Microsoft's malware detection data shows that Lenovo's crapware has been scr믭 from about 250K Windows PCs Credit: Thinkstock Microsoft earlier this week said that search-and-destroy work by it, Lenovo and other software makers has reduced the daily number of Lenovo PCs found infected with the Superfish adware to below 1,000.In a blog post announcing the addition of another Superfish clean-up tool, Microsoft’s security team said that the number of infected PCs detected by its software peaked at around 60,000 on Feb. 21, slumped slightly over the next two days before falling precipitously. By Feb. 25, the daily number of infected PCs encountered by Microsoft’s tools had dropped to around 3,000, sliding further over the next several days to what appeared to be less than 1,000 each day.All told, Microsoft implied that about a quarter of a million Lenovo PCs were cleansed of Superfish between Feb. 20 and March 4.Microsoft’s numbers came from its Malicious Software Removal Tool (MSRT), a free utility pushed to Windows PCs monthly via Windows Update. MSRT, a companion to real-time security software like antivirus programs, includes a smaller set of “fingerprints” that detect and delete malware that Microsoft believes is the most pervasive or threatening. The company added a fingerprint for Superfish Visual Discovery, an ad-injection program pre-loaded on Lenovo’s consumer PCs for several months late last year, and according to reports, still contained on the Chinese PC maker’s machines that remain in the sales channel.To implant ads on encrypted websites, Superfish installed a self-signed root certificate into the Windows certificate store, then re-signed all certificates presented by domains using HTTPS. That meant a browser trusted all the fake certificates generated by Superfish, which was effectively conducting a classic “man-in-the-middle” (MITM) attack able to spy on supposedly secure traffic between a browser and a server. Once hackers cracked the encryption key for the Superfish certificate — a laughably easy job, as it turned out — they could launch their own MITM attacks by duping Lenovo PC users into connecting to a malicious Wi-Fi hotspot in a public place, like a coffee shop, airport or school campus.Lenovo published instructions for manually removing Superfish and its certificate, then followed that on Feb. 21 with an automated tool. Between Lenovo’s two moves, Microsoft updated its free Windows Defender and Security Essentials antivirus programs with a signature that sniffed out and deleted the rogue certificate.While it’s impossible to tell the impact of a specific tool — whether Lenovo’s, Microsoft’s or others’ — on the Superfish infection numbers, the cumulative effort did suppress the adware.Microsoft acknowledged that other software besides Superfish used the same security-threatening tactic, but said its tools only targeted Lenovo PCs. Related content opinion Proactive, not reactive: the path to ensuring operational resilience in cybersecurity The experience of the financial sector in dealing with threats is instructive to anyone in the cybersecurity space — there’s no substitute for getting out ahead of potential risks and problems. By Cameron Dicker Dec 04, 2023 6 mins Financial Services Industry Financial Services Industry Financial Services Industry feature 4 budget-savvy strategies for building an effective purple team Building a purple team is not only for organizations with a generous budget. From the shoestring one-person operation harnessing open-source power to the well-oiled machine of a comprehensive team, organizations of all sizes have a pathway to heighte By Maril Vernon Dec 04, 2023 14 mins Threat and Vulnerability Management IT Training Risk Management news Is China waging a cyber war with Taiwan? Nation-state hacking groups based in China have sharply ramped up cyberattacks against Taiwan this year, according to multiple reports. By Gagandeep Kaur Dec 01, 2023 4 mins Cyberattacks Government news Apple patches info-stealing, zero day bugs in iPads and Macs The vulnerabilities that can allow the leaking of sensitive information and enable arbitrary code execution have had exploitations in the wild. By Shweta Sharma Dec 01, 2023 3 mins Zero-day vulnerability Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe