Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

Post by cesarb » Fri, Feb 20, 2015, 8:39 AM UTC

vpeters25 wrote: post #37

sitkack wrote: post #29

Earlier quoted context omitted.

TIL Google is ok if you get backdoored by your boss.

The company I work for has a strict policy of no direct outbound connections from the corporate network. This is to prevent (or just make harder) for compromised machines from "phoning home". This has the unfortunate side effect that all internet traffic must go through a proxy, they have to MiTM SSL traffic. I just use my smartphone's data for any personal internet browsing.

Post by e12e » Fri, Feb 20, 2015, 8:55 AM UTC

lern_too_spel wrote: post #103

e12e wrote: post #84

Earlier quoted context omitted.

Should this fall under the original brief of the NSA? (Ironic, I know). I realize that FBI traditionally does "domestic" and CIA "foreign" -- but I seem to recall NSA has something about "cybersecurity threats" or some such nebulus thing in their mission statement?

No. The FBI handles cybercrime. The NSA is under the DoD.

Post by Xylakant » Fri, Feb 20, 2015, 9:54 AM UTC

beagle3 wrote: post #79

gluxon wrote: post #66

Earlier quoted context omitted.

From what I understand of Superfish, Mozilla (and other browser vendors) can't just blacklist the certificate. That would make all HTTPS connections error out. A message notifying users of the issue is all they can do.

They definitely can blacklist the certificate. They have the choice of having HTTPS effectively useless (by leaving the certificate there), or making HTTPS not work (by removing it, thus prompting action from the user to fix it -- perhaps by calling their tech savvy nephew). Browser vendors should (and usually do) err on the side of security.

Post by cnvogel » Fri, Feb 20, 2015, 10:00 AM UTC

arthurfm wrote: post #89

guelo wrote: post #11

Shouldn't Lenovo be issuing a recall and pulling all the inventory in their distribution channel? In other words, Best Buy shouldn't be selling these things!

According to the Wall Street Journal [1], Lenovo are going to release a program that completely removes Superfish from their PCs. > WSJ: What are you doing now to ensure the security of people who bought Lenovo laptops with the Superfish app? > Hortensius: As soon as the programmer is finished, we will provide a tool that removes all traces of the app from people’s laptops; this goes further than simply uninstalling…

    Thanks for buying a Lenovo product. To get the most out of
    your new high-performance mobile workstation, the following
    software products can be installed free of charge by ticking the
    check-box and clicking 'Next'.

    [x] Superfish Ad-Injector, making your web-browsing experience
        miserable and yourself vulnerable to Man-in-the-Middle-Attacks
        when doing facebook and online banking.

    [x] Limited trial of Super-High-Security-Internet-
        Security-Anti-Vius which will constantly nag you about paying
        for the full product

    (...)

Post by lmm » Fri, Feb 20, 2015, 10:02 AM UTC

vpeters25 wrote: post #74

skuhn wrote: post #50

Earlier quoted context omitted.

Well you don't have to MITM SSL in order to proxy it, it can be done in other ways. They probably choose to do so in order to see the details of the request.

Correct, the firewall intercepts all traffic looking for potential compromises and blocks it. Given all these corporations getting hacked, such measures seem necessary.