Slashdot Mirror
Homeland Security Urges Lenovo Customers To Remove Superfish
HughPickens.com (3830033) writes "Reuters reports that the US Department of Homeland Security has advised Lenovo customers to remove "Superfish" software from their computers. According to an alert released through its National Cyber Awareness System the software makes users vulnerable to SSL spoofing and could allow a remote attacker to read encrypted web browser traffic, spoof websites and perform other attacks on Lenovo PCs with the software installed. Lenovo inititally said it stopped shipping the software because of complaints about features, not a security vulnerability. "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns," the company said in a statement to Reuters early on Thursday. On Friday, Lenovo spokesman Brion Tingler said the company's initial findings were flawed and that it was now advising customers to remove the software and providing instructions for uninstalling "Superfish". "We should have known about this sooner," Tingler said in an email. "And if we could go back, we never would have installed this software on our machines. But we can't, so we are dealing with this head on.""
"Lenovo began installing Superfish VisualDiscovery software on some of its computers as early as 2010". And Homeland Security, with all their skillful teams, their heavy means, could not figure out that dirty adware before 2015?
Slashdot, fix the reply notifications... You won't get away with it...
No, more like they want to be the only ones able to control your PC and don't appreciate the competition.
Hey! We found a chance to get positive PR! Such a rare occurence...contact the spin department!
as most viruses and trojans today are written for windows.
If you can't tell that installing a CA and the private key for it creates a barn door sized security vulnerability, you have no business selling computers with preinstalled software.
They've been doing nothing but putting spin on this since it blew up in their face. Claiming they installed it to enhance the user's experience instead of because they were paid to. Claiming there's no security risk. Claiming they stopped it because of complaints of the "features", rather than because their customers believed it to be intrusive and dangerous. Claiming it can be simply and completely removed with a standard uninstall, which does not remove the custom certificate and vulnerability. Retracting statements and making apologies while dodging the actual issue.
I don't expect many will accept this as a suitable definition of "head on".
To be fair, 90% OSes in the world are Windows. What do you think would happen if 90% OSes were Linux (besides my complete satisfaction)?
Slashdot, fix the reply notifications... You won't get away with it...
Throwing the baby out with the bathwater has never been an acceptable solution. Troll elsewhere.
If Homeland Security urges it, we surely must comply as good citizens.
Does anyone know if other computer manufactures have used Superfish software? Software installers? Just curious if other manufactures also bought the sales pitch from the Superfish sales team.
as most viruses and trojans today are written for windows.
Are you suggesting that Lenovo couldn't have done this if Linux was preinstalled?
"A plan fiendishly clever in its intricacies"- Homer Simpson
The agency could educate more the population. As it stands, this advice is superfishal.
Don't you know it is now both immoral and criminal to think beyond the next quarterly report?
This is a consumer protection function. For goodness sake. Give it to the commerce dept.
Its a G series consumer model.
It doesn't have "Superfish", never has had. I followed the manual removal procedure and didn't find any references to it.
Of course, this is probably only a feature of US Lenovo laptops, Lenovo Europe has probably got an equivalent fishing/manipulation system called someting else and are keeping quiet about it. "We don't install Superfish! OhhhNooooooo!!!!!".
Lenovo is a Chinese company. Is this situation our good friend China doing the same things that the NSA and others do for the US? A large amount of computer equipment is made in China so can we trust this stuff? Uinstalling Widows maybe. Reinstalling Windows clean yes.
I'd suggest to recommend uninstalling windows too as most viruses and trojans today are written for windows.
And then what? Install the perpetually buggy OS called Linux? Yeah, that will work out just fine.
Petah Tiqva, Israel.
I think it's interesting that Lenovo posts not just the "Automatic Removal Tool," but also the source code to the tool. What I want to know is this: has anyone compiled it, and managed to get their compile options/environment such that they came up with a binary that matches the downloadable tool?
For your security, this post has been encrypted with ROT-13, twice.
Interesting (in a scaring way). I wish I had mod points.
My first program:
Hell Segmentation fault
As it interferes with out software that pretty much does the same thing.
Yeah, like anyone would sign up for that. Might as well put a neon sign on your house "Please track my every move, for I am a self-identified sheep."
What about all those nefarious apps in the Android app store? Do you recommend not using Android either?
Linux would certainly rise the entry level for malware writers, which would make malware writing a less promising market.
+1I, that's what I thought.
Slashdot, fix the reply notifications... You won't get away with it...
If you care about the security of your computers, networks and data, I think you only have one choice: OpenBSD.
OpenBSD is the only operating system project that has shown it consistently puts forth the emphasis on security, as well as the extremely high level of care needed.
Not everybody's needs are equal, of course. Not everybody cares about the security of their computers, networks, or data. So they don't have to use OpenBSD.
But anyone who does give even the slightest damn about security really only has one choice, and that choice is OpenBSD.
If you consider security to be important, but then you don't use OpenBSD for whatever reason, any negative repercussions are solely your fault.
