Lenovo Caught Installing Adware on New Computers
This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate.<p>The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy):
<a href="https://twitter.com/fugueish/status/568258997578371072" rel="nofollow">https://twitter.com/fugueish/status/568258997578371072</a><p>Someone will extract the private key in the next few hours, and then HTTPS will be basically completely broken for all Lenovo users -- anyone will be able to spoof any site to them.<p>Uninstalling the app does NOT remove the certificate: <a href="https://twitter.com/metsfan/status/568265468173107200" rel="nofollow">https://twitter.com/metsfan/status/568265468173107200</a><p>On the bright side, Firefox does not use the system certificates (it has its own list) and Chrome will no doubt push an update to block the certificate promptly.