Lenovo’s website is fully accessible after being knocked offline for several hours Wednesday following a hack attack. Lenovo vows to tighten security and to find out what happened but won’t discuss what all hackers – allegedly from Lizard Squad – did.
“We are reviewing our network security and we will take further appropriate steps to bolster our site and to protect the integrity of our users’ information and experience,” Lenovo’s Ray Gorman, who is based in the Triangle at Lenovo’s executive headquarters, said in a statement emailed to WTW on Thursday.
However, Gorman did not respond to a question about whether the hackers were able to penetrate Lenovo’s network and gain access to internal email. (Friday morning, Lenovo also announced it’s providing security services free to customers affected by the adware debacle.)
Lizard Squad has said it will disclose more information gained from the hack.
“We’ll comb the Lenovo dump for more interesting things later,” the group tweeted.
Here’s how Oxford Dictionaries defines a data dump: “A large amount of data transferred from one system or location to another.”
Is Lizard Squad just boasting or does it really have something?
“Rootkit” Attack
A security news website, KrebsonSecurity, reported that “Lizard Squad used a command injection vulnerability in Webnic.cc to upload a rootkit—a set of hacking tools that hide the intruder’s presence on a compromised system and give the attacker persistent access to that system.” (Webnic.cc is a Malaysian firm involved in administering domains, or web addresses.)
When hackers get to the root of a system, that company has big problems.
In a statement acknowledging the “cyber attack,” Lenovo didn’t comment on anything beyond the website hack.
“Unfortunately, Lenovo has been the victim of a cyber attack that redirected traffic from the Lenovo website. We responded quickly, addressing the issue and restoring our website’s ecommerce functionality. We continue to monitor the situation for additional developments.”
So what do the hackers know?
And when will the public, including Lenovo customers, find out?
Lizard Squad claims it attacked Lenovo for the world’s No. 1 PC manufacturer’s acknowledge role in pre-installing Superfish adware on laptops made for consumers from September or last year through January. The disclosure and warnings (including from the Department of Homeland Security) that the adware was in fact malware and thus exposed Lenovo customers to cyber risk triggered stories of outrage and alarm around the world.
Lenovo’s chief technology officer also confessed in a letter to Lenovo customers that the company was unaware Superfish poised a security risk.
The possibility that hackers were knocking around inside Lenovo’s network is a far more dangerous risk that just having a hacker group knock a website offline and forwarding Lenovo.com site visitors to another site where they saw a parody and heard a song.
As WRAL TechWire and some other sites reported, the hackers published information that, if true, showed they had penetrated far enough to see, copy and reprint Lenovo exchanges with customers. (Check out the image with this post from Lizard Squad’s Twitter feed in which you can see a captured email that’s allegedly from Lenovo.)
The success of the attack raises questions about the quality of Lenovo’s security.
Not that Lenovo was hit by second-rate hackers. Lizard Squad claims to have been involved in other major hacks, including hits on Sony’s and Microsoft’s gaming networks.
In recent months, numerous large institutions (including Anthem, which exposed data for 775,000 North Carolina residents), also have been hit. So Lenovo is farm from alone.
However, the Superfish snafu heightens user sensitivity about Lenovo.
“We are also working proactively with 3rd parties and advisors to further investigate and address this attack and we will provide additional information as it becomes available,” Lenovo said in a statement.
The Full Statement
Here’s all that Lenovo has had to say – so far:
“Unfortunately, Lenovo has been the victim of a cyber attack that redirected traffic from the Lenovo website. We responded quickly, addressing the issue and restoring our website’s ecommerce functionality. We continue to monitor the situation for additional developments.
“We regret any inconvenience that our users may have experienced if they were not able to access parts of our site. We are reviewing our network security and we will take further appropriate steps to bolster our site and to protect the integrity of our users’ information and experience.
“We are also working proactively with 3rd parties and advisors to further investigate and address this attack and we will provide additional information as it becomes available.”
