Lenovo’s Official Statement about the Superfish Incident; List of impacted systems

There is no doubt over the last 24 hours or so you have heard and read a lot about this entire Superfish malware incident with Lenovo. We now have an official statement from Lenovo they shared with us.

Richard Hay, Senior Content Producer

February 20, 2015

4 Min Read
Lenovo’s Official Statement about the Superfish Incident; List of impacted systems

There is no doubt over the last 24 hours or so you have heard and read a lot about this entire Superfish malware incident with Lenovo.

Also read: My Take on Lenovo, OEMS and Junkware on new computers and  Microsoft vs. SuperFish here at the SuperSite for Windows.

Lenovo has released a few different statements over that same period of time plus they have been active on social media eventually taking ownership of the poor decisions that were made. In addition, they have promised to move the discussion forward within the industry relating to what is pre-installed on consumer computers.

Of course, as a couple of commenters have said on our site and social media, Lenovo’s actions will speak louder than any apology they offer.

The following is an official statement from Lenovo about the incident and wraps all the different sources up into one bundle.

At Lenovo, we make every effort to provide a great user experience for our customers.  We know that millions of people rely on our devices every day, and it is our responsibility to deliver quality, reliability, innovation and security to each and every customer. In our effort to enhance our user experience, we pre-installed a piece of third-party software, Superfish (based in Palo Alto, CA), on some of our consumer notebooks. 

We thought the product would enhance the shopping experience, as intended by Superfish. It did not meet our expectations or those of our customers. In reality, we had customer complaints about the software.  We acted swiftly and decisively once these concerns began to be raised. We apologize for causing any concern to any users for any reason – and we are always trying to learn from experience and improve what we do and how we do it. Superfish technology does not profile nor monitor user behavior.  It does not record user information. It does not know who the user is. Users are not tracked nor re-targeted.   Every session is independent. Users are given a choice whether or not to use the product.  
 
We stopped the preloads beginning in January. We shut down the server connections that enable the software (also in January, and we are providing online resources to help users remove this software.  Finally, we are working directly with Superfish and with other industry partners to ensure we address any possible security issues now and in the future. Detailed information on these activities and tools for software removal are available here:
 
http://support.lenovo.com/us/en/product_security/superfish
http://support.lenovo.com/us/en/product_security/superfish_uninstall
 
To be clear: Lenovo never installed this software on any ThinkPad notebooks, nor any Lenovo desktops or  smartphones. This software has never been installed on any enterprise product -- servers or storage -- and these products are in no way impacted. And, Superfish is no longer being installed on any Lenovo device. In addition, we are going to spend the next few weeks digging in on this issue, learning what we can do better. We will talk with partners, industry experts and our users. We will get their feedback. By the end of this month, we will announce a plan to help lead Lenovo and our industry forward with deeper knowledge, more understanding and even greater focus on issues surrounding adware, pre-installs and security. We are eager to be held accountable for our products, your experience and the results of this new effort.

I am disappointed there is not anything in this statement about the certificate which was installed and allowed Superfish to monitor secure sessions on the computer. That by-passing of security with a bad certificate is a major concern in this situation.

Lastly, just in case you wanted to see if a Lenovo product you purchased may have been affected we have been provided this list by Lenovo:

G Series: G410, G510, G710, G40-70, G50-70, G40-30, G50-30, G40-45, G50-45
U Series: U330P, U430P, U330Touch, U430Touch, U530Touch 
Y Series: Y430P, Y40-70, Y50-70
Z Series: Z40-75, Z50-75, Z40-70, Z50-70
S Series: S310, S410, S40-70, S415, S415Touch, S20-30, S20-30Touch
Flex Series: Flex2 14D, Flex2 15D, Flex2 14, Flex2 15, Flex2 14(BTM), Flex2 15(BTM), Flex 10
MIIX Series: MIIX2-8, MIIX2-10, MIIX2-11
YOGA Series: YOGA2Pro-13, YOGA2-13, YOGA2-11BTM, YOGA2-11HSW
E Series: E10-30

Now that you have another read on Lenovo’s official stand does it change what grade would you give Lenovo's response to the Superfish situation?

 

About the Author

Richard Hay

Senior Content Producer, IT Pro Today (Informa Tech)

I served for 29 plus years in the U.S. Navy and retired as a Master Chief Petty Officer in November 2011. My work background in the Navy was telecommunications related so my hobby of computers fit well with what I did for the Navy. I consider myself a tech geek and enjoy most things in that arena.

My first website – AnotherWin95.com – came online in 1995. Back then I used GeoCities Web Hosting for it and WindowsObserver.com is the result of the work I have done on that site since 1995.

In January 2010 my community contributions were recognized by Microsoft when I received my first Most Valuable Professional (MVP) Award for the Windows Operating System. Since then I have been renewed as a Microsoft MVP each subsequent year since that initial award. I am also a member of the inaugural group of Windows Insider MVPs which began in 2016.

I previously hosted the Observed Tech PODCAST for 10 years and 317 episodes and now host a new podcast called Faith, Tech, and Space. 

I began contributing to Penton Technology websites in January 2015 and in April 2017 I was hired as the Senior Content Producer for Penton Technology which is now Informa Tech. In that role, I contribute to ITPro Today and cover operating systems, enterprise technology, and productivity.

https://twitter.com/winobs

Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like