Ars: SSL-Busting Code That Threatened Lenovo Users Found In a Dozen More Apps

Ars Technica reports on the continuing revelations about the same junkware that Lenovo has shipped on their computers, but which is known now to be present in at least 14 pieces of software. The list of software known to use the same HTTPS-breaking technology recently found preinstalled on Lenovo laptops has risen dramatically with the discovery of at least 12 new titles, including one that's categorized as a malicious trojan by a major antivirus provider. ... What all these applications have in common is that they make people less secure through their use of an easily obtained root CA [certificate authority], they provide little information about the risks of the technology, and in some cases they are difficult to remove," Matt Richard, a threats researcher on the Facebook security team, wrote in Friday's post. "Furthermore, it is likely that these intercepting SSL proxies won't keep up with the HTTPS features in browsers (e.g., certificate pinning and forward secrecy), meaning they could potentially expose private data to network attackers. Some of these deficiencies can be detected by antivirus products as malware or adware, though from our research, detection successes are sporadic."

Comments

List 'em in the summary, slashdot.

[Anonymous Coward]

List 'em in the summary, slashdot.

Re:List 'em in the summary, slashdot.

[DarkOx]

        CartCrunch Israel LTD
        WiredTools LTD
        Say Media Group LTD
        Over the Rainbow Tech
        System Alerts
        ArcadeGiant
        Objectify Media Inc
        Catalytix Web Services
        OptimizerMonitor

Mossad connection

[Anonymous Coward]

CartCrunch Israel LTD
        WiredTools LTD
        Say Media Group LTD
        Over the Rainbow Tech
        System Alerts
        ArcadeGiant
        Objectify Media Inc
        Catalytix Web Services
        OptimizerMonitor

Hey look, there's Israel again (at least 3 times in fact). This Komodia/Superfish crap is likely Mossad sponsored. That would also help explain why Homeland Security put out urgent guidance to remove the crapware and even Microsoft added detection directly to their anti-malware tools. NSA doesn't like being upstaged on its own turf.

Re:Mossad connection

[wiredlogic]

They're a paper ally because they provide a convenient way to funnel our "aid" money into domestic arms production. A state that is always at war always needs bullets and we're only too happy to buy them on the American taxpayer's behalf, "gratis". This helps float the MIC when we're in between wars. Holocaust guilt prevents any criticism from gaining public traction.

If the software is this bad

[fustakrakich]

I would contend there are problems in the hardware also. This one runs deep. Everything on the market needs further inspection. More so now with all the governments demanding backdoors.

Re:If the software is this bad

[jones_supa]

It's becoming too complicated to verify everything. Last week it was revealed how NSA has a spyware kit for firmwares of all HDD brands. It's getting pretty crazy.

Legality

[BitZtream]

I'm fairly certain just installing this software is illegal.

Its not protected by some EULA because the device is sold before the EULA can be read, which courts have already ruled invalidates the EULA.

It violates the same laws that were used to put Kevin Mitnick in jail (and lets be clear, he deserved it), unauthorized access to a computer system and unauthorized access to data flowing across a network.

Hang'em high, I say. Bring Lenovo's leaders out to the chopping block, as well as the leadership of the companies who made any other software that works like this. Its a scam from the very beginning, theres no 'well, maybe its not bad' or 'maybe it was an accident' to it. This is outright bullshit behavior by companies trying to sell a product to someone and then turn that someone into the product for someone else. The entire legal system AND THE PUBLIC need to come down on this like a ton of bricks and make it clear that its unacceptable and will not be tolerated. And by not tolerated I mean 'you will be jailed, not fined'.

Re: Legality

[jd2112]

Careful. That pony could be a Trojan Horse. Albeit a small one.

Re:Block off programmatic access to cert trust.

[BitZtream]

And if your machine can automatically do all those things ... so can third party software because in order for you to do everything you want to do, there has to be a pragmatic way to do so, and if the OS can do it, so can any other software that has admin rights.

Either way, you don't want to put that sort of power into the vendors hands, since it means they effectively have created the Apple App store, and if thats what you really want, just buy a Mac and stop using Windows (your first mistake).

The only way to prevent this sort of thing is by not installing software that does it.

But lets ignore all the problems with what you're suggesting and assume it works ... Lenovo would have just approved the certs before they shipped the machine. Or the machine would prompt the user, who would blindly do so on boot, just like all the other things users blindly do.

If you want to prevent this from happening, put the people who do this AND the people who make the decisions to do this, IN JAIL.

Both the developers who write the code to do it and the management who tells them to do so. Assign some personal responsibility for this shit and watch how it suddenly changes. The problem in America is that anyone in a company can basically do whatever they want and hide behind 'the company' who then gets some minor fine (Relatively) and the guy who did it doesn't care one bit.

Re:Superfish is present in Flash Video Downloader

[operator_error]

You may be right, I don't know. I just want to point out an open-source javacript is called superfish, and I'm pretty sure this library is something else entirely, and benign. http://users.tpg.com.au/j_birc...