15 ms·

Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

494 points by ndesaulniers 12y ago

gojomo 12y ago
Bullet point 4 is what I'd been wondering about: • The Superfish proxy accepts its own certificate, so now that the private key has been leaked, an attacker can mimic an arbitrary site in Chrome and IE I thought there might be a chance that despite all the other idiocy here, they might have refused external certificates from their own CA, mitigating the risks somewhat. But no suck luck for Lenovo customers!
- jimktrains2 12y ago
  And this matters because even if you uninstall the program, it leaves the certificate behind, right? So you have to manually remove the cert to shield yourself against future attacks, in addition to removing the program
  - VieElm 12y ago
    Not that this excuses Lenovo in any regard whatsoever, the removal instructions[1] Lenovo link to in their press release[2][3] includes the removal of a certificate. [1] http://support.lenovo.com/us/en/product_security/superfish_uninstall http://support.lenovo.com/us/en/product_security/superfish_u... [2] http://news.lenovo.com/article_display.cfm?article_id=1929 http://news.lenovo.com/article_display.cfm?article_id=1929 [3] http://support.lenovo.com/us/en/product_security/superfish http://support.lenovo.com/us/en/product_security/superfish
    - TeMPOraL 12y ago
      Good, though TBH, it didn't include removal of a certificate just few hours ago. I guess they're breaking under the pressure of PR shitstorm.
- glandium 12y ago
  That would have been comical, considering uninstalling doesn't remove the root cert, so a user would have been more secure with superfish installed than uninstalled.
  - patcheudor 12y ago
    Nope. Look at my reply to the parent. The Superfish solution is not properly passing the validation state of the public cert provided by the cert to the browser. As a result its fairly trivial to MitM HTTPS without need of the private when the Superfish software is installed. To be clear, it is absolutely worse to have Superfish installed than to have it removed.
- TazeTSchnitzel 12y ago
  The Superfish proxy accepts any certificate. If you're being MITMed (before Superfish MITMs you), Superfish will help them by replacing their certificate with Superfish's.
  - gojomo 12y ago
    I don't believe that's true, but if so – for example if it replaces self-signed certs, or certs from any untrusted CA, with its own (force-trusted) cert – then that would be worthy of another scary explicit bullet point. (It might just accept all CAs locally-configured, and it's accepting its own because they didn't special-case a rejection.)
    - TazeTSchnitzel 12y ago
      It is true. I can't remember where I read it, but I remember seeing it either here on HN or on Twitter.
      - takluyver 12y ago
        Komodia's own info says that it will generate an invalid certificate if the real certificate was invalid or untrusted "so it will not cause a security problem". They may be lying, but that page is fairly open about the way it works: http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cert_creation http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cer...
        patcheudor 12y ago
        I wouldn't go as far as say lying, they just failed to consider the SAN. Unfortunately they pulled the doc, possibly due to what they claim to be a DDOS but it's still in Google cache: http://webcache.googleusercontent.com/search?q=cache:XUbVSX81n_YJ:www.komodia.com/wiki/index.php%3Ftitle%3DSSL_Digestor+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:XUbVSX8...
        12y ago
tveita 12y ago
This is a PDF attached to this issue, requesting blacklisting of the Superfish certificate: https://bugzilla.mozilla.org/show_bug.cgi?id=1134506 https://bugzilla.mozilla.org/show_bug.cgi?id=1134506
- hurin 12y ago
  I'm somewhat puzzled by the single certificate. Couldn't they have generated a new signing request and self-signed on each machine - at least ensuring that each customer has a unique cert for their proxy?
  - lstamour 12y ago
    These guys aren't the brightest bulbs out there. You could even have it switch certificates on every reboot... or not do this in the first place. ;-)
    - deleted 12y ago
      [deleted]
    - deleted 12y ago
      [deleted]
    - nikital 12y ago
      > or not to do this in the first place. Are there other options besides installing my own root certificate? Assuming I want to write software that legitimately MITMs all HTTP and HTTPS traffic (parental control, ad blocker, anti-virus scan for webpages...). I want it to be browser independent and work with browsers that don't support extensions.
      - lstamour 12y ago
        Well, it's basically impossible in some cases to MITM while showing the same certificate without re-building a browser. So your best bet would be to modify existing browsers. That said, if content modification isn't required -- and all you want to do is snoop on SSL, you can use SSLKEYLOGFILE in NSS-based browsers like Firefox and Chrome. If legitimate, I'd prefer going the extension route: people want you in their browser, so you can walk them through whatever it takes to install you, or provide pre-made profiles with you enabled. The point of encryption is to avoid spying and while most users (as evidenced here) don't actually check that the HTTPS website certificate is what it claims to be, pretending to be the same site is about all you can do to modify content and MITM. I'd also point out that the problem here isn't so much that they're MITMing as that they're doing it really, really poorly. Of course, any backdoor could be used by others -- even your SSLKEYLOGFILE. ;-)
