Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

Post by cpeterso » Fri, Feb 20, 2015, 6:43 AM UTC

vpeters25 wrote: post #37

sitkack wrote: post #29

Earlier quoted context omitted.

TIL Google is ok if you get backdoored by your boss.

The company I work for has a strict policy of no direct outbound connections from the corporate network. This is to prevent (or just make harder) for compromised machines from "phoning home". This has the unfortunate side effect that all internet traffic must go through a proxy, they have to MiTM SSL traffic. I just use my smartphone's data for any personal internet browsing.

Post by PhantomGremlin » Fri, Feb 20, 2015, 6:59 AM UTC

e12e wrote: post #84

somerandomone wrote: post #18

I originally discovered this issue a month ago when debugging my friend's Lenovo laptop. Neither chrome nor IE can render battle.net correctly because the HTML injection is not properly escaped. Since the problem persists after a fresh recovery, I guess it's from some pre-installed software. I almost reported it to FBI.

Should this fall under the original brief of the NSA? (Ironic, I know). I realize that FBI traditionally does "domestic" and CIA "foreign" -- but I seem to recall NSA has something about "cybersecurity threats" or some such nebulus thing in their mission statement?

Post by orblivion » Fri, Feb 20, 2015, 7:28 AM UTC

nandhp wrote: post #42

guelo wrote: post #11

Shouldn't Lenovo be issuing a recall and pulling all the inventory in their distribution channel? In other words, Best Buy shouldn't be selling these things!

I believe Lenovo's official statement previously said "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." However, it now has a link to LEN-2015-010, a high-severity security vulnerability. http://news.lenovo.com/article_display.cfm?article_id=1929 https://news.ycombinator.com/item?id=9074676 http://support.lenovo.com/us/en/product_security/superfish

Post by raverbashing » Fri, Feb 20, 2015, 8:04 AM UTC

gluxon wrote: post #66

tveita wrote: post #4

This is a PDF attached to this issue, requesting blacklisting of the Superfish certificate: https://bugzilla.mozilla.org/show_bug.cgi?id=1134506

From what I understand of Superfish, Mozilla (and other browser vendors) can't just blacklist the certificate. That would make all HTTPS connections error out. A message notifying users of the issue is all they can do.

Post by bfhdstgg » Fri, Feb 20, 2015, 8:13 AM UTC

gojomo wrote: post #92

patcheudor wrote: post #68

Earlier quoted context omitted.

I wouldn't go as far as say lying, they just failed to consider the SAN. Unfortunately they pulled the doc, possibly due to what they claim to be a DDOS but it's still in Google cache: http://webcache.googleusercontent.com/search?q=cache:XUbVSX8...

'SAN'?