The same Lenovo that, after being caught bundling malware [1] with their laptops, promised not to do it again, and was then caught bundling a rootkit [2]?
> No, it's not really the same Lenovo. [..] development [..] is separated
That's putting a lot of faith into internal separation of departments for a company with a track record of inserting malware into their products and lying about it.
> That's putting a lot of faith into internal separation of departments for a company with a track record of inserting malware into their products and lying about it.
1) Why would a pre-installed Ubuntu from Lenovo be more risky than a pre-installed windows from Lenovo ?
2) This news gives a new service to the customers. That does not affect the security at all.
3) That's not a question of faith, it is a question of trust and facts.
There has never been any evidence of any malware insertion at Thinkpad.
So I have no reason to worry more about Thinkpad than I worry about Dell or any other vendor.
Points 1), 2) and 3) question the relevance to make the connection between superfish and this news.
If you don't trust Thinkpad, then you shouldn't trust Dell either.
If you don't trust the pre-installed Ubuntu of Thinkpad and Dell, then you shouldn't trust their pre-installed windows either.
And if you are in one of these cases, you don't trust pre-installed systems, then you should delete the pre-installed system and then install your system.
3) "never been any evidence of any malware insertion at Thinkpad" - Why are you treating Lenovo and Thinkpad separately? They're the same company, even if there's some internal separation (that Lenovo can violate as they wish).
> then you should delete the pre-installed system and then install your system.
Some tried. From my 2nd link: More worrisome part of the feature is that it injects software that updates drivers, firmware, and other pre-installed apps onto Windows machine – even if you wiped the system clean. So even if you uninstall or delete the Lenovo's own software programs, the LSE hidden in the firmware will automatically bring them back as soon as you power-on or reboot your machine.
> Why are you treating Lenovo and Thinkpad separately? They're the same company, even if there's some internal separation (that Lenovo can violate as they wish).
Because historically they are two different entities.
Lenovo acquired Thinkpad, but Thinkpad remained largely separate from other Lenovo products.
The drivers are not the same, the hardware is not the same, the production lines are probably not the same, warranties are not the same, the customer service is not the same.
And the product quality is significantly different.
There is therefore no reason to consider that Lenovo and Thinkpad are the same thing.
Please notice that: Thinkpads are used in the ISS, but a Lenovo product would never enter in the ISS. Even here they are considered as different entities.
> More worrisome part of the feature is that it injects software that updates drivers, firmware, and other pre-installed apps onto Windows machine – even if you wiped the system clean. So even if you uninstall or delete the Lenovo's own software programs, the LSE hidden in the firmware will automatically bring them back as soon as you power-on or reboot your machine.
That Lenovo, not Thinkpad.
But I talked about Dell and Thinkpad, not Lenovo products.
There are evidences of malware insertion at Lenovo, so I don't trust Lenovo products.
That's not the case at Dell or Thinkpad.
Thinkpad & ThinkStation never had superfish pre-installed.
The development of Thinkpad products is separated from the development of other Lenovo products.
[1] https://thehackernews.com/2015/02/lenovo-superfish-malware.h...
[2] https://thehackernews.com/2015/08/lenovo-rootkit-malware.htm...
Edit as reply due to rate limit:
> No, it's not really the same Lenovo. [..] development [..] is separated
That's putting a lot of faith into internal separation of departments for a company with a track record of inserting malware into their products and lying about it.