12 ms·

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted ro

• eloff 12y ago
  Anyway to see if that certificate is on a Lenovo computer? Anyway to remove it? I bought a Lenovo laptop recently, and I was appalled at the amount of crapware that was installed. It's a wonderful laptop at a great price, just too bad about the software.
  • voltagex_ 12y ago
    Check Certificate Management in mmc.exe (Add Snap-In).
    • yuhong 12y ago
      Or just run certmgr.msc.
  • kentonv 12y ago
    It should show up in the system certificates list as "Superfish, Inc.". I haven't seen it myself but search for #superfish on Twitter to see a lot of screenshots and such.
  • ekianjo 12y ago
    > It's a wonderful laptop at a great price, just too bad about the software. Lenovo's hardware support for Linux is great so unless there's something keeping you on Windows switching to a good Linux distro usually works fine on these laptops.
    • Argorak 12y ago
      Do you trust a hardware vendor that installs MITM stuff on your machine per default to keep the firmware untampered? There is almost no machine out there running openly auditable code on all components.
      • ekianjo 12y ago
        So what? At least with the software part you remove a large portion of the risks. It's better to go half way than doing nothing about it, and hardware tampering for a company could be more risky since they would have to do mass recall if discovered.
        • Argorak 12y ago
          I'm talking Firmware-tampering, which is rather risk-free and firmware patches are not unusual.
      • dingaling 12y ago
        > Do you trust a hardware vendor that installs MITM stuff on your machine per default to keep the firmware untampered? Adding dodgy userspace software is easy and remunerative for Lenovo ( lots of $$$ from the software vendor for 'bundling' ). Tampering with firmware is hard, expensive and doesn't seem to offer compelling return on investment. What's the business case?
        • bronson 12y ago
          Well over $10 million? http://www.cnet.com/news/security-firm-rsa-took-millions-from-nsa-report/ http://www.cnet.com/news/security-firm-rsa-took-millions-fro...
  • rst 12y ago
    A cloudflare developer (I think) has put a test site up here: https://filippo.io/Badfish/ https://filippo.io/Badfish/ The idea is something like <img src="haveproblem.gif" onError="this.src='noproblem.gif'/> where haveproblem.gif is signed with the superfish cert (so you'll get an error if your machine does not have it, triggering the onError JS).
    • throw7 12y ago
      Here's the url: https://badfish.filippo.io/yes.png https://badfish.filippo.io/yes.png
• kentonv 12y ago
  Here's Lenovo trying to justify the presence of this software, naturally oblivious to the security implications: https://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Lenovo-Pre-instaling-adware-spam-Superfish-powerd-by/m-p/1863174#M79882 https://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Lenovo-...
  • moe 12y ago
    naturally oblivious to the security implications Rest assured Lenovo was perfectly aware of the security and privacy implications of this feature from the beginning. They merely try to sound oblivious because their laywers hope that will soften the legal and media repercussions.
    • kentonv 12y ago
      Honestly, I think that's unlikely. This is far too sloppy to have been intentional. There are much better ways to implement a backdoor when you control the OS image. This is just incompetence, plain and simple. Superfish looks like the kind of crapware that pays OEMs to include it in their bundle. Lenovo took the cash and didn't bother to review the code. Superfish, for its part, probably doesn't have the best and brightest engineers working for them. They probably tasked a junior programmer with working around SSL, who then committed the first solution that worked without ever thinking about security implications, and they shipped it.
      • WestCoastJustin 12y ago
        Cannot see how this could possibly be true. Having been privy to OS bundling for products, I can assure you there is lengthy contracts, and negotiations, about exactly what is happening. You do no simply walk up to Lenovo and have your "software" installed into the OS without a very detailed contract and pay structure. There also looks to be js injected into pages, which is serving up the ads, and a comment about Lenovo [1]. Think about what the means. There was a project at this company, where they had meetings, project plans, testing to make sure it worked, and a very detailed idea of what was going on. Never mind all the ramping up capacity due to new Lenovo's boxes coming on-line. There is zero chance this was some low level junior programmer fly by night operation. [1] https://news.ycombinator.com/item?id=9072542 https://news.ycombinator.com/item?id=9072542
• WestCoastJustin 12y ago
  Wow, there are tons of images on twitter about this [1]. There is one where they MITM https://www.bankofamerica.com/ https://www.bankofamerica.com/ too [2]. Why the hell would they do this. Brutal. [1] https://twitter.com/search?q=%23superfish&src=typd https://twitter.com/search?q=%23superfish&src=typd [2] https://twitter.com/kennwhite/status/568270748638318593/photo/1 https://twitter.com/kennwhite/status/568270748638318593/phot...
