Slashdot Mirror
Ars: SSL-Busting Code That Threatened Lenovo Users Found In a Dozen More Apps
Ars Technica reports on the continuing revelations about the same junkware that Lenovo has shipped on their computers, but which is known now to be present in at least 14 pieces of software.
The list of software known to use the same HTTPS-breaking technology recently found preinstalled on Lenovo laptops has risen dramatically with the discovery of at least 12 new titles, including one that's categorized as a malicious trojan by a major antivirus provider. ... What all these applications have in common is that they make people less secure through their use of an easily obtained root CA [certificate authority], they provide little information about the risks of the technology, and in some cases they are difficult to remove," Matt Richard, a threats researcher on the Facebook security team, wrote in Friday's post. "Furthermore, it is likely that these intercepting SSL proxies won't keep up with the HTTPS features in browsers (e.g., certificate pinning and forward secrecy), meaning they could potentially expose private data to network attackers. Some of these deficiencies can be detected by antivirus products as malware or adware, though from our research, detection successes are sporadic."
List 'em in the summary, slashdot.
CartCrunch Israel LTD
WiredTools LTD
Say Media Group LTD
Over the Rainbow Tech
System Alerts
ArcadeGiant
Objectify Media Inc
Catalytix Web Services
OptimizerMonitor
Hey look, there's Israel again (at least 3 times in fact). This Komodia/Superfish crap is likely Mossad sponsored. That would also help explain why Homeland Security put out urgent guidance to remove the crapware and even Microsoft added detection directly to their anti-malware tools. NSA doesn't like being upstaged on its own turf.
I would contend there are problems in the hardware also. This one runs deep. Everything on the market needs further inspection. More so now with all the governments demanding backdoors.
“He’s not deformed, he’s just drunk!”
I smell the hand of a three-letter agency? Or perhaps this is too gauche a manoeuvre and they'd be more subtle than this?
I'm fairly certain just installing this software is illegal.
Its not protected by some EULA because the device is sold before the EULA can be read, which courts have already ruled invalidates the EULA.
It violates the same laws that were used to put Kevin Mitnick in jail (and lets be clear, he deserved it), unauthorized access to a computer system and unauthorized access to data flowing across a network.
Hang'em high, I say. Bring Lenovo's leaders out to the chopping block, as well as the leadership of the companies who made any other software that works like this. Its a scam from the very beginning, theres no 'well, maybe its not bad' or 'maybe it was an accident' to it. This is outright bullshit behavior by companies trying to sell a product to someone and then turn that someone into the product for someone else. The entire legal system AND THE PUBLIC need to come down on this like a ton of bricks and make it clear that its unacceptable and will not be tolerated. And by not tolerated I mean 'you will be jailed, not fined'.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Which is why you should always build your own system.
Woz was right.
The browsers/OSes should harden by eliminating the ability for 3rd party software to automatically install a certificate or CA as trusted into the system database. They should also remove any functionality that allows a 'globally' wildcarded certifacte to be deployed to the browser
Basically, when the computer's hostname is assigned, or during user profile creation, the trusted certificate store should be reinitialized with only stock certificates approved by the OS maker or browser vendor.
A machine-specific keypair should be generated and used to stamp all the certificates with a local trust signature.
Any access to the machine keypair / stamp should be available only through an interactive approval process.
Sysprep'ing an image or changing the product key should invalidate the local trust mark and require manual re-approval of all certs not in the browser vendor's official trust list.
yeah binary analysis on the fly should be included in current antimalware programs, not just file hashes. it should be automatic and do the work without you busting a nut trying to examine shit yourself.
for *nix this should include a 'suck and spit' program which tears apart the newly downloaded binaries and checks them for shit before installing them.
I thought we all learned 20+ years ago that OS images from manufacturers could not be trusted. Doesn't everyone install their own OS image upon buying a new system any more? If not, well fine, but this is what you are going to get.
