reader comments 51
The FTC said Tuesday that it cannot stop computer makers from selling computers that inject ads into webpages to US consumers. The statement covers Lenovo’s practice of having sold computers pre-installed with the so-called VisualDiscovery adware developed by a company called Superfish. This adware, which was installed on computers without consumers’ knowledge, hijacked encrypted Web sessions that made users vulnerable to HTTPS man-in-the-middle attacks and shared user browsing data with third parties.
settlement with Lenovo, the FTC said the Chinese hardware maker, or any computer company for that matter, was free to sell computers with the adware made from a company called Superfish—as long as consumers consented before it was downloaded on the machine.
“As part of the settlement with the FTC, Lenovo is prohibited from misrepresenting any features of software preloaded on laptops that will inject advertising into consumers’ Internet browsing sessions or transmit sensitive consumer information to third parties. The company must also get consumers’ affirmative consent before pre-installing this type of software,” the FTC announced.
The commission said Lenovo has stopped installing Superfish’s VisualDiscovery software. In February 2015, the software became one of the hottest topics in the security world after it was disclosed that the Chinese computer maker was shipping computers with VisualDiscovery pre-installed, unbeknownst to consumers. The software secretly installed a self-signed root HTTPS certificate that could intercept encrypted traffic for every website a user visited. When a user visited an HTTPS site, the site certificate was signed and controlled by Superfish and falsely represented itself as the official website certificate. The FTC said Tuesday that 750,000 computers with this software were sold in the US.
allegations (PDF) in the complaint from the FTC and in a similar complaint lodged by 32 states, which Lenovo also settled Tuesday without admitting wrongdoing. Lenovo said it has stopped installing the Superfish software:
After learning of the issues, in early 2015 Lenovo stopped preloading VisualDiscovery and worked with antivirus software providers to disable and remove this software from existing PCs. (Those instructions can be found on the Lenovo website here.) To date, we are not aware of any actual instances of a third party exploiting the vulnerabilities to gain access to a user’s communications. Subsequent to this incident, Lenovo introduced both a policy to limit the amount of pre-installed software it loads on its PCs, and comprehensive security and privacy review processes, actions which are largely consistent with the actions we agreed to take in the settlements announced today.
The FTC settlement also requires that Lenovo submit audits of pre-loaded software on computers to third parties.
Also, as part of getting consumer consent for adware to be downloaded, the FTC said that “a clear and conspicuous mechanism shall be provided for a consumer to indicate assent to the operation of the covered software by taking affirmative action authorizing its operation.” According to the FTC, that means the disclosure must be “difficult to miss” and “easily understandable by ordinary consumers.”