Microsoft Promised to Improve Its Adware Rules Next Year

[Thakur]

The tech giant has announced that it would detect and remove insecure adware from its computers in 2016. Such approach could prevent a repeat of Lenovo’s embarrassing self-inflicted security flaw dated March 2015, by making it mandatory for any advertising-based software to only use a web browser’s official methods for any actions, like installation, execution, disabling and removal.

Microsoft has revealed its new policy, which targets software like Superfish – the adware shipped by Lenovo pre-installed on its own laptops in 2014 and 2015. Superfish simply hijacked a user’s Internet connection through a so-called “man in the middle” attack and displayed advertising – even on webpages that were not supposed to have them.

According to Microsoft, such kinds of techniques intercept communications between the worldwide web and the personal computer in order to inject ads and promotions into webpages from outside, without the control of the web browser. So, Microsoft is going to keep the user in control of their browsing experience, while such methods reduce that control.

Aside from the loss of control (and the relevant suboptimal user experience of using a PC stuffed with unwanted ads), such adware also poses a security risk for users, said Microsoft. For instance, in the case of Superfish, the software hijacked the security system that delivered encrypted webpages in order to insert advertisements in Google search pages. The problem is that such activity also posed a serious risk for any user viewing sensitive information like a bank account or ecommerce website using a public Wi-Fi connection.

So, in a bid to solve the problem with such software, the tech giant has announced that from April 2016, it will allow to use software creating advertisements in browsers only through the browsers’ supported extensibility model for any actions, including installation, execution, disabling, and removal. This means that the programs will be installed as plugins to the web browsers, easily removable in the same way. In Lenovo’s case, even if a user managed to uninstall Superfish from their laptop, the security flaw it opened up remained active – this was a cause for concern until the computer maker apologized and provided a removal tool.