4 ms·
Bullet point 4 is what I'd been wondering about: • The Superfish proxy accepts its own certificate, so now that the private key has been leaked, an attacker ca
by gojomo 12y ago
Bullet point 4 is what I'd been wondering about:
• The Superfish proxy accepts its own certificate, so now that the private key has been leaked, an attacker can mimic an arbitrary site in Chrome and IE
I thought there might be a chance that despite all the other idiocy here, they might have refused external certificates from their own CA, mitigating the risks somewhat. But no suck luck for Lenovo customers!
- jimktrains2 12y agoAnd this matters because even if you uninstall the program, it leaves the certificate behind, right? So you have to manually remove the cert to shield yourself against future attacks, in addition to removing the program
- VieElm 12y agoNot that this excuses Lenovo in any regard whatsoever, the removal instructions[1] Lenovo link to in their press release[2][3] includes the removal of a certificate. [1] http://support.lenovo.com/us/en/product_security/superfish_uninstall http://support.lenovo.com/us/en/product_security/superfish_u... [2] http://news.lenovo.com/article_display.cfm?article_id=1929 http://news.lenovo.com/article_display.cfm?article_id=1929 [3] http://support.lenovo.com/us/en/product_security/superfish http://support.lenovo.com/us/en/product_security/superfish
- TeMPOraL 12y agoGood, though TBH, it didn't include removal of a certificate just few hours ago. I guess they're breaking under the pressure of PR shitstorm.
- glandium 12y agoThat would have been comical, considering uninstalling doesn't remove the root cert, so a user would have been more secure with superfish installed than uninstalled.
- patcheudor 12y agoNope. Look at my reply to the parent. The Superfish solution is not properly passing the validation state of the public cert provided by the cert to the browser. As a result its fairly trivial to MitM HTTPS without need of the private when the Superfish software is installed. To be clear, it is absolutely worse to have Superfish installed than to have it removed.
- TazeTSchnitzel 12y agoThe Superfish proxy accepts any certificate. If you're being MITMed (before Superfish MITMs you), Superfish will help them by replacing their certificate with Superfish's.
- gojomo 12y agoI don't believe that's true, but if so – for example if it replaces self-signed certs, or certs from any untrusted CA, with its own (force-trusted) cert – then that would be worthy of another scary explicit bullet point. (It might just accept all CAs locally-configured, and it's accepting its own because they didn't special-case a rejection.)
- TazeTSchnitzel 12y agoIt is true. I can't remember where I read it, but I remember seeing it either here on HN or on Twitter.
- takluyver 12y agoKomodia's own info says that it will generate an invalid certificate if the real certificate was invalid or untrusted "so it will not cause a security problem". They may be lying, but that page is fairly open about the way it works: http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cert_creation http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cer...
- patcheudor 12y agoI wouldn't go as far as say lying, they just failed to consider the SAN. Unfortunately they pulled the doc, possibly due to what they claim to be a DDOS but it's still in Google cache: http://webcache.googleusercontent.com/search?q=cache:XUbVSX81n_YJ:www.komodia.com/wiki/index.php%3Ftitle%3DSSL_Digestor+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:XUbVSX8...
- 12y ago