Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo Caught Installing Adware on New Computers

thenextweb.com

Post reply on HN
Print view View original

381–390 of 435 posts

Re: Lenovo Caught Installing Adware on New Computers

#381

Post by nsxwolf »

kurokikaze wrote: post #364
kentonv wrote: post #5

This is much worse than just installing adware. They install a web proxy which MITMs all web connections, including HTTPS by means of a pre-installed trusted root certificate. The root certificate is the same across all installs, and the private key is present on the machine (necessarily, to operate the proxy): https://twitter.com/fugueish/status/568258997578371072 Someone will extract the private key in the next few…

Aaaand here it is: http://blog.erratasec.com/2015/02/extracting-superfish-certi...

Why did he expect to find the password in the clear in the memory dump? He indeed found it there, but why would one expect to?

Re: Lenovo Caught Installing Adware on New Computers

#382

Post by cm2187 »

danielweber wrote: post #372
cm2187 wrote: post #337

Earlier quoted context omitted.

I think the problem is rather giving a false sentiment of security to the unsuspecting user.

Chrome could display a notice reminding users that it's an executable that can be compromised by other programs. But those other programs could also delete that notice.

I was thinking more something like an amber icon instead of green, which shows this connection is somewhat secure but there are problems detected.

Re: Lenovo Caught Installing Adware on New Computers

#383

Post by Alupis »

meowface wrote: post #367
userbinator wrote: post #359

Earlier quoted context omitted.

Some EULAs basically say "you give permission for us to access and modify any data in your system"... this is the first example that comes to mind: http://en.wikipedia.org/wiki/PunkBuster These agreements could be summed up in 3 words: "we own you".

At least PunkBuster is spying for a relatively noble purpose: preventing cheating in online games. Cheating absolutely destroys the experience in multiplayer games and has killed many games. This is spying with the sole purpose of spreading ads and making money.

So because a few people decide to cheat at a game they paid for, everyone who paid full price for the game is forced to install spyware which can and does modify files on your pc, take screenshots as you play the game, monitor your mouse inputs, keyboard, etc...?

Re: Lenovo Caught Installing Adware on New Computers

#385

Post by betenoire »

nsxwolf wrote: post #381
kurokikaze wrote: post #364

Earlier quoted context omitted.

Aaaand here it is: http://blog.erratasec.com/2015/02/extracting-superfish-certi...

Why did he expect to find the password in the clear in the memory dump? He indeed found it there, but why would one expect to?

the nature of writing a blog post ex post facto?

Re: Lenovo Caught Installing Adware on New Computers

#386

Post by geococcyxc »

nsxwolf wrote: post #381
kurokikaze wrote: post #364

Earlier quoted context omitted.

Aaaand here it is: http://blog.erratasec.com/2015/02/extracting-superfish-certi...

Why did he expect to find the password in the clear in the memory dump? He indeed found it there, but why would one expect to?

Because it is needed to decrypt the key and as the program uses it, it must be in memory (at least at some time).

Re: Lenovo Caught Installing Adware on New Computers

#387

Post by nsxwolf »

betenoire wrote: post #385
nsxwolf wrote: post #381

Earlier quoted context omitted.

Why did he expect to find the password in the clear in the memory dump? He indeed found it there, but why would one expect to?

the nature of writing a blog post ex post facto?

So, just a hunch that it would be a company name or something else that might be in the dump? There's no technical reason for the actual password itself to somehow end up there? A serious security flaw or something?

Re: Lenovo Caught Installing Adware on New Computers

#388

Post by nsxwolf »

geococcyxc wrote: post #386
nsxwolf wrote: post #381

Earlier quoted context omitted.

Why did he expect to find the password in the clear in the memory dump? He indeed found it there, but why would one expect to?

Because it is needed to decrypt the key and as the program uses it, it must be in memory (at least at some time).

Ahh. That makes sense. So the malware itself is decrypting the certificate using the password.

Re: Lenovo Caught Installing Adware on New Computers

#389

Post by scott_s »

nsxwolf wrote: post #381
kurokikaze wrote: post #364

Earlier quoted context omitted.

Aaaand here it is: http://blog.erratasec.com/2015/02/extracting-superfish-certi...

Why did he expect to find the password in the clear in the memory dump? He indeed found it there, but why would one expect to?

He didn't find the password in the clear, he found the private key in the clear. He brute-forced the password.

I assume his reasoning for looking for the private key was similar to: this program creates a new certificate authority and installs it on this computer. In order to do this, it must have all necessary tools for doing so, including the private key it uses to create those certificates, in memory somewhere. Even if that private key is stored encrypted somewhere, it has to exist unencrypted in memory at some point to be used.

Re: Lenovo Caught Installing Adware on New Computers

#390

Post by meowface »

Alupis wrote: post #383
meowface wrote: post #367

Earlier quoted context omitted.

At least PunkBuster is spying for a relatively noble purpose: preventing cheating in online games. Cheating absolutely destroys the experience in multiplayer games and has killed many games. This is spying with the sole purpose of spreading ads and making money.

So because a few people decide to cheat at a game they paid for, everyone who paid full price for the game is forced to install spyware which can and does modify files on your pc, take screenshots as you play the game, monitor your mouse inputs, keyboard, etc...?

I think that is fine, personally. Obviously others might not. You have to specifically agree to install/allow PunkBuster, and you can choose to play on servers that don't use PunkBuster. With Lenovo not only is there no opt-out, but you're not even aware of the adware and root CA installation.

The "spyware" only spies on modifications to the game client in any way and tries to detect non-human involvement, which of course includes inspecting the file system and RAM. In theory it could harvest irrelevant information from your hard drive or memory, but no reverse engineer has ever made such a claim to my knowledge.

Valve Anti-Cheat does very similar things, but is run by what many consider to be a trustworthy company, so not that many people take issue with it. If one trusts the company that distributes the spyware, it's not really a problem, in my opinion. If Valve were to ever violate that trust, it would severely harm their business.

I also strongly disagree with DRM, because it only harms other players while providing no benefits. In contrast, online cheaters can completely ruin the playing experience for online games, and have heavily contributed to the death of some games.

I also have no issue if people decide to cheat when in single-player mode. If you pay for the game you should be able to do whatever you want if you're not affecting others. It's only a problem when they're playing with other people over the Internet. PunkBuster and VAC only run when you're playing in online mode.

Post reply on HN