deleted 12y ago
[deleted]
bamura 12y ago
Lenovo too smart in laying down the removal instructions under their security advisors today!!
guelo 12y ago
Shouldn't Lenovo be issuing a recall and pulling all the inventory in their distribution channel? In other words, Best Buy shouldn't be selling these things!
- TheSoftwareGuy 12y ago
  You are absolutely right, but frankly, they never should have sold them to begin with.
- nandhp 12y ago
  I believe Lenovo's official statement previously said "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." However, it now has a link to LEN-2015-010, a high-severity security vulnerability. http://news.lenovo.com/article_display.cfm?article_id=1929 http://news.lenovo.com/article_display.cfm?article_id=1929 https://news.ycombinator.com/item?id=9074676 https://news.ycombinator.com/item?id=9074676 http://support.lenovo.com/us/en/product_security/superfish http://support.lenovo.com/us/en/product_security/superfish
  - orblivion 12y ago
    They didn't even close all their parentheses.
- remarkEon 12y ago
  Yes to both.
- nness 12y ago
  It's not in Lenovo's interest to voluntarily recall anything, unless they wanted to save face, but I would imagine consumer expectations on Lenovo are different than, say, a car manufacturer. But unlike a car manufacturer, I doubt any governments will compel them either... since this kind of thing is exactly what a government would want.
- arthurfm 12y ago
  According to the Wall Street Journal [1], Lenovo are going to release a program that completely removes Superfish from their PCs. > WSJ: What are you doing now to ensure the security of people who bought Lenovo laptops with the Superfish app? > Hortensius: As soon as the programmer is finished, we will provide a tool that removes all traces of the app from people’s laptops; this goes further than simply uninstalling the app. Once the app-wiping software is finished tonight or tomorrow, we’ll issue a press release with information on how to get it. [1] http://blogs.wsj.com/digits/2015/02/19/lenovo-cto-were-working-to-wipe-superfish-app-off-of-pcs/ http://blogs.wsj.com/digits/2015/02/19/lenovo-cto-were-worki...
edohyiez 12y ago
I find it a bit weird that it can MITM https://www.google.com/ https://www.google.com/ on Chrome. I thought Chrome did CA-pinning for Google-domains.
- schoen 12y ago
  Maybe it triggers the logic that allows (supposedly) user-added certs to override those pins? (Google was pressured into adding such logic by corporate users, whose IT departments want to -- supposedly openly -- MITM employees' connections.) Edit: I think that's the case. AGL's original announcement of pinning said: "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues." https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html If Chrome thinks that this was a "user installed root CA", it would have been allowed to override the pin. (Disclaimer: I haven't checked that this is right, I'm just using my recollection of how this could work according to AGL's account.)
  - edohyiez 12y ago
    Ah, That explains it. Thanks! And to semenko too.
    - schoen 12y ago
      It points to an interesting problem that, while browser vendors officially think that users ought to be notified when someone is using an intercepting proxy -- that it shouldn't be invisible to them -- when users aren't installing their own OS or configuring their own browser, it could be completely invisible in practice. So the IT department-installed or OEM-installed cert is treated as "user-installed" by the pinning logic, and the user never actually gets warned.
somerandomone 12y ago
I originally discovered this issue a month ago when debugging my friend's Lenovo laptop. Neither chrome nor IE can render battle.net correctly because the HTML injection is not properly escaped. Since the problem persists after a fresh recovery, I guess it's from some pre-installed software. I almost reported it to FBI.
- sitkack 12y ago
  Shouldn't Lenovo be guilty of hacking and illegal wiretaps?
  - lern_too_spel 12y ago
    To be guilty of wire fraud, Lenovo must have intent to defraud the user out of money. It will be tricky to prosecutte.
    - bo1024 12y ago
      Placing their ads on a site where the user believes they are something else (e.g. Google search ads) has to qualify.
  - chinathrow 12y ago
    They should be put in front of a court. With they I mean the management of Lenovo, together with the management of Superfish. Everything else is not acceptable.
  - danielweber 12y ago
    The law that would make this criminal would probably make innocently shipping software with security holes criminal as well. (There are some people in the industry who call for this. I am not one of them.)
- e12e 12y ago
