Connecticut Attorney General George Jepsen said he has demanded more information from computer maker Lenovo and its partner software company regarding media reports that preinstalled spyware on some Lenovo machines could have exposed buyers to hack attacks.
A researcher first discovered the spyware, called Superfish Visual Discovery, in January, according to the New York Times.
Installed in some Lenovo computers sold between September and January, the spyware is difficult to detect. The U.S. Department of Homeland Security has said that the computers have a compromised root CA certificate, which could be exploited by hackers to allow them to read encrypted web browser traffic or commit other attacks.
Jepsen wants to discern if Lenovo or Superfish have broken state law regarding unfair and deceptive trade practices.
“It is bad enough that the company sold consumers computers pre-loaded with software designed to track their browsing without alerting them,” Jepsen said in a statement. “Even more alarming is that the software reportedly has a significant security vulnerability, putting computer users at risk of hacking.”
Lenovo has released fix to remove Superfish and corrupted certificate from the computers.
Jepsen has demanded to know the number of infected computers sold, how many were sold to Connecticut residents, and has also demanded communications between Lenovo and Superfish and financial details of their arrangement.
Forbes reported last week that Lenovo only made $250,000 for installing Superfish.
Creative Commons photo license
DOWNLOAD PDFs
