In 2015, security researchers discovered that Lenovo had pre-installed adware called Superfish Visual Discovery on consumer laptops shipped between September 2014 and January 2015. Superfish's stated purpose was to help users find visually similar products while shopping online. Its actual implementation was a catastrophic security vulnerability.
What Superfish did: To intercept HTTPS (encrypted) web traffic so it could inject advertisements into secure pages, Superfish installed its own root Certificate Authority (CA) certificate into the Windows certificate store. This allowed Superfish's software to perform a man-in-the-middle attack on every HTTPS connection the user made — it decrypted the traffic, scanned it for product images, injected its ads, and re-encrypted it. The user's browser saw a valid HTTPS certificate and showed no warnings — because the certificate was signed by Superfish's CA, which Windows trusted.
The security catastrophe: The Superfish root CA certificate used the same private key on every Lenovo machine it was installed on — and that private key was embedded in the Superfish software. Security researchers extracted the private key within days of the discovery. Any attacker who possessed that key could generate fraudulent HTTPS certificates trusted by every affected Lenovo laptop. This meant any attacker on the same network (coffee shop Wi-Fi, corporate network) could perform a man-in-the-middle attack against any HTTPS site — banking, email, corporate VPN — on any affected Lenovo computer, with no browser warnings to alert the victim.
The response: Lenovo issued a removal tool and instructions. Microsoft released a Windows Defender update to remove the Superfish certificate. Lenovo CEO publicly apologized. Multiple class-action lawsuits followed. The U.S. Federal Trade Commission settled with Lenovo in 2017, requiring security audits for 20 years.
Exam takeaways: (1) Bloatware is not merely annoying — it can be a critical security vulnerability present from the first boot. (2) Pre-installed software operates with the same trust level as manufacturer-installed software, which can be weaponized. (3) A compromised root CA certificate undermines all HTTPS security on the affected system. (4) The manufacturer is financially incentivized to pre-install third-party software regardless of its security implications for users.
In 2011, security researcher Trevor Eckhart discovered that a software component called Carrier IQ was installed on millions of smartphones by mobile carriers — without the knowledge of most users. Carrier IQ was positioned as a network diagnostics tool for carriers to measure network performance and identify call quality issues.
What Carrier IQ actually collected: Eckhart's analysis revealed that Carrier IQ's implementation on some handsets captured far more than network metrics. The software logged keystrokes (including the content of text messages and search queries), recorded which apps were opened, logged location data, and captured information about calls — all without explicit user consent. This data was transmitted to the carrier. While Carrier IQ disputed the characterization of its software as a keylogger, the breadth of data collected shocked both security researchers and the general public.
Scope: Carrier IQ was found on devices from multiple major carriers and manufacturers — including AT&T, Sprint, T-Mobile, HTC, Samsung, and Nokia. Estimates placed the number of affected devices at over 140 million. Users had no option to disable or remove the software; it was embedded at the firmware level, below the operating system.
Regulatory response: U.S. Senators sent letters to carriers demanding answers. The FTC conducted an investigation. The incident drove significant changes in carrier disclosure practices and highlighted the vulnerability of users to surveillance by the companies that sell them their devices.
Exam takeaways: (1) Spyware can be installed at the carrier or manufacturer level — not just through malicious downloads. (2) Firmware-level software is invisible to and unremovable by the user. (3) The "diagnostics" framing is a classic way to legitimate surveillance behavior. (4) Even trusted parties (carriers, manufacturers) can deploy surveillance software without meaningful consent.
Throughout the late 2000s and 2010s, fake antivirus software (scareware) became one of the most effective spyware delivery vectors. The pattern was consistent: users browsing ordinary websites would see a pop-up that mimicked a Windows system alert, claiming the computer had been infected with dozens of viruses. The pop-up urged the user to click a "Scan Now" or "Clean My PC" button to resolve the infection.
The mechanics: Clicking the pop-up downloaded and executed an installer. The installer displayed a convincing fake antivirus interface, running fake "scans" that appeared to discover numerous infections. The user was then pressured to purchase a "full version" of the software to remove the infections — infections that did not exist. Whether or not the user paid, the installation had already deployed spyware: keyloggers, browser monitors, and behavioral tracking components that collected credentials and browsing data.
Why it worked: The scareware exploited the one moment when users are most likely to override their caution: when they believe they are already under attack. A user who sees "Your computer has 47 viruses!" is psychologically primed to install something immediately to fix the problem — even something from an unknown source. The social engineering element was as important as the technical delivery mechanism.
Well-known fake AV families: Antivirus XP, WinFixer, SystemAlert, PC Antispyware 2010 — dozens of rebranded variants circulated under different names. Each variant was designed to look like a legitimate, known security product.
