Lenovo preinstalled an ad injector that broke HTTPS on every machine

Lenovo did not get compromised. Lenovo chose this. From August 2014 the company preinstalled Superfish VisualDiscovery on consumer laptops — Yoga and Flex models and others, though not ThinkPads — to inject shopping comparisons into web pages. Injecting into an HTTPS page means terminating the TLS connection, so Superfish installed its own root certificate authority into Windows' trust store and man-in-the-middled the user's browser from the inside.

The implementation came from Komodia, an Israeli company selling an SSL interception SDK. It had two properties that turned a privacy complaint into an emergency. The root certificate's private key shipped inside the software, identical on every affected machine, so anyone who extracted it once could impersonate any website to every Lenovo owner. And the key was protected with the password komodia. Rob Graham of Errata Security had it out in about three hours.

The result was that a Lenovo laptop, out of the box, would accept a forged certificate for any site on the internet without a browser warning — on coffee-shop Wi-Fi, from anyone who had read the news that week. US-CERT issued VU#529496. Lenovo had already stopped preloading it in January 2015 over user complaints about the ads, published a removal tool in February, and settled with the FTC and 32 states in 2017.

It belongs in a catalogue of supply-chain attacks even though no attacker was involved, because the user's exposure is identical: something hostile to their interests arrived through the legitimate channel, signed and endorsed by the vendor, and no check available to them would have caught it.