How do you safely install Mozilla Firefox if you have a broken certificate store?
Lenovo Caught Installing Adware on New Computers
181–190 of 435 posts
Re: Lenovo Caught Installing Adware on New Computers
#182Hardware manufacturers cannot be trusted with software. One day the horrors of proprietary firmware will come to light as well, and people will wake up to this shit.
Dells entire business line of Latitude laptops have been completely broken under Linux for 10 months. It took them that long to merely revert the "keyboard improvements" made between two BIOS revisions, but they subsequently shipped, and are still shipping, brand new machines without the fix or any downgrade path. These machines just aren't fit-for-purpose.
Imho Richard Stallman is right if for no other reason than I see no other way to end all this consumer abuse and borderline criminal negligence. In the mean time, this debacle sounds Class-action worthy to me.
Re: Lenovo Caught Installing Adware on New Computers
#183Jebus, how far the might IBM laptop line has fallen under the leadership of Lenovo. There was a time when a ThinkPad was arguably the best laptop money could buy. Many companies, including Google, would offer a choice between a ThinkPad or a MacBook, because those were the really reliable choices that were free of shovelware. I even considered buying a Lenovo recently when a pretty nice looking ThinkPad was on sale,…
Is it even possible to buy a Windows laptop right now with only the OS installed? This is exactly why I've been recommending Chromebooks to anyone who asks my advice for about a year now.
With Windows even if you buy the boxed version it still doesn't mean you are free from hardware vendors fuckery. The necessary drivers are quite often bundled with shitware.
Re: Lenovo Caught Installing Adware on New Computers
#184This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…
"Someone will extract the private key in the next few hours, and then HTTPS will be basically completely broken for all Lenovo users -- anyone will be able to spoof any site to them."
Do you mean the proxy is remote? That is not the impression I have (otherwise having the private key locally makes no sense).
If it's local, then even with the private key extracted, and considering a lot of website force https nowadays, we should still have standard crypto between the lenovo computer and the website. EDIT: As long as the adware checks the website certificate AND doesn't trust it's own self-signed certificate in the store... yeah... a lot of ifs...
Anyway, thanks for the additional details, more helpful than "[...] the certificate allows the software to decrypt secure requests[...]", found in the article...
Re: Lenovo Caught Installing Adware on New Computers
#185Unbelievable. Guess switching to Apple from Lenovo last autumn wasn't the worst choice.
That’s like leaving an abusive relationship to instead plug yourself into the Matrix.
Re: Lenovo Caught Installing Adware on New Computers
#186Ugh. So for "developer-tier" laptops, i.e. not a netbook, does that pretty much leave Apple as the sole non-shit laptop maker? Is there a chromebook out there that runs linux pretty well if you pull chromeOS off? You pay a hefty premium for that backlit Apple logo on the lid, and I'd prefer to get something a little more down-to-earth.
A colleague uses the Dell XPS 13 and it's pretty good; I'm eyeing that for my next machine.
I have the previous version and am really pleased with it.
The new line is kind of missing a developer edition with 16GB RAM in my opinion.
Re: Lenovo Caught Installing Adware on New Computers
#187Earlier quoted context omitted.
naturally oblivious to the security implications Rest assured Lenovo was perfectly aware of the security and privacy implications of this feature from the beginning. They merely try to sound oblivious because their laywers hope that will soften the legal and media repercussions.
Honestly, I think that's unlikely. This is far too sloppy to have been intentional. There are much better ways to implement a backdoor when you control the OS image. This is just incompetence, plain and simple. Superfish looks like the kind of crapware that pays OEMs to include it in their bundle. Lenovo took the cash and didn't bother to review the code. Superfish, for its part, probably doesn't have the best and br…
How could you add mitm functionality by mistake?
Re: Lenovo Caught Installing Adware on New Computers
#188I'm surprised that this is just now news. I received complaints from people participating in our beta trial ( http://sketchtogether.com ) from as early as October 22nd, 2014 that our website was broken, and it was because of Superfish being installed on their lenovo laptops. When they uninstalled Superfish, our webpage started working again. Superfish injected a line of code that referenced "sf_main.jsp" from a remot…
Interestingly it is disabled for Google services (making the article's image irrelevant :).
If this regex matches, `nofish` is set true, which disables superfish:
/^https?:\/\/(www|play)\.google\.(?!com\/analytics\/)/i
Also, if you add a tag, it gets disabled as well.
Possibly some agreement with Google, like the ones they tend to make with ad-blockers? (http://www.theverge.com/2015/2/2/7963577/google-ads-get-thro...)
Re: Lenovo Caught Installing Adware on New Computers
#189This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…
I thought that Chrome checks and reports that google.com certificate is a google issued certificate. How did this mitm attack not pop up massive warnings in chrome?
Chrome ignores Trusted Root Certificates when checking certificate pinning.
Re: Lenovo Caught Installing Adware on New Computers
#190So basically I have to pay for the hardware and then see annoying ads too?