  Should this fall under the original brief of the NSA? (Ironic, I know). I realize that FBI traditionally does "domestic" and CIA "foreign" -- but I seem to recall NSA has something about "cybersecurity threats" or some such nebulus thing in their mission statement?
patcheudor 12y ago
I went to Best Buy as well today and picked up a laptop to look into this further. The Superfish software is not properly passing the validation state of the public cert when it connects to a website like Bank of America as an example. There's no need to export their private and use it in a MitM transparent proxy. The software is simply not triggering appropriate warnings when provided an obviously fake certificate that has been generated in a way to bypass browser warnings. It's also not properly validating revoked certs. Both of these situations are very bad. Allowing any self-signed cert would lead me to believe that this could have easily been exploited in the wild without prior knowledge of this vulnerability. I'm not going to provide a how-to guide on how to exploit users here. I have notified both Superfish and Lenovo of this issue and here's an example of the improper status pass through based on doing something that might be quite obvious to some: This is what the browser should do when it encounters a self-signed cert delivered by an SSL/TLS MitM solution: http://defaultstore.com/six.png http://defaultstore.com/six.png However, it's not doing this for this self-signed public cert: http://defaultstore.com/four.png http://defaultstore.com/four.png Note both certs show "verify_fail." at the beginning and those who know how browser cryptography works will understand what has gone wrong with their implementation.
- patcheudor 12y ago
  Does anyone have a security contact at Superfish? It looks like they don't have a security@ mailbox: "DB3FFO11OLC004.mail.protection.outlook.com rejected your message to the following email addresses: security@superfish.com Something went wrong and your message couldn't be delivered. This could be a temporary issue. Try resending the message in a few minutes. If that doesn't work, forward this message to your email admin."
  - nadams 12y ago
    Try abuse or postmaster or one of these: http://whois.domaintools.com/superfish.com http://whois.domaintools.com/superfish.com
    - patcheudor 12y ago
Buge 12y ago
This isn't right though. I got a Lenovo Y50 a couple weeks ago, and when I downloaded Firefox and looked at the certificate, it was Superfish. I've since uninstalled Superfish and deleted the keys (I exported them first though). I know I probably should reinstall Windows but I'm too lazy.
jedanbik 12y ago
Not only did I have to remove the certificate from my root authority in the control panel, I also had to remove it from my list of certificates in Firefox. This was after uninstalling Superfish. Once I did all of these things, and cleared my history and cache and all that, the website that folks have been linking said that it didn't detect Superfish (sorry, I'm typing this from a phone). So my explanation wasn't very technical, but I feel as though the part of the process where you also remove the certificate from Firefox had been left out, and I wanted to share it in case it helps out another person. This news took me by surprise, as I just received a brand new Lenovo Yoga 2 for work last week, and it had this vulnerability.
- jrsmitchell 12y ago
  You're right. Further discussion in that bug and on twitter [1] confirm that Firefox is affected after a restart. The author of this didn't restart. So any removal instructions which don't include clearing out Firefox's certificates are incomplete. This includes Lenovo's published instructions. [1] - https://twitter.com/FiloSottile/status/568600661534875648 https://twitter.com/FiloSottile/status/568600661534875648
- Luyt 12y ago
  the website that folks have been linking said that it didn't detect Superfish (sorry, I'm typing this from a phone) The website you're referring to, is https://canibesuperphished.com/ https://canibesuperphished.com/
  - arthurfm 12y ago
    Another useful website is: https://filippo.io/Badfish/ https://filippo.io/Badfish/
    - jedanbik 12y ago
      This is the one I was thinking about and implicitly referring to. Thanks for posting.
- agapos 12y ago
userbinator 12y ago
While this whole Superfish/Lenovo thing is certainly quite scary, let's not forget the very important fact that, currently, the user ultimately still has the ability to modify the software on the machines he/she owns, which includes among other things (un)installing software like Superfish, and also adding/removing trusted certificates. There will be those who advocate locking down the certificate stores and other areas of the OS (e.g. only "approved" software can be installed) in an effort to prevent companies from doing things like this, but I think that could lead to an even worse situation - imagine if this was preinstalled on a locked-down system that made it nearly impossible to remove (or perhaps even discover!) To put it bluntly, I'd still prefer to buy a system "infected" with Superfish but which lets me reinstall the OS and configure it however I choose, than one which is locked-down so much that, even if such malware was not present initially, if something similarly undesirable is eventually installed by default, it would be nearly impossible to remove. Of course buying an open system that has no malware/adware preinstalled is even better, but given the way things seem to be going with "smart TVs" adding ads and whatnot, it feels like that might not be an option in the future.
