Lenovo.com website hacked by Lizard Squad
Reuters

The US government has advised users of Chinese PC maker Lenovo to remove the malicious application named Superfish installed on some Lenovo laptops due to cybersecurity issues.

The US Department of Homeland Security said the Superfish programme in the laptops allows the installation of a "non-unique trusted root certification authority (CA) certificate, allowing an attacker to spoof HTTPS traffic".

"All browser-based encrypted traffic to the internet is intercepted, decrypted, and re-encrypted to the user's browser by the application – a classic man-in-the-middle attack," the agency said in an alert.

Lenovo pre-installed the spyware, which intercepts users' web traffic to provide targeted advertisements, on some of its PCs starting in September 2014.

Because the certificates used by Superfish are signed by the CA installed by the software, the browser will not display any warnings that the traffic is being tampered with. Therefore, systems with the Superfish software installed are vulnerable to cyber attacks, as websites such as banking and email, can be spoofed without a warning from the browser.

Lenovo has earlier said it discontinued the practice of pre-installing the software, but systems with the software already pre-installed will continue to be vulnerable, the agency reminded.

It also urged customers to uninstall Superfish VisualDiscovery on Lenovo laptops along with the associated root CA certificate.

Laptops in Lenovo's Yoga, Flex and MiiX lines as well as its E, G, U, Y and Z series are affected by the adware, according to the company's support website.