An alert sent by Aspire, an intellectual property law group in Colorado Springs, said a serious security flaw in certain Lenovo laptops, which shipped with embedded adware that undermines the trust of the root certificate functions of the Windows operating system, created a substantial risk for companies using the infected Lenovo laptops.
The adware, called Superfish, was designed to enable targeted marketing of the laptop user’s online activity, by capturing content to enable less expensive products and services to be displayed to the laptop user. Superfish reportedly employs one universal security certificate across all Lenovo laptops that is easily decrypted.
The Superfish adware therefore operates as a filter, or man-in-the-middle attack vulnerability, to reportedly redirect certain content to its vendor network. This breach of integrity and confidentiality may present legal problems to affected users and their company’s security and privacy compliance requirements. Also, because the universal certificate’s encryption is easily cracked, hackers can access the user’s laptop and cause further harm across trusted network connections.
Aspire recommends organizations with infected Lenovo laptops to remove the software.
For more information, us-cert.gov/ncas/alerts/TA15-051A or news.lenovo.com/images/20034/remove-superfish-instructions.pdf.