- TeMPOraL 12y ago
  Welcome to the War over General-Purpose Computing. http://boingboing.net/2012/08/23/civilwar.html http://boingboing.net/2012/08/23/civilwar.html http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html The future really scares me. And yes, backlash from Superfish fiasco will probably only make things worse.
  - storrgie 12y ago
    This is exactly what I thought (I spammed many of my friends with the link to the talk). I bet you that this (which is a step in the wrong direction) will trigger a something worse (a leap in the wrong direction to 'protect' consumers).
  - GhotiFish 12y ago
    I don't understand how this would be the conclusion reached. If you asked a person on the street, would they not think that Lenovo is a entity of authority? That they were the ones dictating the computers configuration? That they were any more or less fallible/malicious than Sony or Microsoft or HP? If you asked anyone, would they not follow the line of reasoning that, if the manufacturer was releasing hardware in a default state of compromise, that we could not trust the default state of released hardware? Why would you conclude the opposite after this? I can't see a way to construe this as "We need to ensure that machines must stay as the manufacturer ordained to protect us from security threats introduced by the manufacturer!" I don't understand the rational here.
ZanyProgrammer 12y ago
It would be interesting to try any of the Lenovos at a Microsoft Store (say at San Francisco Center) and see if they also contain this malware.
thefreeman 12y ago
Any idea why it doesn't affect Firefox?
- syntheticcdo 12y ago
  Firefox has it's own certificate store. Both IE and Chrome utilize the Windows store.
  - rockdoe 12y ago
    But as pointed out in other comments, it looks like SuperFish does install the extra cert in Firefox's database too, but only after a restart.
emehrkay 12y ago
Computing is genuinely becoming scary. If I didn't browse tech sites or spend my days on HackerNews, I probably wouldn't know about these things. I'm getting older and more disinterested in the constant maintenance -- I just want the shit to work. It sucks the most for those who learned "don't install anything fishy, run a virus scan, don't open attachments, and you'll be fine." They bought a computer and followed the rules and are still being fucked over. I've seen a high number of comments that say "oh man, I never trust OEM software, clean installs only for me." So it looks like there is another rule for the pleb/peasant/uninitiated computer users to follow. I can barely keep up, I wonder how nontechnical people do.
- cbd1984 12y ago
  ARTICLE IS UNMARKED PDF (PDFs can be malware, too.)
- remarkEon 12y ago
  This. I can tell several stories of trying to set things up for my parents, only to have to call them/wait until I fly home next to fix something. Lessons have been learned the hard way on dumb email chains/anti-virus software, but trying to give them a list of browser settings (among other things) to do is getting to be too much. So, now what?
  - Luyt 12y ago
    Use some software with which you can do remote maintenance on your parents' computer(s). Or, introduce them to more stable OSses, like Ubuntu instead of Windows. That worked for my neighbours ;-)
    - remarkEon 12y ago
      I've thought about Ubuntu...but it's a comfort thing. I'm afraid that telling my parents "hey so this new thing is more stable...." and it'll just trail off after that. For now, I'm afraid, I'll just keep fighting the good fight. Remote maintenance is probably something I should look more into.
cbd1984 12y ago
PDF Didn't Hacker News used to mark PDFs?
- robin_reala 12y ago
  It marks PDFs if the URL ends in .pdf.
cbd1984 12y ago
Flagged for being unmarked PDF.
iLoch 12y ago
I will never again consider buying a Lenovo neither for myself, nor any company I am with. I'll also make sure to recommend another brand to anyone who asks my opinion. What an absurdly stupid business decision.
masswerk 12y ago
Shouldn't the content providers strike back, in order to stop such things as a business? E.g., a class action against those vendors who pre-install said software. Determine the average share of traffic of these machines, use average Adsense-earnings to determine the damage ... Globally, this might add up to something that would be suitable to take even a major corporation out of business ...
sbate1987 12y ago
Where did they get the Katy Perry shark?
billyhoffman 12y ago
Great research and I like the level of detail But why take actually photographs of the computer screen instead of just using native screen capture? The lights and reflections are super distracting. A minor nit, yes but still...
cbd1984 12y ago
PDF
- cbd1984 12y ago
  Article is a PDF
cbd1984 12y ago
This article crashed my browser.

