3 ms·

Did you miss superfish? https://www.cnet.com/news/superfish-torments-lenovo-owners-with-more-than-adware/ https://www.cnet.com/news/superfish-torments-lenovo-o

Did you miss superfish? https://www.cnet.com/news/superfish-torments-lenovo-owners-with-more-than-adware/ https://www.cnet.com/news/superfish-torments-lenovo-owners-w... It did MITM to inject ads, including adding their cert to the trust store to MITM SSL connections. Of course the software needed the private key to work, which they shipped to every laptop and was quickly put online. All of the sudden banking at coffee shops on a lot of Lenovo models was no longer private. I'm not sure if captured traffic could be retroactively decrypted, but I wouldn't doubt it. PFS support probably wasn't high on Superfish's priorities.

modzu 6y ago
please folks, dont do your banking on open coffee shop wifi
- sneak 6y ago
  I do this all the time. My machine has a modern browser, up to date OCSP, HSTS already cached, all that. Could you please explain to me the danger or threats you are warning against?
  - jlgaddis 6y ago
    What does "up to date OCSP" even mean? Have you configured your browser(s) to "fail closed" when it comes to OCSP queries? CRL and OCSP behavior has been, well, "not ideal" since basically forever.
- CountSessine 6y ago
  Honest question - why not? My bank uses this cool thing called TLS. What’s the threat model here?
  - modzu 6y ago
    yes legitimate traffic is going to be fully encrypted thanks to TLS, the risk comes from attacks where you believe you're logging into your banking site securely when you're actually not. for example dns cache poisoning, ssl downgrade attacks, etc. in the case of a starbucks, the AP itself is not necessarily secure (under a counter somewhere?) so it's possible users are connecting to a malicious AP. the threat model depends on the level of risk: the convenience may outweigh those risks, it may not. for myself it is one of a few tasks i wouldn't engage in on a network i don't have more trust in, but in retrospect this advice was indeed probably too strong for most.
    - CountSessine 6y ago
      Again - who cares about dns cache poisoning when your cert chain is sound and your browser is sensible about cert downgrades (which all of them are now)? Who cares about how secure the AP is? It’s an encrypted, securely authenticated connection. That’s the whole point of the cert chain. The AP can be as malicious and evil as it wants - good luck usefully tampering with or impersonating my bank’s public key. Again, what’s the threat model here? Exploiting a browser vulnerability? Maybe?
dralley 6y ago
Superfish was never on Thinkpads, only Lenovo's consumer laptops. The Thinkpad division and the consumer laptop division seem to operate somewhat separately. Not to excuse Lenovo - they fucked up big.
- aesh2Xa1 6y ago
  Superfish was never found, but there has definitely been malware installed on the ThinkPad line: https://thehackernews.com/2015/09/lenovo-laptop-virus.html?m=1 https://thehackernews.com/2015/09/lenovo-laptop-virus.html?m... The firmware rootkit, to my knowledge, has never been found on ThinkPads.

modzu 6y ago

please folks, dont do your banking on open coffee shop wifi

sneak 6y ago
I do this all the time. My machine has a modern browser, up to date OCSP, HSTS already cached, all that. Could you please explain to me the danger or threats you are warning against?
- jlgaddis 6y ago
  What does "up to date OCSP" even mean? Have you configured your browser(s) to "fail closed" when it comes to OCSP queries? CRL and OCSP behavior has been, well, "not ideal" since basically forever.
CountSessine 6y ago
Honest question - why not? My bank uses this cool thing called TLS. What’s the threat model here?
- modzu 6y ago
  yes legitimate traffic is going to be fully encrypted thanks to TLS, the risk comes from attacks where you believe you're logging into your banking site securely when you're actually not. for example dns cache poisoning, ssl downgrade attacks, etc. in the case of a starbucks, the AP itself is not necessarily secure (under a counter somewhere?) so it's possible users are connecting to a malicious AP. the threat model depends on the level of risk: the convenience may outweigh those risks, it may not. for myself it is one of a few tasks i wouldn't engage in on a network i don't have more trust in, but in retrospect this advice was indeed probably too strong for most.
  - CountSessine 6y ago
    Again - who cares about dns cache poisoning when your cert chain is sound and your browser is sensible about cert downgrades (which all of them are now)? Who cares about how secure the AP is? It’s an encrypted, securely authenticated connection. That’s the whole point of the cert chain. The AP can be as malicious and evil as it wants - good luck usefully tampering with or impersonating my bank’s public key. Again, what’s the threat model here? Exploiting a browser vulnerability? Maybe?

dralley 6y ago

Superfish was never on Thinkpads, only Lenovo's consumer laptops. The Thinkpad division and the consumer laptop division seem to operate somewhat separately. Not to excuse Lenovo - they fucked up big.

aesh2Xa1 6y ago
Superfish was never found, but there has definitely been malware installed on the ThinkPad line: https://thehackernews.com/2015/09/lenovo-laptop-virus.html?m=1 https://thehackernews.com/2015/09/lenovo-laptop-virus.html?m... The firmware rootkit, to my knowledge, has never been found on ThinkPads.