  • Dylan16807 12y ago
    I assume it's easier to MITM everything.
  • rmc 12y ago
    Incompetance probably. They didn't realise that it would be that much of a bad thing.
    • Torn 12y ago
      Hanlon's razor: Never attribute to malice that which is adequately explained by stupidity. ... I wonder if there's an MBA / capitalism version of this, centering around short-term profit at the expense of everything else.
      • eropple 12y ago
        Jumping at short-term profit over the people who trusted you is malice, in my book. Profit-uber-alles is not some thing that appears out of the ether--somebody has to do it.
• lstamour 12y ago
  The certificate technique they use dates back to at least 2010 (possibly only in add-on form back then?) See https://groups.google.com/forum/m/#!topic/mozilla.support.firefox/5pi0XUYPFS4 https://groups.google.com/forum/m/#!topic/mozilla.support.fi... for example. This causes other problems too: http://www.id.ee/index.php?id=37046 http://www.id.ee/index.php?id=37046 It's not alone in this behavior: http://kb.mit.edu/confluence/display/istcontrib/Programs+that+causes+problems+with+X.509+certificates http://kb.mit.edu/confluence/display/istcontrib/Programs+tha...
  • lstamour 12y ago
    What's funny is that they have three apps for photo-based matching of products...and pets. They really are a "visual search" company, a CA start-up of 80-200 people according to LinkedIn... They just seem to have forgotten the "don't be evil" parts of their business model...
    • BinaryIdiot 12y ago
      > They just seem to have forgotten the "don't be evil" parts of their business model... That or maybe they are completely clueless about the security implications.
    • sounds 12y ago
      I think you mean "do no evil"? https://news.ycombinator.com/item?id=9013374 https://news.ycombinator.com/item?id=9013374
• tedunangst 12y ago
  Remaining questions: Does the superfish proxy itself check the certificate of the site it's connecting to? One would hope, but that's also a pretty easy thing to screw up. If it does, does it trust its own cert? Probably (certainly?), but if not, that would leave one in the curious (perverse?) position of being safer by using the proxy. superfish can mitm your connection, but nobody else with the key could.
  • rjaco31 12y ago
    It's most likely not hard-failing on cert errors, otherwise any website with a self-signed or expired cert would be unaccessible. So that means you just lose warnings (and thus the ability to detect another MitM) in your browser.
• grecy 12y ago
  I'm curious what legal stance Lenovo customers have here - their secure HTTPS connections are being MITMed intentionally - surely that's hacking, or some national security violation?
  • rodgerd 12y ago
    It certainly seems like unauthorised use of a computer system, on the face of it.
  • ajmurmann 12y ago
    It's a big company doing, so it's gonna be fine.
    • techtics 12y ago
      It's not just because they are a big company though. The "community", the industry and the government all share blame for the lack of liability for software. Edit: It's pretty bad form to downvote new accounts becuase you disagree. Imagine if I didn't know about hellbanning. Ask yourself what open source licenses, corporate EULAs and the NSAs defense have in common. The best hope here is that Lenovo explicitly promised someone something they didn't keep.
      • deleted 12y ago
        [deleted]
    • harbingerzero 12y ago
      It actually depends whether or not the practice is directly or indirectly agreed to by the user in the Terms of Use, Privacy Policy or similar document. Now, it's likely that users do agree to it, but if the language in their policies wasn't broad enough to cover action like this, theoretically it would be a violation of the Computer Fraud and Abuse Act, as exceeding authorized use.
      • chopin 12y ago
        This won't hold for Germany though. There is a concept of surprising clause (überraschende Klausel) as well as the concept of an unethical clause (sittenwidrige Klausel). In this case I would assume that both would hold even if there is some clause in the EULA. The BigCo argument holds in Germany unfortunately as well...
• cpeterso 12y ago
  Mozilla discussion about what to do with the Superfish cert: Bug 1134506 - Mark "Superfish, Inc." root certificate as untrusted in NSS https://bugzilla.mozilla.org/show_bug.cgi?id=1134506 https://bugzilla.mozilla.org/show_bug.cgi?id=1134506
  • BinaryIdiot 12y ago
    While it is akin to playing whack-a-mole, it's nice to see them seriously considering blocking this cert so users who get a theoretical update in Firefox would have it simply be removed. Granted Superfish could update and get around it but that would require effort and considering the PR nightmare Lenovo is going to be fielding I doubt they would do so.
    • yuhong 12y ago
      Yea, this should get into the news which will hopefully help a lot.
• gradys 12y ago
  Is there reason to believe that the same key is used on all machines?
  • tedunangst 12y ago
    Click the first Twitter link?