494 points by ndesaulniers 12y ago

Bullet point 4 is what I'd been wondering about: • The Superfish proxy accepts its own certificate, so now that the private key has been leaked, an attacker can mimic an arbitrary site in Chrome and IE I thought there might be a chance that despite all the other idiocy here, they might have refused external certificates from their own CA, mitigating the risks somewhat. But no suck luck for Lenovo customers!

jimktrains2 12y ago
And this matters because even if you uninstall the program, it leaves the certificate behind, right? So you have to manually remove the cert to shield yourself against future attacks, in addition to removing the program
- VieElm 12y ago
  Not that this excuses Lenovo in any regard whatsoever, the removal instructions[1] Lenovo link to in their press release[2][3] includes the removal of a certificate. [1] http://support.lenovo.com/us/en/product_security/superfish_uninstall http://support.lenovo.com/us/en/product_security/superfish_u... [2] http://news.lenovo.com/article_display.cfm?article_id=1929 http://news.lenovo.com/article_display.cfm?article_id=1929 [3] http://support.lenovo.com/us/en/product_security/superfish http://support.lenovo.com/us/en/product_security/superfish
  - TeMPOraL 12y ago
    Good, though TBH, it didn't include removal of a certificate just few hours ago. I guess they're breaking under the pressure of PR shitstorm.
glandium 12y ago
That would have been comical, considering uninstalling doesn't remove the root cert, so a user would have been more secure with superfish installed than uninstalled.
- patcheudor 12y ago
  Nope. Look at my reply to the parent. The Superfish solution is not properly passing the validation state of the public cert provided by the cert to the browser. As a result its fairly trivial to MitM HTTPS without need of the private when the Superfish software is installed. To be clear, it is absolutely worse to have Superfish installed than to have it removed.
TazeTSchnitzel 12y ago
The Superfish proxy accepts any certificate. If you're being MITMed (before Superfish MITMs you), Superfish will help them by replacing their certificate with Superfish's.
- gojomo 12y ago
  I don't believe that's true, but if so – for example if it replaces self-signed certs, or certs from any untrusted CA, with its own (force-trusted) cert – then that would be worthy of another scary explicit bullet point. (It might just accept all CAs locally-configured, and it's accepting its own because they didn't special-case a rejection.)
  - TazeTSchnitzel 12y ago
    It is true. I can't remember where I read it, but I remember seeing it either here on HN or on Twitter.
    - takluyver 12y ago
      Komodia's own info says that it will generate an invalid certificate if the real certificate was invalid or untrusted "so it will not cause a security problem". They may be lying, but that page is fairly open about the way it works: http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cert_creation http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cer...
      - patcheudor 12y ago
        I wouldn't go as far as say lying, they just failed to consider the SAN. Unfortunately they pulled the doc, possibly due to what they claim to be a DDOS but it's still in Google cache: http://webcache.googleusercontent.com/search?q=cache:XUbVSX81n_YJ:www.komodia.com/wiki/index.php%3Ftitle%3DSSL_Digestor+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:XUbVSX8...
        12y ago

tveita 12y ago

This is a PDF attached to this issue, requesting blacklisting of the Superfish certificate: https://bugzilla.mozilla.org/show_bug.cgi?id=1134506 https://bugzilla.mozilla.org/show_bug.cgi?id=1134506

hurin 12y ago
I'm somewhat puzzled by the single certificate. Couldn't they have generated a new signing request and self-signed on each machine - at least ensuring that each customer has a unique cert for their proxy?
- lstamour 12y ago
  These guys aren't the brightest bulbs out there. You could even have it switch certificates on every reboot... or not do this in the first place. ;-)
  - deleted 12y ago
    [deleted]
  - deleted 12y ago
    [deleted]
  - nikital 12y ago
    > or not to do this in the first place. Are there other options besides installing my own root certificate? Assuming I want to write software that legitimately MITMs all HTTP and HTTPS traffic (parental control, ad blocker, anti-virus scan for webpages...). I want it to be browser independent and work with browsers that don't support extensions.
    - lstamour 12y ago
      Well, it's basically impossible in some cases to MITM while showing the same certificate without re-building a browser. So your best bet would be to modify existing browsers. That said, if content modification isn't required -- and all you want to do is snoop on SSL, you can use SSLKEYLOGFILE in NSS-based browsers like Firefox and Chrome. If legitimate, I'd prefer going the extension route: people want you in their browser, so you can walk them through whatever it takes to install you, or provide pre-made profiles with you enabled. The point of encryption is to avoid spying and while most users (as evidenced here) don't actually check that the HTTPS website certificate is what it claims to be, pretending to be the same site is about all you can do to modify content and MITM. I'd also point out that the problem here isn't so much that they're MITMing as that they're doing it really, really poorly. Of course, any backdoor could be used by others -- even your SSLKEYLOGFILE. ;-)

deleted 12y ago

[deleted]

bamura 12y ago

Lenovo too smart in laying down the removal instructions under their security advisors today!!

