A class action lawsuit filed in California against computer manufacturer Lenovo highlights how a weak link in the cyber security chain can lead to disaster effects.
In the suit, the plaintiffs allege Lenovo preinstalled Superfish bloatware/adware developed by a Chinese tech firm, for a fee, on the Lenovo PCs it sold, mainly to businesses, and that the pre-installed Superfish adware created a cybersecurity vulnerability. Ostensibly, the Superfish software was only meant to display advertisements targeted to the user based on images the viewer clicked on with a mouse. However, the plaintiffs allege the Superfish software had a vulnerability whereby it could be modified and hacked to extract user data.
Lenovo has worked with Microsoft, McAfee, and others to eliminate any risk from the Superfish software but, of course, remediation requires users to install updates, which industry data suggests only one-third of users do on a timely basis. In the meantime, businesses that are running machines with this vulnerability risk allowing outside sources to access otherwise secure data.
Lessons learned: cyber security requires vigilance at every level because superfluous adware and other background processes can create significant liability for businesses.