Now that HW is being increasingly compromised of course have yet another problem to contend with, but that doesn't mean installing your own OS has become a bad idea. It's still absolutely necessary, and anyone not doing it is begging for problems.
Many places are giving up on American software due to potential spying. Will Israeli software companies see a similar backlash?
The last time I checked a version of Superfish was installed in the Flash Video Downloader for Android available from the official Mozilla Addons download website.
In the FVD source I have locally, the files of interest are superfish_titles.txt and superfish.js which are both in the modules/ directory.
I can't remember if the same source kit is used for desktop Firefox.
Microsoft needs to grow a pair and lay down the law to any company that wants to be an OEM for their products. Apple wouldn't let the carriers pull this stunt on their phones.
"Most people don't even know what a rootkit is, so why should they care about it?" - Thomas Hesse, President, Global digital business, Sony BMG
http://www.f-secure.com/weblog...
http://www.f-secure.com/weblog...
This is a software issue, not a hardware issue. Unless you propose to personally code the entire operating system and every application program, that is not practical.
That said, replacing the preinstalled OS with a free one is my first step when buying a new computer. Most recently I managed to buy a PC without an OS at all, but that's rare,
Preinstalled vulnerabilities have to be deemed illegal, and compensated for. Software bugs happen, but installing a software for money being exploited with no use to the user (or ending a trial Antivirus) , should be illegal. I am talking about preinstalled software for the purposes of money. Yes the cost of the system is off set by the Adware. The rapid decline of the PC markets makes it seem easier for companies to install Adware to circumvent the cost. Support for money or giving a better product has went the way of the Unicorn. This should be illegal. A lot of individuals do not know what a acceptable application is vs a preinstalled, and this is how I make my money fixing Windows PCs.
Might kill my business, but this has got worse over the years.
I am getting tired of all the Malware on windows. As soon as the Chromebook Pixel 2 gets released (assuming it has more RAM and 64GB+ of SSD storage as well as a 16x9 AR).
I am not sure why I have been holding off this long since about 1 year ago I stopped using most of Microsoft tools in favor of Google Apps for business (collaboration features of google docs/drive are just better and gmail + calendar are significantly better IMHO).
Either way, after look at my use pattern over the past year and the type of work I do - I cannot imagine why I need to stay with a Windows Laptop with the increased Malware/exposure risk.
... I realized my non-blessed Firefox suddenly was unable to reach Google(SSL). Merely searching sounded an alert about Google not being who I thought it was, but in IE and Chrome everything worked like a charm.
What I thought at the time was that "they" (yes, "they" at our central IT dept.) were probably checking what we searched. We're fairly conscious about law-mandated secrecy and the network is not mine, after all. My decision to use Google(SSL) also was based on work needs; in the end, I quit having privacy because I thought they had the obligation to ensure good use of the network.
Now I wonder whether they knew what is happening at all...
Not just any boring vanilla pony - we want a unicorn pony and rainbows and the whole bit!
Lenovo probably will fire somebody, for embarrassing them, but it won't change the number of vendors of crapware out there. Lenovo's certainly not going to take the kind of financial hit that Gemalto did when the public found that the GCHQ had pwned all the SIM cards they sold. Maybe one or two adware companies will lose a non-trivial percentage, but there's a market for sleazy advertising and there's a market for having software companies pay to Add Valuable Features to your hardware.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Israel doesn't have a lot of revenue sources or natural resources, so high-tech products like software are important to them, even more so than growing oranges on Palestinian land. And everybody has to serve in the army, except a few specially exempted groups, so just about everybody with a college education has been in the Army before they got that high-tech job, and a lot of them did computer jobs in the Army as well as marching around with Uzis, because every army these days needs computer technology. That doesn't mean that every high-tech company in Israel, or even every sleazy adware company in Israel, is a front for Mossad.