guelo 12y ago

Shouldn't Lenovo be issuing a recall and pulling all the inventory in their distribution channel? In other words, Best Buy shouldn't be selling these things!

TheSoftwareGuy 12y ago
You are absolutely right, but frankly, they never should have sold them to begin with.
nandhp 12y ago
I believe Lenovo's official statement previously said "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." However, it now has a link to LEN-2015-010, a high-severity security vulnerability. http://news.lenovo.com/article_display.cfm?article_id=1929 http://news.lenovo.com/article_display.cfm?article_id=1929 https://news.ycombinator.com/item?id=9074676 https://news.ycombinator.com/item?id=9074676 http://support.lenovo.com/us/en/product_security/superfish http://support.lenovo.com/us/en/product_security/superfish
- orblivion 12y ago
  They didn't even close all their parentheses.
remarkEon 12y ago
Yes to both.
nness 12y ago
It's not in Lenovo's interest to voluntarily recall anything, unless they wanted to save face, but I would imagine consumer expectations on Lenovo are different than, say, a car manufacturer. But unlike a car manufacturer, I doubt any governments will compel them either... since this kind of thing is exactly what a government would want.
arthurfm 12y ago
According to the Wall Street Journal [1], Lenovo are going to release a program that completely removes Superfish from their PCs. > WSJ: What are you doing now to ensure the security of people who bought Lenovo laptops with the Superfish app? > Hortensius: As soon as the programmer is finished, we will provide a tool that removes all traces of the app from people’s laptops; this goes further than simply uninstalling the app. Once the app-wiping software is finished tonight or tomorrow, we’ll issue a press release with information on how to get it. [1] http://blogs.wsj.com/digits/2015/02/19/lenovo-cto-were-working-to-wipe-superfish-app-off-of-pcs/ http://blogs.wsj.com/digits/2015/02/19/lenovo-cto-were-worki...

edohyiez 12y ago

I find it a bit weird that it can MITM https://www.google.com/ https://www.google.com/ on Chrome. I thought Chrome did CA-pinning for Google-domains.

schoen 12y ago
Maybe it triggers the logic that allows (supposedly) user-added certs to override those pins? (Google was pressured into adding such logic by corporate users, whose IT departments want to -- supposedly openly -- MITM employees' connections.) Edit: I think that's the case. AGL's original announcement of pinning said: "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues." https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html If Chrome thinks that this was a "user installed root CA", it would have been allowed to override the pin. (Disclaimer: I haven't checked that this is right, I'm just using my recollection of how this could work according to AGL's account.)
- edohyiez 12y ago
  Ah, That explains it. Thanks! And to semenko too.
  - schoen 12y ago
    It points to an interesting problem that, while browser vendors officially think that users ought to be notified when someone is using an intercepting proxy -- that it shouldn't be invisible to them -- when users aren't installing their own OS or configuring their own browser, it could be completely invisible in practice. So the IT department-installed or OEM-installed cert is treated as "user-installed" by the pinning logic, and the user never actually gets warned.

somerandomone 12y ago

I originally discovered this issue a month ago when debugging my friend's Lenovo laptop. Neither chrome nor IE can render battle.net correctly because the HTML injection is not properly escaped. Since the problem persists after a fresh recovery, I guess it's from some pre-installed software. I almost reported it to FBI.

sitkack 12y ago
Shouldn't Lenovo be guilty of hacking and illegal wiretaps?
- lern_too_spel 12y ago
  To be guilty of wire fraud, Lenovo must have intent to defraud the user out of money. It will be tricky to prosecutte.
  - bo1024 12y ago
    Placing their ads on a site where the user believes they are something else (e.g. Google search ads) has to qualify.
- chinathrow 12y ago
  They should be put in front of a court. With they I mean the management of Lenovo, together with the management of Superfish. Everything else is not acceptable.
- danielweber 12y ago
  The law that would make this criminal would probably make innocently shipping software with security holes criminal as well. (There are some people in the industry who call for this. I am not one of them.)
e12e 12y ago
Should this fall under the original brief of the NSA? (Ironic, I know). I realize that FBI traditionally does "domestic" and CIA "foreign" -- but I seem to recall NSA has something about "cybersecurity threats" or some such nebulus thing in their mission statement?

