The discovery last week that Lenovo laptops had been shipping with preinstalled adware that left users wide open to security exploitation triggered a lot of righteous anger in the tech community. David Auerbach at Slate wrote that Lenovo had “betrayed its customers and sold out their security”. Whenever a big company does something so monumentally foolish, it’s worth stepping back and asking how this could have happened.
But first, let’s review what happened. Lenovo laptops came preinstalled with adware from a company called Superfish, which intercepted users’ web traffic in order to insert ads. The adware would intercept even encrypted (https) connections, a capability it achieved by including software written by a company called Komodia. If the user tried to make a secure connection to, say, https://bank.com, the Komodia software would impersonate bank.com to the user’s computer, so that it could get its hands on the secure traffic that the user thought was going directly to the bank. The Komodia software succeeded at impersonation because it (1) modified the user’s computer to allow a certain private cryptographic key to vouch for the identity of any site, and then (2) using that private key, which was baked in to the Komodia software, to carry out the impersonation. Later, researchers discovered that in some cases Komodia accepted a site’s claimed identity without verification, making impersonation attacks even easier.
That’s a somewhat involved scenario, but the upshot is this: anyone on the net could impersonate any site to any affected Lenovo laptop user. Users’ email, private files, finances, online health information, and so on were wide open.
When this came to light, the fingerpointing began. Lenovo first said, implausibly, that the security problem was only theoretical, and anyway the software helped users by presenting them with ads for useful products. Later, Lenovo admitted error and pledged to issue a patch to close the hole. Superfish has said that its product is legitimate and the fault is Komodia’s. Komodia has been silent, as far as I can tell.
A stranger to today’s tech market would ask: Why in the world would a company like Lenovo include in its product a security-critical component, made by a small unrelated company, that has not been carefully vetted? Yet this practice seems to be common, and especially where ads are concerned. Mobile apps often include third-party ad libraries, and many publishers allow unrelated parties, which they hope are only placing ad content, to include material (and often software code) on their pages. Unchecked third-party inclusions of code are a ticking time bomb for many companies. In Lenovo’s case, the bomb went off, but others are equally vulnerable.
Superfish’s response has been a classic of security flaw denialism. Here’s an excerpt:
Despite the false and misleading statements made by some media commentators and bloggers, the Superfish software does not present a security risk. In no way does Superfish store personal data or share such data with anyone. Unfortunately, in this situation a vulnerability was introduced unintentionally by a 3rd party.
The only way to read this as anywhere close to true is to postulate that Komodia is an unrelated party whose software somehow got onto the same computer as Superfish’s—as opposed to something that Superfish shipped as part of its product. Not to mention that if there was an “unintentional” vulnerability, it could only have been the extra vulnerability discovered at the end. The original vulnerability, the use of a private key installed everywhere that could impersonate any site to any affected user, could only have been a deliberate design decision by Komodia. And there was plenty of reason to suspect trouble with Komodia’s product—if somebody says they can intercept other people’s encrypted communications, it’s a good guess that they are doing something irregular.
If any good comes from this mess, it will be because companies learn from Lenovo’s experience and start paying closer attention to what they are including in their products. When a computer maker installs junkware on their systems, they are doing more than making a few pennies. They are putting their users at risk. Companies that respect their customers should refuse to do that.
Leave a Reply