]

Lenovo is now on my "Do Not Buy" list. Any company that resorts to preinstalled malware should not be allowed to stay in business.

[sherlock62]

Lenovo owner's here should read here and elsewhere in order that they are not at risk.

[hilldude]

That was a dumb move,greed can hurt sales.

[cleo43]

Moves like this are suicidal for a company.