patcheudor 12y ago

I went to Best Buy as well today and picked up a laptop to look into this further. The Superfish software is not properly passing the validation state of the public cert when it connects to a website like Bank of America as an example. There's no need to export their private and use it in a MitM transparent proxy. The software is simply not triggering appropriate warnings when provided an obviously fake certificate that has been generated in a way to bypass browser warnings. It's also not properly validating revoked certs. Both of these situations are very bad. Allowing any self-signed cert would lead me to believe that this could have easily been exploited in the wild without prior knowledge of this vulnerability. I'm not going to provide a how-to guide on how to exploit users here. I have notified both Superfish and Lenovo of this issue and here's an example of the improper status pass through based on doing something that might be quite obvious to some: This is what the browser should do when it encounters a self-signed cert delivered by an SSL/TLS MitM solution: http://defaultstore.com/six.png http://defaultstore.com/six.png However, it's not doing this for this self-signed public cert: http://defaultstore.com/four.png http://defaultstore.com/four.png Note both certs show "verify_fail." at the beginning and those who know how browser cryptography works will understand what has gone wrong with their implementation.

patcheudor 12y ago
Does anyone have a security contact at Superfish? It looks like they don't have a security@ mailbox: "DB3FFO11OLC004.mail.protection.outlook.com rejected your message to the following email addresses: security@superfish.com Something went wrong and your message couldn't be delivered. This could be a temporary issue. Try resending the message in a few minutes. If that doesn't work, forward this message to your email admin."
- nadams 12y ago
  Try abuse or postmaster or one of these: http://whois.domaintools.com/superfish.com http://whois.domaintools.com/superfish.com
  - patcheudor 12y ago

Buge 12y ago

This isn't right though. I got a Lenovo Y50 a couple weeks ago, and when I downloaded Firefox and looked at the certificate, it was Superfish. I've since uninstalled Superfish and deleted the keys (I exported them first though). I know I probably should reinstall Windows but I'm too lazy.

jedanbik 12y ago

Not only did I have to remove the certificate from my root authority in the control panel, I also had to remove it from my list of certificates in Firefox. This was after uninstalling Superfish. Once I did all of these things, and cleared my history and cache and all that, the website that folks have been linking said that it didn't detect Superfish (sorry, I'm typing this from a phone). So my explanation wasn't very technical, but I feel as though the part of the process where you also remove the certificate from Firefox had been left out, and I wanted to share it in case it helps out another person. This news took me by surprise, as I just received a brand new Lenovo Yoga 2 for work last week, and it had this vulnerability.

jrsmitchell 12y ago
You're right. Further discussion in that bug and on twitter [1] confirm that Firefox is affected after a restart. The author of this didn't restart. So any removal instructions which don't include clearing out Firefox's certificates are incomplete. This includes Lenovo's published instructions. [1] - https://twitter.com/FiloSottile/status/568600661534875648 https://twitter.com/FiloSottile/status/568600661534875648
Luyt 12y ago
the website that folks have been linking said that it didn't detect Superfish (sorry, I'm typing this from a phone) The website you're referring to, is https://canibesuperphished.com/ https://canibesuperphished.com/
- arthurfm 12y ago
  Another useful website is: https://filippo.io/Badfish/ https://filippo.io/Badfish/
  - jedanbik 12y ago
    This is the one I was thinking about and implicitly referring to. Thanks for posting.
agapos 12y ago

userbinator 12y ago

While this whole Superfish/Lenovo thing is certainly quite scary, let's not forget the very important fact that, currently, the user ultimately still has the ability to modify the software on the machines he/she owns, which includes among other things (un)installing software like Superfish, and also adding/removing trusted certificates. There will be those who advocate locking down the certificate stores and other areas of the OS (e.g. only "approved" software can be installed) in an effort to prevent companies from doing things like this, but I think that could lead to an even worse situation - imagine if this was preinstalled on a locked-down system that made it nearly impossible to remove (or perhaps even discover!) To put it bluntly, I'd still prefer to buy a system "infected" with Superfish but which lets me reinstall the OS and configure it however I choose, than one which is locked-down so much that, even if such malware was not present initially, if something similarly undesirable is eventually installed by default, it would be nearly impossible to remove. Of course buying an open system that has no malware/adware preinstalled is even better, but given the way things seem to be going with "smart TVs" adding ads and whatnot, it feels like that might not be an option in the future.