• downandout 12y ago
  >They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. That's the odd part of this. Browser plugins can modify the DOM (insert ads, change search results, etc) without proxying anything. So why do it? I wonder if they were fishing for an NSA contract to further monetize the installs.
  • icebraining 12y ago
    The proxy works for all browsers with a single codebase.
  • pixl97 12y ago
    Browser plugins are easy to wipe out. When dealing with a rather persistent malware a few months ago, it had inserted a legacy policy for a proxy in the Windows registry in a place not commonly checked by malware scanners. You turn off the proxy settings, but at every reboot it would come back and nothing seemed to catch it at the time. Malware can inject things in to the local group policy and other places that are not commonly checked, such as the root cert store, making them very likely to be missed by tech support.
• MBlume 12y ago
  I'm confused; if Firefox doesn't use the system certificates, shouldn't Firefox users have been seeing visibly broken HTTPS from day one?
  • ptaipale 12y ago
    It's not broken, because the Firefox certificate storage isn't empty when you install it. It includes the ones recognized by Mozilla. https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/ https://www.mozilla.org/en-US/about/governance/policies/secu...
    • MBlume 12y ago
      Sure, but I assume Mozilla doesn't recognize the Lenovo adware, so if all the web traffic is being routed through this proxy, shouldn't firefox have squawked?
      • HackinOut 12y ago
        Except if the adware just modify OS proxy settings, like madeofpalk mentioned. Firefox does not take those into account.
        • ptaipale 12y ago
          When taking Firefox into use, it imports the OS proxy settings, though. You get a warning but I guess about 99 % of people don't care about what that means.
      • ptaipale 12y ago
        Mozilla has its own proxy settings as well, independent of Windows Control Panel configuration, so a Firefox user appears not to be impacted by the whole thing at all.
        • dhimes 12y ago
          It's not clear to me. Just a few minutes ago (and after your post) this appeared on mozilla discussion forum given by [1] above (will come back to credit this- didn't copy and don't remember (and can't see!)). https://bugzilla.mozilla.org/show_bug.cgi?id=1134506 https://bugzilla.mozilla.org/show_bug.cgi?id=1134506 Down around 0200 PST 2015-02-19 EDIT: credit [1] cpeterso https://news.ycombinator.com/item?id=9072642 https://news.ycombinator.com/item?id=9072642
• cm2187 12y ago
  I thought that Chrome checks and reports that google.com certificate is a google issued certificate. How did this mitm attack not pop up massive warnings in chrome?
  • carey 12y ago
    Chrome ignores Trusted Root Certificates when checking certificate pinning.
    • cm2187 12y ago
      But doesn't that defeat the purpose? If a trusted Chinese certificate authority issues some certificate on google.com for China to perform MITM attack, and Chrome ignores anything signed by a valid root certificate, it will never report this attack. I thought the point of certificate pinning is precisely that only a single authority can sign a certificate for a website.
      • praseodym 12y ago
        This situation is quite common in enterprise deployments [1], where HTTPS traffic is MITM-proxied through a central server to e.g. check for malicious content or other filtering. If Chrome were to block unknown roots for pinned sites, these sites would become inaccessible because the MITM proxy is still active. That's certainly not desirable in a controlled enterprise environment, but the same would occur when blocking this 'Lenovo root'. [1] http://it.slashdot.org/story/14/03/05/1724237/ask-slashdot-does-your-employer-perform-https-mitm-attacks-on-employees http://it.slashdot.org/story/14/03/05/1724237/ask-slashdot-d...
      • danielweber 12y ago
        No, the purpose of pinning is to stop a compromised CA from issuing their own www.google.com cert. If someone installs a CA, Chrome will trust it. There's not much way around this: if someone has the capability to install a CA on your computer, they'd have the capability to modify chrome.exe to force acceptance of it. Also, sometimes MITM'ing is desired. I'm doing it right now with Firefox and BurpSuite.
• HackinOut 12y ago
  "Someone will extract the private key in the next few hours, and then HTTPS will be basically completely broken for all Lenovo users -- anyone will be able to spoof any site to them." Do you mean the proxy is remote? That is not the impression I have (otherwise having the private key locally makes no sense). If it's local, then even with the private key extracted, and considering a lot of website force https nowadays, we should still have standard crypto between the lenovo computer and the website. EDIT: As long as the adware checks the website certificate AND doesn't trust it's own self-signed certificate in the store... yeah... a lot of ifs... Anyway, thanks for the additional details, more helpful than "[...] the certificate allows the software to decrypt secure requests[...]", found in the article...
  • SixSigma 12y ago
    Having the private key means you can sign your own certificates to serve HTTPS with, so no MITM required.