Exam takeaways: (1) Fake security software is a primary spyware delivery vector — never install security software prompted by a web pop-up. (2) Scareware exploits fear — the psychological trigger is more important than the technical exploit. (3) Legitimate security software is never distributed via unsolicited pop-ups. (4) Recognizing fake security alerts is part of security awareness training.
Scenario: A user reports that their computer began displaying advertisements for products related to their online shopping searches, even when browsing in private/incognito mode on sites they had not visited before. An antivirus scan returns clean. The user recently installed a free audio conversion tool downloaded from a third-party site. Which of the following BEST explains the advertisements, and what should the analyst do?
Answer: This is most consistent with spyware (specifically browser-monitoring spyware or adware) installed via bundled software with the audio conversion tool. The indicators are: (1) targeted advertising correlated to private browsing activity — a browser monitor is collecting search queries and site visits and transmitting them to an advertising network; (2) private/incognito mode does not prevent application-level monitoring — spyware running as an OS process can intercept browser traffic regardless of the browser's privacy mode; (3) antivirus returned clean — common for spyware that uses techniques to evade signature detection or that was installed too recently to have a signature.
Actions: (1) Run a dedicated anti-malware scan (Malwarebytes) to detect spyware that standard AV missed. (2) Uninstall the audio conversion tool and any software installed alongside it. (3) Check the browser for unwanted extensions or changed default settings (search engine, homepage). (4) Review the system's installed programs list for any software the user did not intentionally install. (5) Change passwords for any accounts accessed on this machine from a clean device — if a keylogger was also present, credentials may be compromised.
Scenario: An IT administrator receives a new laptop from a vendor for deployment to an executive. Before deploying it, the administrator notes that the manufacturer has pre-installed 18 applications beyond the OS, including a trial antivirus suite, a cloud storage client, a music app, three games, a shopping companion browser extension, and several manufacturer utilities. The administrator is asked whether the laptop is ready to deploy as-is. What security concerns should the administrator raise, and what should be done before deployment?
Answer: The administrator should raise the following concerns and recommended actions:
(1) Expanded attack surface: each of the 18 pre-installed applications is software with potential unpatched vulnerabilities, present from day one. For an executive device with access to sensitive systems, this is unacceptable. Recommendation: remove all bloatware not required for business operations before deployment.
(2) Unpatched software risk: the pre-installed apps may not be at their latest versions and may not auto-update. Recommendation: update all retained applications before deployment; remove any that cannot be kept current.
(3) The shopping companion browser extension is a direct security concern: browser extensions have access to all browsing data including credentials entered on web pages. A shopping companion extension from an unknown vendor could be spyware. Recommendation: remove immediately.
(4) The trial antivirus suite: running two antivirus products (the trial and the organization's standard AV) causes conflicts. Recommendation: remove the trial and install only the organization's approved endpoint security tool.
(5) Data collection: some pre-installed software (manufacturer utilities, cloud clients) may transmit usage data. For an executive device, this is a privacy and data security concern.
Correct approach: deploy from the organization's standard baseline image rather than the manufacturer's OEM image, or perform a clean OS installation and install only organization-approved software. This eliminates all bloatware and ensures a known, controlled software state.
Scenario: A security analyst has confirmed a spyware infection on a user's workstation. The spyware includes a browser monitor and a keylogger and has been active for approximately three weeks. The user's standard antivirus, which had current signatures, did not detect it. What is the correct remediation sequence?
Answer: The correct remediation sequence addresses both immediate risk and long-term recovery:
(1) Assume credentials are compromised — with a keylogger active for three weeks, every username and password entered on this machine should be treated as stolen. Do not change passwords from the infected machine (the keylogger may still be running). From a clean, uninfected device, immediately change: email passwords, banking credentials, corporate VPN and domain credentials, any other account accessed from this machine in the past three weeks. Enable multi-factor authentication on all critical accounts.
(2) Run a dedicated anti-malware scanner (Malwarebytes or equivalent) — the standard AV failed to detect this spyware. A dedicated anti-malware tool uses different detection logic and may identify what AV missed. Quarantine and remove all detected components.
(3) Verify complete removal — spyware frequently has persistence mechanisms (startup registry entries, reinstall modules). After Malwarebytes cleanup, reboot and re-scan. Check startup programs and running processes for anything anomalous. The spyware may have multiple components that reinstall each other.
(4) If removal is incomplete or uncertain — reimage: if spyware components cannot be fully removed or if the analyst is not confident the system is clean, the safest remediation is wiping and reimaging from a known-good baseline. Three weeks of potential data exfiltration is too serious a risk to accept an uncertain cleanup.
(5) Investigate the entry point: determine how the spyware was installed (P2P download, bundled software, fake security tool) and address the root cause. If bundled software, identify and remove the parent application. Update policies to prevent similar installation vectors in the future.