Superfish, the creator of the dangerous adware preloaded onto many new Lenovo PCs , has finally issued an extended statement on the matter, and, well, it's basically sticking its head in the sand and denying any wrongdoing whatsoever.
In a statement sent to PCWorld, Superfish CEO Adi Pinhas talks about how Superfish is a visual search tool designed to "enhance the online shopping experience for Lenovo customers," and that it doesn't collect any personal data. But beyond the PR talk, Pinhas' statement reveals Superfish taking a startlingly oblivious position--first for what it says at one point, and also for what it brushes off an inconsequential.
Let's start with what's written down. Here's the passage:
"There has been significant misinformation circulating about Superfish software that was pre-installed on certain Lenovo laptops... Despite the false and misleading statements made by some media commentators and bloggers, the Superfish software does not present a security risk."
Ironically, at around the same time representatives sent us the email, the United States Computer Emergency Readiness Team issued an official alert warning of the considerable dangers of the Snapfish adware preloaded on many Lenovo consumer PCs. US-CERT recommends removing Superfish and its root certificate from affected PCs.
Why? Because of the deeper issue at play here--one that Pinhas's statement brushes off.
The core issue with the Snapfish adware isn't that it may or may not be tracking customer behavior. (Both Lenovo and Snapfish say it isn't.) The problem is that the web is increasingly embracing encrypted HTTPS connections, and in order to inject its ads into secured sites, Superfish uses the equivalent of a man-in-the-middle attack to interfere with encrypted HTTPS connections--undermining the trust between users and websites. How? By installing a self-signed root certificate deep inside Windows, which it then uses to re-sign SSL certificates from legitimate websites.
Worse, Superfish uses the same certificate on every affected Lenovo system, and it does so using a weak, depreciated version of encryption. In fact, security researchers have already extracted the private key for the certificate. Hackers can easily launch their own man-in-the-middle attacks on users of affected Lenovo PCs by leveraging this shocking vulnerability put in place for Superfish.
That's very, very, very bad.
Pinhas says "a vulnerability was introduced unintentionally by a third party," but it's downright shocking for him to say "Superfish software does not present a security risk." While Pinhas is technically true--the true danger lies in the certificate, not the Superfish software itself--to say that Superfish "does not present a security risk" as it was implemented in Lenovo's PCs seems incredibly disingenuous.
Fortunately, others technological giants are already moving to fix the vulnerability.
Sign up for CIO Asia eNewsletters.