5 ms·

However distasteful Lenovo's business decision to bundle adware on their consumer laptops, the finger of blame should now rightly point to the third-party softw

by notsony 12y ago

However distasteful Lenovo's business decision to bundle adware on their consumer laptops, the finger of blame should now rightly point to the third-party software provider, Komodia. Lenovo did not vet the software properly before bundling it and heads should roll, but I do not think they are deliberately evil or malicious. If Lenovo are to be condemned, then the entire open-source community must also condemn itself for allowing OpenSSL and Bash to have remained vulnerable for so long. Just like Lenovo, our eyes were wide shut, and it took a shock to open them.

0x0 12y ago
Openssl and bash serve useful purposes and don't try to sneakily alter the user experience without being upfront about it. Pretty big difference, there.
Argorak 12y ago
"Point to the supplier" is a standard tactic, but also wrong. They did put their customers up to harm, for no other reason then trying to squeeze another buck out of them. They provide no additional benefit to the customer. OpenSSL and Bash are free services providing benefit to their users.
orblivion 12y ago
One counterpoint, if a minor one, is that Lenovo still maintains that this posed no security concern.
crazychrome 12y ago
Lenovo customers pay $$, man. Lenovo is either incompetent or evil. you pick.
- takluyver 12y ago
  > Lenovo is either incompetent or evil. you pick. (S)he picked incompetent: > Lenovo did not vet the software properly before bundling it and heads should roll, but I do not think they are deliberately evil or malicious.
xerphn 12y ago
No. You are saying that anyone who creates software with a security bug in it should be condemned. Komodia built their software with a very serious security hole, intentionally, to sell a product with HTTPS sniffing abilities. Just because Lenovo didn't build the software, doesn't mean they are not guilty of overlooking a serious security vulnerability by including software which provides no benefit to its customers. It's an insult to customers. The bugs you find in openSSL and Bash are not insults, they are mistakes made by people who don't get money out of their work (and who don't go out of their way to sell / track information). Security is hard to build correctly, easy to break.
- mikeash 12y ago
  MITMing your own SSL connections can be done safely, and for good reasons (Charles proxy being a good example of both). These guys are doing it unsafely, and for bad reasons. However, those two parts are unrelated! This stuff could easily have been safe had they known what they were doing, or prioritized that. I don't think it's fair to say that the security hole itself is intentional. Certainly if they hadn't built the product in the first place the hole wouldn't exist, but building the product doesn't imply the hole had to be there. The fundamental problem is that software like this greatly increases your attack surface, and thus should only be used with careful consideration if the benefits are worthwhile. Instead, Lenovo put its users at risk without informing them or providing them with any benefit.
  - notsony 12y ago
    Yes, another use-case is if you are running Privoxy on your local computer; would be great if you could MITM all local SSL connections instead of having to manually whitelist specific sites.
    - SixSigma 12y ago
      Here's how to decrypt ssl sessions in Wireshark https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/ https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf... Before that I used Burpsuite, but that uses its own self signed cert too. http://portswigger.net/burp/ http://portswigger.net/burp/ Privoxy doesn't do SSL or did I miss something?
bigbugbag 12y ago
Lenovo is to blame for deliberately bundling adware with their hardware. Komodia is to blame for making the software they make and the way they do it. Open-source is irrelevant to this matter, but if anything the tech community is to blame for telling the world that the lock in the browser and https means the connection is secure.

by notsony 12y ago

0x0 12y ago

Openssl and bash serve useful purposes and don't try to sneakily alter the user experience without being upfront about it. Pretty big difference, there.

Argorak 12y ago

"Point to the supplier" is a standard tactic, but also wrong. They did put their customers up to harm, for no other reason then trying to squeeze another buck out of them. They provide no additional benefit to the customer. OpenSSL and Bash are free services providing benefit to their users.

orblivion 12y ago

One counterpoint, if a minor one, is that Lenovo still maintains that this posed no security concern.

crazychrome 12y ago

Lenovo customers pay $$, man. Lenovo is either incompetent or evil. you pick.

takluyver 12y ago
> Lenovo is either incompetent or evil. you pick. (S)he picked incompetent: > Lenovo did not vet the software properly before bundling it and heads should roll, but I do not think they are deliberately evil or malicious.

xerphn 12y ago

No. You are saying that anyone who creates software with a security bug in it should be condemned. Komodia built their software with a very serious security hole, intentionally, to sell a product with HTTPS sniffing abilities. Just because Lenovo didn't build the software, doesn't mean they are not guilty of overlooking a serious security vulnerability by including software which provides no benefit to its customers. It's an insult to customers. The bugs you find in openSSL and Bash are not insults, they are mistakes made by people who don't get money out of their work (and who don't go out of their way to sell / track information). Security is hard to build correctly, easy to break.

mikeash 12y ago
MITMing your own SSL connections can be done safely, and for good reasons (Charles proxy being a good example of both). These guys are doing it unsafely, and for bad reasons. However, those two parts are unrelated! This stuff could easily have been safe had they known what they were doing, or prioritized that. I don't think it's fair to say that the security hole itself is intentional. Certainly if they hadn't built the product in the first place the hole wouldn't exist, but building the product doesn't imply the hole had to be there. The fundamental problem is that software like this greatly increases your attack surface, and thus should only be used with careful consideration if the benefits are worthwhile. Instead, Lenovo put its users at risk without informing them or providing them with any benefit.
- notsony 12y ago
  Yes, another use-case is if you are running Privoxy on your local computer; would be great if you could MITM all local SSL connections instead of having to manually whitelist specific sites.
  - SixSigma 12y ago
    Here's how to decrypt ssl sessions in Wireshark https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/ https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf... Before that I used Burpsuite, but that uses its own self signed cert too. http://portswigger.net/burp/ http://portswigger.net/burp/ Privoxy doesn't do SSL or did I miss something?

bigbugbag 12y ago

Lenovo is to blame for deliberately bundling adware with their hardware. Komodia is to blame for making the software they make and the way they do it. Open-source is irrelevant to this matter, but if anything the tech community is to blame for telling the world that the lock in the browser and https means the connection is secure.