“User feedback was not positive,” Lenovo acknowledged on its website this week – while also trying to explain how customers could protect themselves against a serious security risk.
“Visual Discovery/Superfish was previously included on some consumer notebook products shipped in a short window between October and December to help customers potentially discover interesting products while shopping,” explains itsweb page where it also explains how to remove Superfish, which has been tagged by multiple security researchers as a serious risk to user credentials.
Lenovo says it “responded quickly and decisively” to news of the vulnerability. Superfish turned off server-side connections to Lenovo products, and claims it stopped preloading the software in January 2015. “We will not preload this software in the future,” Lenovo says firmly.
So why did it install it in the past? A simple reason: the consumer PC market is so cut-throat that any extra revenue source becomes a godsend. Lenovo is far from the first to install extra software, for money, on the PCs it sells to consumers; but the surprise is that it did it at all.
Lenovo is the world’s biggest PC maker, whose PC division managed operating margins of 5.4% in the three months to the end of December according to itsfinancial report; that means for every $100 of revenue from PCs, it kept $5.40 (£3.50) as profit (once taxes and other exceptionals are dealt with). Lenovo’s average PC sold for $570 (£371) in the fourth quarter, so its per-PC profit was $30.78.
That’s well ahead of Asus ($394 average PC price, per-PC profit $18); only third-quarter figures are available for Acer (average PC price $339, profit $4.37) and HP (average price $580, profit $23.90). Dell hasn’t published public figures since going private, though its consumer PC division often struggled to break even. (I looked at what I call the “value trap” for Windows PC makers in January 2014; since then, revenues and per-PC profits have mostly worsened, except for Lenovo and Apple.)
It’s actually Dell, which used to break out its enterprise and consumer profitability, which gives us the clue to the problem. Unlike the enterprise market, where manufacturers can often sell direct in huge volumes, the consumer Windows PC market forces manufacturers to sell mostly via retailers.
Retailers take a slice of profit; and retail customers love low prices over anything. That, though, erodes profits for the manufacturers. So how do they get them back? Simple – with adware, which is what these Superfish installations were. Superfish intercepted the secure streams going to Google or other search engines and replaced the adverts in them with its own.
The reality is that a consumer PC nowadays is a collection of auctionable software elements. The default browser? There’s a price on its head. Antivirus? Those limited trials are worth money to antivirus companies. All those extras help to improve the margins on PCs. It’s not clear how much Superfish helped Lenovo, but it’s remarkable how its PC operating margins improved by two percentage points in a year (it hasn’t released operating margins for any quarter except the end of 2014 and 2013) – helping a per-PC operating profit increase of nearly $11.
What drove that? Even with Lenovo’s improving efficiencies, it’s hard not to think that Superfish, and any other preinstalled products, helped, even just a little, by providing a dollar per-install on millions of machines.
Adware is big business. Ben Edelman, an associate professor at Harvard Business School, has been on the trail of adware companies since 2002, but was still finding examples of unwanted installations in January 2014.
Superfish is a new name in the field, which until a few days ago might have been best known for its efforts to introduce a “visual search engine” that could name flowers from a picture, but WindowShopper – the software preinstalled on the Lenovo “consumer laptops” - was first released in 2011. The company said it had 80 million users in mid-2014.
Might Lenovo not have realised the risks involved in Superfish? Could it have just been someone too eager to close a profitable deal? Not according to a commenter on Hacker News, the watering hole for programmers, who said:
Having been privy to OS bundling for products, I can assure you there is lengthy contracts, and negotiations, about exactly what is happening. You do not simply walk up to Lenovo and have your “software” installed into the OS without a very detailed contract and pay structure. There also looks to be Javascript injected into pages, which is serving up the ads, and a comment [in the Javascript] about Lenovo. Think about what that means. There was a project at this company, where they had meetings, project plans, testing to make sure it worked, and a very detailed idea of what was going on. Never mind all the ramping up capacity due to new Lenovo’s boxes coming online. There is zero chance this was some low level junior programmer fly by night operation.
So Lenovo knew what it was doing. Whether anyone saw further, to the risks to users of man-in-the-middle attacks (where phishers could for example host a fake Bank of America site yet be told it was authentic), is not.
It’s easy for technically competent people to say “Oh, you should wipe the drive and reinstall Windows to avoid all the crapware”, but for the overwhelming majority of people the idea of doing that is too worrying. Which means that they are vulnerable to this sort of backroom deal, accepted with a click of the hundred-page legalese of the end-user licence agreement when the machine first powers up.
The damage to Lenovo is hard to estimate – but it’s real. The clamour over this mistake (for that’s what Lenovo is effectively admitting it was) will continue for some time. So what advice should you give someone worried that their favourite PC maker has been selling them short? There are three possibilities: buy a “signature edition” via Microsoft, which is guaranteed to be just Windows and nothing else; get a Chromebook; or buy a Macintosh from Apple.
Of the three options, the signature edition will at least give the familiar experience of Windows – but Lenovo hasn’t done Microsoft a favour in the past 24 hours or so.
No comments:
Post a Comment