  • lmm 12y ago
    > we should still have standard crypto between the lenovo computer and the website Standard crypto using that website's certificate. Which could be legit. Or could be an attacker's certificate, signed with this Lenovo root certificate. Some criminals are about to make a lot of money.
    • HackinOut 12y ago
      Not if the proxy checks the certificate of the site it's connecting to and doesn't trust it's own self-signed cert (there is no point in doing so if it's pure adware). But yeah... I have no idea what it does...
      • makomk 12y ago
        I honestly doubt that someone who was clueless and lazy enough to use the same self-signed certificate on all machines would put in the extra effort not to trust that certificate. Besides, the certificate is left behind after the software's uninstalled and no longer proxying connections.
• deleted 12y ago
  [deleted]
• elliotanderson 12y ago
  Looks like the certificate and encrypted private key has been found in "Visual Discovery.exe" - http://pastebin.com/N42Qfm5p http://pastebin.com/N42Qfm5p (credit to @paul_pearce) More context at https://twitter.com/supersat https://twitter.com/supersat
• userbinator 12y ago
  Ironically, I've been MITM'ing my HTTP and HTTPS for over a decade with Proxomitron, and it's been quite useful: http://en.wikipedia.org/wiki/Proxomitron http://en.wikipedia.org/wiki/Proxomitron Interesting question to consider: what if the MITM was benevolent to the user? I.e. Lenovo included a similar ad-blocking proxy in their default installation? Would the public response have been as negative, or would it be considered to be a helpful addition akin to how most browsers now include popup-blockers? In other words, are people more repulsed by the purpose (advertising)? Because I certainly think MITM'ing connections locally to remove ads a good thing... and with some devices like "smart" TVs apparently now phoning home and showing ads, I have no qualms about putting their traffic through a proxy to strip that crap out.
  • rfw 12y ago
    The issue here isn't so much the ads as it is being able to authenticate that the remote party is who you think it is – if your browser trusts the MITMed certificate, you no longer have the guarantee that your banking website is actually your banking website and nothing nefarious, as the page has been intercepted (maliciously or not) in-flight. avast! was actually guilty of this a while ago (see https://lelutin.ca/posts/avast_conducts_MitM_attack_on_users_and_encourages_bad_security_practices/ https://lelutin.ca/posts/avast_conducts_MitM_attack_on_users...), and the article gives some good rationale why MITMing SSL at all without the user's explicit knowledge is bad.
    • userbinator 12y ago
      if your browser trusts the MITMed certificate, you no longer have the guarantee that your banking website is actually your banking website and nothing nefarious, as the page has been intercepted (maliciously or not) in-flight. The trust essentially moves from the browser to the proxy - while I don't know what Superfish does, Proxomitron definitely checks the certificate and pops up a warning dialog if there's something wrong. why MITMing SSL at all without the user's explicit knowledge is bad I think "without the user's explicit knowledge" is the key point here; if you install a security product then you somehow expect that it be able to inspect all your traffic for any maliciousness... as otherwise the "bad guys" will just make use of SSL to defeat that.
• korstiaan 12y ago
  > On the bright side, Firefox does not use the system certificates (it has its own list) [...] https://twitter.com/supersat/status/568343079268327424 https://twitter.com/supersat/status/568343079268327424
  • dchest 12y ago
    Karl (@supersat): "@ErrataRob btw the code that I'm looking at suggests it may try to install itself into Firefox and Opera stores"
• kurokikaze 12y ago
  Aaaand here it is: http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html#.VOYGlfmsV-4 http://blog.erratasec.com/2015/02/extracting-superfish-certi...
  • nsxwolf 12y ago
    Why did he expect to find the password in the clear in the memory dump? He indeed found it there, but why would one expect to?
    • betenoire 12y ago
      the nature of writing a blog post ex post facto?
      • nsxwolf 12y ago
        So, just a hunch that it would be a company name or something else that might be in the dump? There's no technical reason for the actual password itself to somehow end up there? A serious security flaw or something?
        • betenoire 12y ago
          What I mean is, we are reading about it because it worked. It's the lowest hanging fruit. I doubt he expected to find the password just sitting there, but since he did, here we are :) But yes, keeping sensitive information hidden in plain text considered a security flaw.
    • geococcyxc 12y ago
      Because it is needed to decrypt the key and as the program uses it, it must be in memory (at least at some time).
      • nsxwolf 12y ago
        Ahh. That makes sense. So the malware itself is decrypting the certificate using the password.
• rcthompson 12y ago
  Imagine if the person you bought your house from told you "I've disabled all the locks on your doors and windows so that I can pop in from time to time and leave a fruit basket on your dining room table."