Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo Caught Installing Adware on New Computers

thenextweb.com

Post reply on HN
Print view View original

1–10 of 435 posts

Re: Lenovo Caught Installing Adware on New Computers

#2

Post by maryland05 »

According to various reports, this Superfish adware uses the same certificate across Lenovo computers. It should be easy to grab the private key out of the proxy binaries. And then... all these computers are vulnerable to arbitrary HTTPS man-in-the-middle attacks. Uh oh.

Re: Lenovo Caught Installing Adware on New Computers

#3

Post by piannucci »

maryland05 wrote: post #2

According to various reports, this Superfish adware uses the same certificate across Lenovo computers. It should be easy to grab the private key out of the proxy binaries. And then... all these computers are vulnerable to arbitrary HTTPS man-in-the-middle attacks. Uh oh.

You're assuming that the proxy is on the laptops, no?

Re: Lenovo Caught Installing Adware on New Computers

#5

Post by kentonv »

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate.

The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072

Someone will extract the private key in the next few hours, and then HTTPS will be basically completely broken for all Lenovo users -- anyone will be able to spoof any site to them.

Uninstalling the app does NOT remove the certificate: https://twitter.com/metsfan/status/568265468173107200

On the bright side, Firefox does not use the system certificates (it has its own list) and Chrome will no doubt push an update to block the certificate promptly.

Re: Lenovo Caught Installing Adware on New Computers

#6

Post by kentonv »

piannucci wrote: post #3
maryland05 wrote: post #2

According to various reports, this Superfish adware uses the same certificate across Lenovo computers. It should be easy to grab the private key out of the proxy binaries. And then... all these computers are vulnerable to arbitrary HTTPS man-in-the-middle attacks. Uh oh.

You're assuming that the proxy is on the laptops, no?

Well, the other possibility is that Superfish is routing and MITMing all traffic through its own servers, which is arguably worse.

Re: Lenovo Caught Installing Adware on New Computers

#7

Post by BrainInAJar »

kentonv wrote: post #6
piannucci wrote: post #3

Earlier quoted context omitted.

You're assuming that the proxy is on the laptops, no?

Well, the other possibility is that Superfish is routing and MITMing all traffic through its own servers, which is arguably worse.

arguably? That's orders of magnitude worse

Re: Lenovo Caught Installing Adware on New Computers

#8

Post by eloff »

kentonv wrote: post #5

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…

Anyway to see if that certificate is on a Lenovo computer? Anyway to remove it? I bought a Lenovo laptop recently, and I was appalled at the amount of crapware that was installed. It's a wonderful laptop at a great price, just too bad about the software.

Re: Lenovo Caught Installing Adware on New Computers

#9

Post by voltagex_ »

eloff wrote: post #8
kentonv wrote: post #5

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…

Anyway to see if that certificate is on a Lenovo computer? Anyway to remove it? I bought a Lenovo laptop recently, and I was appalled at the amount of crapware that was installed. It's a wonderful laptop at a great price, just too bad about the software.

Check Certificate Management in mmc.exe (Add Snap-In).

Re: Lenovo Caught Installing Adware on New Computers

#10

Post by kentonv »

eloff wrote: post #8
kentonv wrote: post #5

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…

Anyway to see if that certificate is on a Lenovo computer? Anyway to remove it? I bought a Lenovo laptop recently, and I was appalled at the amount of crapware that was installed. It's a wonderful laptop at a great price, just too bad about the software.

It should show up in the system certificates list as "Superfish, Inc.". I haven't seen it myself but search for #superfish on Twitter to see a lot of screenshots and such.
Post reply on HN