Slashdot Mirror
Superfish Security Certificate Password Cracked, Creating New Attack Vector
In a followup to today's news about junk software included with Lenovo computers, an anonymous reader writes Robert Graham at Errata Security has published an article announcing his success in extracting the SuperFish self-signed security certificate from the adware which has caused Chinese computer manufacturer Lenovo such embarrassment in the last day. Since SuperFish is already capable of carrying out man-in-the-middle attacks over secure connections on the Lenovo machines which use the certificate, the disclosure of the certificate's password presents hackers with a 'a pre-installed hacking environment' which would be difficult to arrange by other means. The password, "komodia," is also the name of the Komodia Redirector framework, which allows its clients to manipulate TCP/IP network sessions "with a few simple clicks."
Of course they can be sued. Can you actually win? Probably not. I would assume there's some agreement somewhere when you unwrap the computer saying you accept the software that's installed.
Um, already discussed. http://yro.slashdot.org/story/...
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
Now that the vendor knows this, they may be legally obligated to do a "voluntary" factory recall or face a government-mandated involuntary recall.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
What's next:
LENOVO: "Hey! You can't exploit or exploit! DMCA DMCA!"
Your thin skin doesn't make me a troll
Anybody else work in IT and is starting to get depressed?
I am just soo tried of trying to keep up with all the hacking, spying & stealing going on.......
Constantly feeling attacked from all sides (gov, corporations etc.)
Who can you even trust anymore?
I would like to take a more active role in protecting my privacy and personal data, however I do not see how this is possible without completely abandoning all electronic gadgets and the internet?
Preloading advertising spyware with a new computer while knowingly disabling all https and code signing security.
There is selfish, there is stupid, there is dumb and there is criminal batshit insanity.
Having been a fan of Lenovo for years I sincerely hope they are sued into oblivion and face criminal prosecution. No need wasting your time wondering if I will ever buy anything from them again.
legitimate question: what slashdotter still uses the stock OS on a laptop they purchase?
If by "OS" you mean the factory-installed crypto-signed firmware/bootloader/OS stack which can't be changed without keys the end-user doesn't have, then the answer is "probably more than we would like to think."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Summaries don't contain *all* the words (that's what makes them summaries rather than articles). Even dumb Americans know that.
Frankly, I'm having a hard time seeing how Lenovo recovers from this.
Editor, A1-AAA AmeriCaptions
It doesn't take government operatives... At this point, it's a dupe. I already raised both the issue of all current manufacturers being affected and the fact that not enough actual information was released. It's not a conspiracy in this case, it's just bad reporting being moderated as such.
If someone submits the Kaspersky article, maybe it'll get more traction. Instead, we keep getting submissions that are all hype and no substance, filled with editorialization and almost zero facts. People have tried to spin "custom targeted spyware inserted into firmware of targeted computers, regardless of drive manufacturer" into "firmware from all hardware vendors comes pre-loaded with spyware that reports back to the NSA"
superfish is the hidden, non-user interface version.
note, the lesser known, CLI version is called shellfish
(thank you, I'll be here all night.)
--
"It is now safe to switch off your computer."
Think it through...
1) Drive F/W gets infected.
2) Drive infects OS and UEFI on boot.
3) You detect malware, but don't realise it's in the F/W of the drive. You disinfect the drive and reboot.
4) You notice the malware is still evident, but can't find any trace of it on the drive. You detect it in the UEFI and flash that to get rid of it.
5) You notice it's STILL there, so you assume it must be so deep in the UEFI that you can't get rid of it (which many would consider far more plausible than it being in the DRIVE F/W!). You therefore replace the whole PC, but swap the disk over as you believe the drive (which you have now "securely" wiped) is safe.
6) Guess what's now infected!?!
OR (more likely) you infect an external hard disk and find that you're still spreading malware from machine to machine throughout the PCs of your company/family/friends/whatever, even after you have "securely" wiped it.
Just my $0.03 (At current exchange rates, my £0.02 is worth more than your $0.02)
I missed the previous article. Just checked my son's laptop that I bought him for Christmas and had to remove this crap. Thanks to whoever exposed this.
That was my first and last Lenovo ever (as in "my first Sony"). What were they thinking.
This is not the sig you're looking for.
> At Lenovo, we make every effort to provide a great user experience for our customers
> In our effort to enhance our user experience, we pre-installed a piece of third-party software, Superfish
PR words are beyond amazingness; when did this became a supreme art like that ? ... anything ?
Is this message really usefull to