Still smarting from HTTPS-busting Superfish debacle, Lenovo says sorry

Lenovo's top technical executive apologized once again for pre-installing laptops with software that intercepted customers' encrypted Web traffic, and the company has gone on to outline plans to ensure that similar mistakes don't happen again.

"This software frustrated some users without adding value to the experience so we were in the process of removing it from our preloads," Lenovo CTO Peter Hortensius wrote in an open letter published Monday afternoon. "Then, we saw published reports about a security vulnerability created by this software and have taken immediate action to remove it. Clearly this issue has caused concern among our customers, partners, and those who care about Lenovo, our industry and technology in general. For this, I would like to again apologize."

Hortensius went on to enumerate the ways affected customers can remove Superfish software, which installs a dangerous Secure Sockets Layer credential in the root certificate authority folder of affected PCs. In addition to an automated removal tool created and distributed by Lenovo, antivirus software from Microsoft, McAfee, and Symantec will also detect and remove the threat. Hortensius said that Lenovo plans to release an updated system for addressing software vulnerabilities and security threats. Options include creating a "cleaner PC image," working with customers and security professionals to create a better policy for pre-installed software, and "soliciting and assessing the opinions of even our harshest critics" as they relate to product security.

Monday's open letter is the latest indication that Lenovo's regret is genuine. It contrasts sharply with the responses of Superfish CEO Adi Pinhas, who on Friday asserted that his ad-injection software posed no security threat despite near-universal condemnation among researchers. These critics say that the Superfish software caused affected Lenovo computers to trust invalid HTTPS certificates that would otherwise be detected as forgeries, a failure that left end users wide open to attacks that impersonate secure sections of Bank of America, Google, or any other website on the Internet. Komodia, a software developer that sold some of the HTTPS-interception code and certificates used by Superfish and other software makers, has so far declined to make any comment on its role.

As unsavory as the entire Lenovo/Superfish debacle has been, a silver lining may come if it prompts an open and honest reassessment of the crapware that comes pre-installed on many new PCs. Here is the entire text of Hortensius' letter:

Superfish Update - An Open Letter from Lenovo CTO Peter HortensiusRESEARCH TRIANGLE PARK, NC – February 23, 2015: Beginning in September 2014, we made a decision to ship some of our consumer notebooks with Superfish. This software frustrated some users without adding value to the experience so we were in the process of removing it from our preloads. Then, we saw published reports about a security vulnerability created by this software and have taken immediate action to remove it. Clearly this issue has caused concern among our customers, partners and those who care about Lenovo, our industry and technology in general. For this, I would like to again apologize. Now, I want to start the process of keeping you up to date on how we are working to fix the problem and restore your faith in Lenovo.

We have already taken several critical first steps:

• We stopped the preloads and will not include this Superfish software in any devices in the future.
• We have worked on our own and with our partners to make your PCs safe from this vulnerability as quickly and easily as possible:
  • On Thursday, Feb. 19, Lenovo provided a manual fix and by Friday, Feb. 20, we provided an automated removal tool to make it simple for our customers to remove Superfish and related files
  • Also on Friday, our partners, Microsoft, McAfee and Symantec have updated their software to automatically disable and remove this Superfish software. This means users with any of these products active will be automatically protected. We thank them for their quick response.
  • Together, these actions mean all new products already in inventory will be protected. Shortly after the system is first powered-on the AV program will initiate a scan and then remove Superfish from the system. For systems which are re-imaged from the backup partition on the HDD, Superfish will also be removed in the same manner. For products already in use, Superfish will be removed when their antivirus programs update.

We have communicated as rapidly as possible with customers, partners and industry watchers and influencers. I hope that with every communication, we are better informed and more clear on what is important.

• Now, we are in the midst of developing a concrete plan to address software vulnerabilities and security with defined actions that we will share by the end of the week. What I can say about this today is that we are exploring a wide range of options that include:
  • creating a cleaner PC image (the operating system and software that is on your device right out of the box);
  • working directly with users, privacy/security experts and others to create the right preload strategy quickly;
  • and soliciting and assessing the opinions of even our harshest critics in evaluating our products going-forward.

While this issue was limited to our consumer notebooks and in no way impacted our ThinkPads; any tablets, desktops or smartphones; or any enterprise server or storage device, we recognize that all Lenovo customers may have an interest in where we are and what is next. The fact is our reputation touches all of these areas, and all of our customers. Now, we are determined to make this situation better, deliver safer and more secure products and help our industry address – and prevent -- the kind of vulnerabilities that were exposed in the last week.

Thank you.
Peter Hortensius

Previous Lenovo statements on Superfish can be found at the Lenovo news site: http://news.lenovo.com/