So just do the right thing if security matters to you: use OpenBSD!
Lenovo's behaviour here is disgraceful.
This is why we need computer hardware that is free and open all the way down to the hardware. At the very least, NO-ONE should buy a Lenovo from now on.
It's that simple. Lenovo has to be hammered into the ground for this. If you don't think so, then you either work for them or you don't understand the full implications and just how bad this is.
or Run away from companies that literally attempt to cause consumers security problems and consumers should never come back. That's the only way companies are going to learn to be buyer/customer oriented.
Linux would certainly rise the entry level for malware writers, which would make malware writing a less promising market.
Today's Linux, maybe. The Linux that's been rewritten so 90%+ of the population will use it... doubtful. You'd probably have to make sudo escalation as easy as UAC escalation and once you run as administrator/root it's pretty much game over no matter what system you're on.
Live today, because you never know what tomorrow brings
Homeland Security wants you to remove this from your system because something in it is messing with the NSA's ability to easily peer into said system? Just a thought.
Is there a list of good\bad CA certificates?
Captcha - insures
Why, thank you! I had no idea you cared!
Homeland security is now an expert on computer security? Will they do as wonderful a job here as they've done at airports? Will Americans soon have to flash their national IDs at the computers before being allowed on the Internet?
What the devil is Homeland Security doing issuing such a statement? Mission creep to the nth degree...
Enjoy life! This is not a dress rehearsal.
Hello!
We, your neighbourly friends over at DHS got your back and we've provided a convient uninstaller for that nasty pieve of Chinese spyware a/k/a Superfish. Please indicate if you are a US Citizen/Resident* then click download, run and just click Yes to run as an Administrator. Kthxbye!
* US Citizens/Residents will be provided by a similar download from our technology partners at gchq-dl.gov.uk.
When the copyright term is "forever minus a day", live every day like it's the last.
This is why when I set up a new PC for a customer, I run a virus sweep and a malware sweep. They put so much other junk on there, I don't trust them to not put crap like this on there too.
http://windows.microsoft.com/e...
And get rid of all of the other crapware that Lenovo put on your PC in one fell swoop. No doubt it will take more effort to do it this way but it will also be more complete. (I have no idea if this works outside the US.)
For further information I wold check the ideapad section at notebookreview.com where you can find reinstallation help (including the thread I just started.)
To be fair, 90% OSes in the world are Windows. What do you think would happen if 90% OSes were Linux (besides my complete satisfaction)?
I can't say for sure - but I doubt people would be touting the security of Windows.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Superfish has been added to malware database of Windows Defender (the integrated virus protection of Windows). A lot of Windows machines are already ringing alarm bells.
Are you suggesting that Lenovo couldn't have done this if Linux was preinstalled?
Lenovo wouldn't have dared doing it.
Slashdot, fix the reply notifications... You won't get away with it...
Wut? I know Linus is a bit of a hard case, but I kinda doubt that Lenovo shivers in their corporate boots every time they here his name mentioned.
Faster! Faster! Faster would be better!
Now I'm all confused. Should we remove this crap or is it actually beneficial to us?
They wouldn't want us to get rid of it if it was horrific and privacy-devastating.
that nasty pieve of Chinese spyware a/k/a Superfish.
If anything, the technology behind Superfish is Israeli
I am Slashdot. Are you Slashdot as well?
Maybe not. But such crapware would have been detected much faster on Linux.
Slashdot, fix the reply notifications... You won't get away with it...
Easy. Shit ware, Trojaned app stores, and fake certicates would come pre-installed on them with Linux too.
Folks put your linux advocacy aside as linux has Trojans too. They simply aren't targeted as linux users are smarter and can delete them. Not because modern windows is somehow less secure.
Hasn't been true since XP SP 1 died. Windows today is as secure if not more than linux design wise. It has ACL lists, low rights sandboxing options and so on.
http://saveie6.com/
I don't think thoroughly means what he thinks it means.
Number one reason not to use Ubuntu and anything that uses SUDO in a way that it uses the same password as your username password, it's fucking stupid, kill sudo and use SU with a proper root password that's different to your user password. Ubuntu should be shamed for using sudo in such a stupid fashion.
http://chimpbox.us
SystemD gives you complete satisfaction?
[Groans internally]
systemd relative importance has been discussed here on this very site. It's deemed overrated.
Slashdot, fix the reply notifications... You won't get away with it...
We would be complaining about systemd?
"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns,"
Everyone involved in the investigation needs fired because they fucking suck at their job.
The last time I checked Superfish was installed in the Flash Video Downloader available from the official Mozilla Addons download website.
In the FVD source I have locally, the files of interest are superfish_titles.txt and superfish.js which are both in the modules/ directory.
Because, just like with robbery, the government hates competition.
"Lost time is not found again."
