Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

bug1134506.bugzilla.mozilla.org

Post reply on HN
Print view View original

81–90 of 188 posts

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#81

Post by userbinator »

gluxon wrote: post #66
tveita wrote: post #4

This is a PDF attached to this issue, requesting blacklisting of the Superfish certificate: https://bugzilla.mozilla.org/show_bug.cgi?id=1134506

From what I understand of Superfish, Mozilla (and other browser vendors) can't just blacklist the certificate. That would make all HTTPS connections error out. A message notifying users of the issue is all they can do.

One way would be to bypass the proxy if it's detected as a Superfish proxy by its certificate, but somehow I feel like this isn't a problem the browser vendors should be doing extra workarounds for (and giving precedence to "if we don't like your proxy we'll ignore it" isn't a great idea either.)

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#82

Post by nness »

guelo wrote: post #11

Shouldn't Lenovo be issuing a recall and pulling all the inventory in their distribution channel? In other words, Best Buy shouldn't be selling these things!

It's not in Lenovo's interest to voluntarily recall anything, unless they wanted to save face, but I would imagine consumer expectations on Lenovo are different than, say, a car manufacturer.

But unlike a car manufacturer, I doubt any governments will compel them either... since this kind of thing is exactly what a government would want.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#83

Post by Luyt »

jedanbik wrote: post #35

Not only did I have to remove the certificate from my root authority in the control panel, I also had to remove it from my list of certificates in Firefox. This was after uninstalling Superfish. Once I did all of these things, and cleared my history and cache and all that, the website that folks have been linking said that it didn't detect Superfish (sorry, I'm typing this from a phone). So my explanation wasn't very…

the website that folks have been linking said that it didn't detect Superfish (sorry, I'm typing this from a phone)

The website you're referring to, is https://canibesuperphished.com/​

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#84

Post by e12e »

somerandomone wrote: post #18

I originally discovered this issue a month ago when debugging my friend's Lenovo laptop. Neither chrome nor IE can render battle.net correctly because the HTML injection is not properly escaped. Since the problem persists after a fresh recovery, I guess it's from some pre-installed software. I almost reported it to FBI.

Should this fall under the original brief of the NSA? (Ironic, I know). I realize that FBI traditionally does "domestic" and CIA "foreign" -- but I seem to recall NSA has something about "cybersecurity threats" or some such nebulus thing in their mission statement?

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#85

Post by Luyt »

remarkEon wrote: post #70
emehrkay wrote: post #57

Computing is genuinely becoming scary. If I didn't browse tech sites or spend my days on HackerNews, I probably wouldn't know about these things. I'm getting older and more disinterested in the constant maintenance -- I just want the shit to work. It sucks the most for those who learned "don't install anything fishy, run a virus scan, don't open attachments, and you'll be fine." They bought a computer and followed th…

This. I can tell several stories of trying to set things up for my parents, only to have to call them/wait until I fly home next to fix something. Lessons have been learned the hard way on dumb email chains/anti-virus software, but trying to give them a list of browser settings (among other things) to do is getting to be too much. So, now what?

Use some software with which you can do remote maintenance on your parents' computer(s).

Or, introduce them to more stable OSses, like Ubuntu instead of Windows. That worked for my neighbours ;-)

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#86

Post by osivertsson »

semenko wrote: post #17
edohyiez wrote: post #14

I find it a bit weird that it can MITM https://www.google.com/ on Chrome. I thought Chrome did CA-pinning for Google-domains.

Chrome does do pinning, but ignores pins when the cert parent is a privately installed cert (because this is a "feature" used by many enterprises). """ Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. 'Data loss prevention' appliances, firewa…

Thank for bringing this to my attention.

I guess I should look into the Chromium source to disable this MITM "feature"... I'm really too busy so if anyone else does this I'd much appreciate a patch.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#87

Post by [deleted] »

lstamour wrote: post #46
hurin wrote: post #12

Earlier quoted context omitted.

I'm somewhat puzzled by the single certificate. Couldn't they have generated a new signing request and self-signed on each machine - at least ensuring that each customer has a unique cert for their proxy?

These guys aren't the brightest bulbs out there. You could even have it switch certificates on every reboot... or not do this in the first place. ;-)

[deleted]

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#88

Post by arthurfm »

Luyt wrote: post #83
jedanbik wrote: post #35

Not only did I have to remove the certificate from my root authority in the control panel, I also had to remove it from my list of certificates in Firefox. This was after uninstalling Superfish. Once I did all of these things, and cleared my history and cache and all that, the website that folks have been linking said that it didn't detect Superfish (sorry, I'm typing this from a phone). So my explanation wasn't very…

the website that folks have been linking said that it didn't detect Superfish (sorry, I'm typing this from a phone) The website you're referring to, is https://canibesuperphished.com/​

Another useful website is: https://filippo.io/Badfish/

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#89

Post by arthurfm »

guelo wrote: post #11

Shouldn't Lenovo be issuing a recall and pulling all the inventory in their distribution channel? In other words, Best Buy shouldn't be selling these things!

According to the Wall Street Journal [1], Lenovo are going to release a program that completely removes Superfish from their PCs.

> WSJ: What are you doing now to ensure the security of people who bought Lenovo laptops with the Superfish app?

> Hortensius: As soon as the programmer is finished, we will provide a tool that removes all traces of the app from people’s laptops; this goes further than simply uninstalling the app. Once the app-wiping software is finished tonight or tomorrow, we’ll issue a press release with information on how to get it.

[1] http://blogs.wsj.com/digits/2015/02/19/lenovo-cto-were-worki...

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#90

Post by Argorak »

userbinator wrote: post #40

While this whole Superfish/Lenovo thing is certainly quite scary, let's not forget the very important fact that, currently, the user ultimately still has the ability to modify the software on the machines he/she owns, which includes among other things (un)installing software like Superfish, and also adding/removing trusted certificates. There will be those who advocate locking down the certificate stores and other ar…

I'm very hesitant to use this word, but this is a very privileged position. Many customers don't have the skills to even see the technical problem while expecting that not to happen. The same goes for reinstalling the machine (or they don't trust in their skills).
Post reply on HN