Lenovo pre-installed 'Superfish' spyware on laptops that broke HTTPS encryption and enabled man-in-the-middle attacks

When you buy a new computer, you expect it to work as advertised. You don't expect it to systematically intercept every secure message you send — your banking passwords, your medical records, your private emails — and leave those communications vulnerable to anyone with basic technical knowledge.

Yet that's exactly what Lenovo did to millions of customers starting in September 2014.

The Chinese computer manufacturer began pre-installing software called Superfish VisualDiscovery on consumer laptops. Officially, it was just a visual search tool designed to help users find similar images while shopping online. Lenovo presented it as a useful feature, bundled with the system so customers wouldn't have to download it themselves. Convenient, the company suggested. Value-added.

What Lenovo didn't adequately disclose was how Superfish worked. To intercept images across the web and perform its visual search function, the software had to position itself between your computer and every website you visited. It did this by installing a self-signed root certificate — essentially a digital key that allowed it to decrypt HTTPS encryption on any secure website.

HTTPS encryption is the lock-and-key system that protects your passwords, medical information, and financial data from being read in transit. It's the reason your banking website appears to be secure. Superfish was effectively opening that lock.

The problem went deeper than mere surveillance. Security researchers discovered that the same root certificate and its private key were hardcoded on all affected laptops. The private key — the crucial piece that should remain secret — was weak and easily extracted. Once researchers published how to do it, any attacker on the same network could theoretically intercept and decrypt the HTTPS traffic of any Superfish-infected machine. A man-in-the-middle attack became trivial.