Slashdot Mirror
Lizard Squad Claims Attack On Lenovo Days After Superfish
Amanda Parker writes with news that hacker group Lizard Squad has claimed responsibility for a defacement of Lenovo's website. This follows last week's revelations that Lenovo installed Superfish adware on consumer laptops, which included a self-signed certificate authority that could have allowed man-in-the-middle attacks.
The hackers seemingly replaced the manufacturer's website with images of an unidentified youth, displayed with a song from the Disney film High School Musical playing in the background. Taking to a new Twitter account that has only been active a matter of days, the Lizards also posted emails alleged to be from Lenovo, leading some to speculate that the mail system had been compromised. While some have seen the attack as retaliation for the Superfish bug, it is also possible that Lizard Squad are jumping on the event merely to promote their own hacking services.
this is no more noteworthy or significant than vandalizing a billboard
As far as I understand it, this didn't just allow hackers to create a man-in-the-middle attack. Your Lenovo computer with the hardware would actively perform a man-in-the-middle attack against the user to analyse any encrypted traffic to https websites. For example when you enter a credit card number on the website of a reputable company using https, the adware could read what you posted.
This is plainly unforgivable.
Wow, incredible display of h4xx0ring skillz.
Since when is a willfully installed piece of adware/spyware a "bug"? Using that term is someone's attempt to pass this off as a coding error when it was actually willfully installed by the OEM in their OS image.
Every machine that I buy, I always start off by wiping the OS and doing a fresh install. Is that not common practice? I've never met anyone with a lenovo for their at home use, always dell's or hp's. And anyone that I've met that did have a lenovo used it just for business. Don't business's hire competent IT guys? Anyone who knows anything knows that the easiest way to get rid of the garbage is just to reload the OS.
This does not prevent firmware attacks such as in BIOS or the firmware on your HDD, or DVD or even battery firmware on laptops.
I was trying to load a lenovo forum on the superfish situation yesterday and was puzzled why it was just showing me G-rated pictures of teenagers staring at cameras. I figured something had gone amiss with the code running the forum, or something was weird with my browser that moment. I then found the information I wanted elsewhere.
In other words, this wasn't a very impressive hack.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
For the security of your users, ENABLE SSL, and use SPDY. Slashdotters should keep asking for this...
On topic: IMO, you should stop giving attention to these kids.
Oh crap, hactivism doesn't cover it anymore because they're also advertising their services. Time to cram more words in. They're Hactivismvertising.
Their DNS was hijacked and they and their clients don't perform TLS with certificate pinning, so mail got redirected to the Lizard Squad chosen server.... Their mail infrastructure was not attacked, so don't expect SONY style DOXin'
The summary is way wrong. No time to read the articles, sorry.
r in ur laptopz
Why do these articles always call crap like this adware? This program deliberately disables SSL protection so the authors can profit at the expense of the uninformed user. Call it what it is TROJAN MALWARE! If the authors object, tell them to look up the definition (Example from Wiktionary: Software which has been designed to operate in a malicious, undesirable manner).
every act of destruction in any form is not really good, all there must be consequences, if they want to be responsible it better. Toko pasutri