So Lenovo had a very bad week, and I'm not talking about a bad week the way a company has a bad quarter. I'm talking about the kind of bad week where security researchers pull apart your factory software image and find out you shipped a root certificate that lets basically anyone snoop on HTTPS traffic to Bank of America.
Quick version for anyone who hasn't been following: starting sometime last September, a bunch of consumer Lenovo laptops came preloaded with something called Superfish "Visual Discovery," an adware thing that injects extra shopping results into your browsing. Annoying, sure, but bloatware has been annoying since forever and I've mostly made peace with it. The actual problem is how Superfish did the injecting. To mess with encrypted HTTPS pages it installed its own self-signed root certificate system-wide, and it used the SAME private key on every single affected machine. Same key, every laptop, out of the box. Once that got noticed this week, it took security people something like a few hours to crack the password protecting it (I've seen "komodia," after the company that made the interception library Superfish was built on). Once you have that key, you can forge certificates for any site you want and any Lenovo machine running Superfish will trust it without blinking. Your bank, your email, whatever.
Lenovo's statement was the usual "we hear you, we're disabling server-side triggering, safety of our users is our top priority" corporate mush, plus a promise not to preload it going forward. Which, fine, but the laptops already sold with it are still out there, and disabling the ad-injection on Lenovo's end doesn't rip the certificate out of the Windows cert store. People need to actually go remove it themselves, and I'd bet real money that the overwhelming majority of Lenovo owners have never heard the word Superfish and never will.
Here's my actual gripe, and it's bigger than one company. I've been the designated "can you set up my new laptop" person for family since way before this blog started, and every single time it's the same ritual: unbox it, boot straight into an ocean of trialware, spend forty-five minutes uninstalling six different antivirus trials, a Dropbox thing nobody asked for, some registry cleaner that's basically malware itself, three shortcuts to games nobody will play, and usually something that hijacks the browser homepage. I did this for my sister's HP over Christmas and it took longer than actually setting up her email. This stuff exists because OEMs get paid by the software vendors to preload it — it's not a mistake, it's a revenue line. Superfish is just the first time that particular revenue line turned out to be a straight-up security hole instead of merely an irritant. I don't think that's a coincidence so much as an inevitability. If you're going to let third parties buy space on the factory image, eventually one of them is going to do something genuinely dangerous instead of just ugly, because nobody at the OEM is auditing the code, they're auditing the check that cleared.
My honest take: I will not buy an OEM Windows laptop for anyone in my family again without immediately doing a clean Windows reinstall from a plain Microsoft ISO, no exceptions, doesn't matter if it's a $400 laptop or a $1200 one. I used to think that was overkill and slightly paranoid. As of this week I think it's the bare minimum. If you've got a Lenovo bought in the last several months, go check Programs and Features for "Superfish" and also check your certificate store (certmgr.msc, Trusted Root Certification Authorities) for anything with Superfish in the name, because Lenovo's uninstaller in some cases didn't even pull the certificate cleanly the first time around.
Also, small tangent, but I keep seeing people in comments elsewhere say "well I never noticed any weird popups so I guess I'm fine," and that's not really how this works — the injected ads were sometimes subtle enough you'd blame the website, and more importantly the certificate risk exists whether or not you ever saw a single ad. The visible symptom and the actual danger are two different things here, and that gap is exactly what makes this kind of thing stick around for months before anyone notices.
Anyway. Go check your laptop.