TeMPOraL 12y ago
Welcome to the War over General-Purpose Computing. http://boingboing.net/2012/08/23/civilwar.html http://boingboing.net/2012/08/23/civilwar.html http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html The future really scares me. And yes, backlash from Superfish fiasco will probably only make things worse.
- storrgie 12y ago
  This is exactly what I thought (I spammed many of my friends with the link to the talk). I bet you that this (which is a step in the wrong direction) will trigger a something worse (a leap in the wrong direction to 'protect' consumers).
- GhotiFish 12y ago
  I don't understand how this would be the conclusion reached. If you asked a person on the street, would they not think that Lenovo is a entity of authority? That they were the ones dictating the computers configuration? That they were any more or less fallible/malicious than Sony or Microsoft or HP? If you asked anyone, would they not follow the line of reasoning that, if the manufacturer was releasing hardware in a default state of compromise, that we could not trust the default state of released hardware? Why would you conclude the opposite after this? I can't see a way to construe this as "We need to ensure that machines must stay as the manufacturer ordained to protect us from security threats introduced by the manufacturer!" I don't understand the rational here.

ZanyProgrammer 12y ago

It would be interesting to try any of the Lenovos at a Microsoft Store (say at San Francisco Center) and see if they also contain this malware.

thefreeman 12y ago

Any idea why it doesn't affect Firefox?

syntheticcdo 12y ago
Firefox has it's own certificate store. Both IE and Chrome utilize the Windows store.
- rockdoe 12y ago
  But as pointed out in other comments, it looks like SuperFish does install the extra cert in Firefox's database too, but only after a restart.

emehrkay 12y ago

Computing is genuinely becoming scary. If I didn't browse tech sites or spend my days on HackerNews, I probably wouldn't know about these things. I'm getting older and more disinterested in the constant maintenance -- I just want the shit to work. It sucks the most for those who learned "don't install anything fishy, run a virus scan, don't open attachments, and you'll be fine." They bought a computer and followed the rules and are still being fucked over. I've seen a high number of comments that say "oh man, I never trust OEM software, clean installs only for me." So it looks like there is another rule for the pleb/peasant/uninitiated computer users to follow. I can barely keep up, I wonder how nontechnical people do.

cbd1984 12y ago
ARTICLE IS UNMARKED PDF (PDFs can be malware, too.)
remarkEon 12y ago
This. I can tell several stories of trying to set things up for my parents, only to have to call them/wait until I fly home next to fix something. Lessons have been learned the hard way on dumb email chains/anti-virus software, but trying to give them a list of browser settings (among other things) to do is getting to be too much. So, now what?
- Luyt 12y ago
  Use some software with which you can do remote maintenance on your parents' computer(s). Or, introduce them to more stable OSses, like Ubuntu instead of Windows. That worked for my neighbours ;-)
  - remarkEon 12y ago
    I've thought about Ubuntu...but it's a comfort thing. I'm afraid that telling my parents "hey so this new thing is more stable...." and it'll just trail off after that. For now, I'm afraid, I'll just keep fighting the good fight. Remote maintenance is probably something I should look more into.

cbd1984 12y ago

PDF Didn't Hacker News used to mark PDFs?

robin_reala 12y ago
It marks PDFs if the URL ends in .pdf.

cbd1984 12y ago

Flagged for being unmarked PDF.

iLoch 12y ago

I will never again consider buying a Lenovo neither for myself, nor any company I am with. I'll also make sure to recommend another brand to anyone who asks my opinion. What an absurdly stupid business decision.

masswerk 12y ago

Shouldn't the content providers strike back, in order to stop such things as a business? E.g., a class action against those vendors who pre-install said software. Determine the average share of traffic of these machines, use average Adsense-earnings to determine the damage ... Globally, this might add up to something that would be suitable to take even a major corporation out of business ...

sbate1987 12y ago

Where did they get the Katy Perry shark?

billyhoffman 12y ago

Great research and I like the level of detail But why take actually photographs of the computer screen instead of just using native screen capture? The lights and reflections are super distracting. A minor nit, yes but still...

cbd1984 12y ago

PDF

cbd1984 12y ago
Article is a PDF

cbd1984 12y ago

This article crashed my browser.