PC manufacturer Lenovo recognizes the Superfish adware it pre-installed on laptops can be potentially abused by attackers. The company has added a page to their support section about the adware on which we reported in January already.
Although it was already known Lenovo added adware to their laptops, this week it became clear the Superfish adware is a potential security risk. The Superfish adware was mainly installed on Lenovo laptops. The adware adds additional advertisements on websites and it's thought Lenovo receives commission when users click on them.
However, Superfish uses its own SSL certificates which normally guarantees the security of internet connections. Such certificates are used to e.g. guarantee that a connection to a bank is secure and nobody is eavesdropping on the connection. Superfish replaces original certificates and due to a leak it was possible for hackers to spy on internet traffic from users with Superfish installed.
Lenovo earlier confirmed it pre-installed the adware but promised the software wasn't installed on laptops since January. According to the company Superfish was also remotely removed from affected devices.
Nevertheless, the company didn't recognise the security risks of the Superfish adware. "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns," Lenovo stated.
However the company has added a new support page to their website on which the company writes the severity of the situation is 'high' and now also acknowledges Superfish is a security concern. Moreover, the company acknowledges that while Superfish can be deleted, the vulnerable certificate remains active.
Lenovo has also put a page online that explains how the certificate can be removed manually. The company also states it will consult with Superfish about a way of automated removal of the adware.
[poll id="15"]