For the typical Windows/Mac/Ubuntu user who would install malware, the only time they ever type an OS-related password on their system is to perform superuser tasks. Most people don't use passwords on their personal computers and have automatic login set up. The fact that the sudo password is the same as their account password is irrelevant because they only ever use it to perform superuser tasks anyway.
If you want a vision of the future, imagine a youtube comments section scrolling - forever.
Not after systemd
That may be true.
It's not applicable in this case, because this is OEM-installed adware. Everything it does can be implemented just fine on a Linux system. The solution is really the same for this sort of thing regardless of whether you're talking Windows or Linux -- don't use the OEM-provided pile of crapware that comes with the machine; install a brand-new copy of just the OS.
> Linux would certainly rise the entry level for malware writers
You mean the Linux with Systemd or the one without?
Ah, systemd: the gateway that would control everything. Wait until it turns up to have a special hidden hook for doing MITM attacks.
Someone needs to sue these dicks- if I had to repair my computer for national security reasons because of someone's incompetent malfeasance, I would want to get paid for the time wasted. If you're a lawyer specializing in class action suits, this warning from the DHS is like a Superfish on a platter!
true.
You were modded down (gee I wonder why) but Komodia is Israeli for sure. I'd be thoroughly surprised if Mossad wasn't somehow involved. No wonder DHS has issued guidance and Microsoft has incorporated Superfish into their own malware detection products, all within 24 hours of the story breaking.
NSA may pass a lot of unfiltered intel to Israel, but it doesn't like to be upstaged on its own turf.
Registry Registrant ID:
Registrant Name: Barak Weichselbaum
Registrant Organization: Komodia
Registrant Street: 101 East Town St Suite 540
Registrant City: Pardesia
Registrant State/Province: Pardesia
Registrant Postal Code: 42815
Registrant Country: IL
Registrant Phone: +00.6142772739
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: barak@komodia.com
Registry Admin ID:
Admin Name: Barak Weichselbaum
Admin Organization: Komodia
Admin Street: 101 East Town St Suite 540
Admin City: Pardesia
Admin State/Province: Pardesia
Admin Postal Code: 42815
Admin Country: IL
Admin Phone: +00.6142772739
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: barak@komodia.com
I just love watching threads like this.
Haven't used Windows for 10 years now, and I finally understand the true meaning of schadenfreude.
Israeli? The company is in California. Let me guess...anti-Semite who is afraid?
I guess it's not obvious to most users that you could set up admin account for maintenance and installing stuff, while using personal account for lol cats and 420noscope bazing. It doesn't take that much technical knowledge , you know
That 90% OS's is of course, one great big fat lie. Let's try and count mobile devices in that and as they greatly outnumber desktops and that doesn't include servers either. So yeah, windows, they are well below 50% and falling fast with regard to OS installations. When it comes to Lenovo and superfish and their intent was to 'supplement the shopping experience', seriously piss of you public relations shit heads, that makes them a dead product manufacturer for at least a decade, simply not to be trusted, redirecting searches, hidden and hard to remove, simply totally and grossly unacceptable, anybody who buys any of the products even from a bargain bin is foolish.
Chaos - everything, everywhere, everywhen
DHS wants a few thousand Lenovo PC owners to do this while their cronies are hacking and spying on everybody worldwide whether they own a PC, smartphone or not. Look over there! A Chinaman named Lenovo and you should be very afraid! Sick. Of. It.
To be fair, 90% OSes in the world are Windows. What do you think would happen if 90% OSes were Linux (besides my complete satisfaction)?
Then the year of the Linux desktop would be 3 years away instead of 5 years away.
Too late.
If it's already been exploited to install other malware, removing the loader for that malware isn't going to get rid of the malware that came in while the door was being held open by Superfish.
That Uber department is a whole lot of other stuff mashed together and then expanding.
Enforcing copyright on Rubik's cubes - that's them. Disaster recovery - that's them.
It's Californian spyware.
I met a spammer once when I was out of work and thought I'd take anything. He had a similar attitude to the above quote and said he was just informing people of the options available for porn and penis enlargement. Turns out I wasn't quite ready to take anything, but maybe mostly because it didn't look like I could trust him to pay me either.
90% are not Windows.
Apple has around 13% of the desktop market share, Linux has around 2-3%.
And when it comes to mobiles/tablets, Microsoft doesn't basically exist at all.
Not even today's Linux. How many distros actually have AppArmor/SELinux enabled?
Most human behaviour can be explained in terms of identity.
Yeah right,
I remind you of the rant Linus Torvalds had with SUSE where his daughter needed to know the root password to install printers.
I think a not so super level is required for limited system change rights.
No, the company has offices in both Palo Alto and in Israel. The CEO and co-founder was born in Israel. The company itself was founded in Israel.
> You'd probably have to make sudo escalation as easy as UAC escalation
Naw, we just have to wait until the holes in systemd (either intentional or inadvertent/as yet unfound by testing or use) get exploited and then all hell will break loose.
Ducks, reaches for popcorn.