4 ms·

>In order to be able to inject content into secure connections, it adds a trusted root certificate to the Windows and Firefox root stores. I'm really not an ex

>In order to be able to inject content into secure connections, it adds a trusted root certificate to the Windows and Firefox root stores. I'm really not an expert. Can someone please explain what this means? How is Lenovo able to modify firefox to intercept web connections? If Lenovo can do this, can anyone? How can I check firefox hasn't been tampered with before I download it?

ewzimm 12y ago
|||->Options->Advanced->View Certificates SSL works by verifying a certificate against an authority, so if there is anyone you don't trust on your list, you can't trust site you are visiting. Superfish distributed their private signing key everywhere, protected only by the simple 'komodia' password. Now anyone can pretend to be them. Operating systems install their own list of authorities, but Firefox maintains its own. Other Komodia products are also vulnerable.
- Dylan16807 12y ago
  I feel like it's better to not mention the password on the key. It could have been the best password in the world and it wouldn't matter. Local signing means the key can be extracted. Talking about the minor obfuscation of storing a passworded key in the same file as the password is a red herring that gives the wrong impression. In short: It wasn't protected by the password. It was protected by nothing.
  - ewzimm 12y ago
    Good point. The important part is that it illustrates just how vulnerable Komodia products are. That password will likely get people access to other things as well.
kbrosnan 12y ago
Before you download it is really hard to prove that the bits have not been tampered with. Once you download the installer you can verify the hash for the installer via md5, sha1, or sha512 by checking against the file listing the hashes at https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/latest/ https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/lat... How do you know that the hash files are good? Well you check the signature of the files with the public key provided. One of the more advanced things Mozilla is working on is verifiable builds. Which means given the source code, the exact same compiler, and configs one can end up with build that you did but would pass the same hash tests because it is bit for bit identical. Now you have software that you can trust is from the source provided. However you are still not safe from what superfish is doing. Superfish is not tampering with Firefox on download. It has a service that checks for new browsers. When it sees one it inserts its certificate authority (CA) into the browser's CA data store. The second part is that they force all the user's network traffic through a local proxy You <=> superfish proxy <=> the internet There are ways to detect this 'man in the middle'. The user can keep a list of certs and which sites they belong to. The browser can do this too which is called key pinning. The browser could warn the user on cert changes. It is difficult for users to make informed decisions as certs are replaced all the time for legitimate reasons. It also fails to catch the preinstalled superfish scenario.

ewzimm 12y ago

|||->Options->Advanced->View Certificates SSL works by verifying a certificate against an authority, so if there is anyone you don't trust on your list, you can't trust site you are visiting. Superfish distributed their private signing key everywhere, protected only by the simple 'komodia' password. Now anyone can pretend to be them. Operating systems install their own list of authorities, but Firefox maintains its own. Other Komodia products are also vulnerable.

Dylan16807 12y ago
I feel like it's better to not mention the password on the key. It could have been the best password in the world and it wouldn't matter. Local signing means the key can be extracted. Talking about the minor obfuscation of storing a passworded key in the same file as the password is a red herring that gives the wrong impression. In short: It wasn't protected by the password. It was protected by nothing.
- ewzimm 12y ago
  Good point. The important part is that it illustrates just how vulnerable Komodia products are. That password will likely get people access to other things as well.

kbrosnan 12y ago

Before you download it is really hard to prove that the bits have not been tampered with. Once you download the installer you can verify the hash for the installer via md5, sha1, or sha512 by checking against the file listing the hashes at https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/latest/ https://ftp.mozilla.org/pub/mozilla.org/firefox/releases/lat... How do you know that the hash files are good? Well you check the signature of the files with the public key provided. One of the more advanced things Mozilla is working on is verifiable builds. Which means given the source code, the exact same compiler, and configs one can end up with build that you did but would pass the same hash tests because it is bit for bit identical. Now you have software that you can trust is from the source provided. However you are still not safe from what superfish is doing. Superfish is not tampering with Firefox on download. It has a service that checks for new browsers. When it sees one it inserts its certificate authority (CA) into the browser's CA data store. The second part is that they force all the user's network traffic through a local proxy You <=> superfish proxy <=> the internet There are ways to detect this 'man in the middle'. The user can keep a list of certs and which sites they belong to. The browser can do this too which is called key pinning. The browser could warn the user on cert changes. It is difficult for users to make informed decisions as certs are replaced all the time for legitimate reasons. It also fails to catch the preinstalled superfish scenario.