Homeland Security has two highly obvious reasons to put out urgent guidance to remove crapware - there's a Congressional partisan squabble that's caught their budget in the crossfire, so they want to get positive press mention rather than the negative mention they'd get if they didn't do that, and the NSA's just gotten caught bugging every computer in the world so Homeland Security needs to talk about anybody else they can being dangerous and scary.
Besides, if it really was Mossad, they'd have done a much better job.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
of at least 12 new titles, including one that's categorized as a malicious trojan by a major antivirus provider.
Why aren't they all categorized as malicious trojans by all major antivirus providers?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The NSA program can flash permanently any HDD. FOREVER!!
There are some older drives out there that aren't flashable, at least not over the normal computer/drive connection (look for "service" connections on late-1990s/early-2000s drives).
In light of these revelations, expect vendors to sell (at a premium of course) drives which can't be "flashed" without setting a physical switch/jumper.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
https://blog.hboeck.de/archives/865-Comodo-ships-Adware-Privdog-worse-than-Superfish.html
You should go dig into Talmon Marcus, Viber's chief, thats a dodgy money trail out of Cyprus but when you dig into the people they seem to be in the US.
His previous company did a lot of very similar apps. MP3 encoders with malware, Video recorders... with malware. All bundled open source, given free, but with spyware added.
I think you'll find the NSA is the biggest customer, and hence the funder for a lot of these apps. It just happens that people who worked for the spy agencies know who to sell to, so they leave and make spyware knowing its a profitable market with hidden buyers.
Komodia's own 'About page' listed its head as former Israeli Defence force Intelligence Core. (It's taken down now but you can get a cache of it from DuckDuck).
"Barak Weichselbaum founded Komodia, Inc. in 2000, following his military service as a programmer in the IDF's Intelligence Core."
Note he's a programmer from the *Intelligence* core, not a foot soldiers, a hacker/spy.
This is the same as Vibers head (Viber = messaging app believed to be Mossad spyware), who was a CIO in the IDF, he pretends he is a Chief Information Officer, but the CIO designation in the IDF is a Chief *INFORMATION* Officer. He also was a hacker/spy not a food soldier.
The customer is likely the NSA, General Alexander paid for a lot of noise to fill his database with.
[bypasses] secure sockets layer protections by modifying the network stack of computers that run its underlying code. Specifically, Komodia installs a self-signed root CA certificate
Picking a nit:
1. Installing a new CA certificate does not modify the network stack. Adding and removing CA certificates is an ordinary operation.
2. All root certificates are self-signed. If your certificate is signed by something else, it's not a root certificate.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Couldn't browsers detect and warn you if you're using a self-signed root CA certificate?
Besides, if it really was Mossad, they'd have done a much better job.
If it was really Mossad they'd be installing the code onto PCs used by their enemies for intelligence gathering. They wouldn't be installing it onto new PCs so they could popup ads for penis enlargement pills.
So many damn funny/insightful posts in this thread, and my points expired at midnight....
"Cock Up Your Beaver" does not mean what you think. This sig is intended to clog filters and annoy do-gooders
There's two parts to this, firstly the Komodia software, this is an SSL intercept run by an ex-Isreal intelligence officer. In other words software written by an Israeli spook for the purpose of tapping SSLs.
(See the cahceh of Komodias own about page: "Barak Weichselbaum founded Komodia, Inc. in 2000, following his military service as a programmer in the IDF's Intelligence Core.").
The second part is all the software that uses it for nefarious purposes, and in the processes spreads this software with the backdoor present in it. That has all manner of things about it, some are games, some are crapware, some are other things. That's just the vehicles to install this tap. One of the media front companies, e.g. "Say Media Group" from TelAviv pays those game sellers to install this spyware with their software installing this tap along the way.
Not actually true. Ultra-orthodox Jews do not (yet) have to serve in the army.
<sarcasm>After all, the ultra-orthodox never provoke any trouble with the Palestinians, so why should they contribute to defence?</sarcasm>
I'm old enough to remember when discussions on Slashdot were well informed.