It would be interesting to investigate whether the uncovered private key is shared by all the other customers of the SSL interceptor as well (http://www.komodia.com/products/komodia-redirector/ as mentioned by ChuckMcM earlier). Their references there mention Barracuda Networks and Astrill, for example.
Lenovo Caught Installing Adware on New Computers
391–400 of 435 posts
Re: Lenovo Caught Installing Adware on New Computers
#392Earlier quoted context omitted.
Why did he expect to find the password in the clear in the memory dump? He indeed found it there, but why would one expect to?
He didn't find the password in the clear, he found the private key in the clear. He brute-forced the password. I assume his reasoning for looking for the private key was similar to: this program creates a new certificate authority and installs it on this computer. In order to do this, it must have all necessary tools for doing so, including the private key it uses to create those certificates, in memory somewhere. Ev…
Read it again, he found the password in cleartext in the memory dump. From the blogpost:
> I tried the small dictionary john.dict that comes with John-the-Ripper, and it didn't find anything. But of course, I don't need a real dictionary. The password is probably also in the clear in the memory dump. I could just use the file super.txt as my dictionary! I tried this, but it was taking a long time, with 150k unique lines of text. It'd take many hours to complete. To speed things up, I filtered the list for just lower-case words
Re: Lenovo Caught Installing Adware on New Computers
#393Earlier quoted context omitted.
Do you trust a hardware vendor that installs MITM stuff on your machine per default to keep the firmware untampered? There is almost no machine out there running openly auditable code on all components.
> Do you trust a hardware vendor that installs MITM stuff on your machine per default to keep the firmware untampered? Adding dodgy userspace software is easy and remunerative for Lenovo ( lots of $$$ from the software vendor for 'bundling' ). Tampering with firmware is hard , expensive and doesn't seem to offer compelling return on investment. What's the business case?
Well over $10 million? http://www.cnet.com/news/security-firm-rsa-took-millions-fro...
Re: Lenovo Caught Installing Adware on New Computers
#394Earlier quoted context omitted.
if your browser trusts the MITMed certificate, you no longer have the guarantee that your banking website is actually your banking website and nothing nefarious, as the page has been intercepted (maliciously or not) in-flight. The trust essentially moves from the browser to the proxy - while I don't know what Superfish does, Proxomitron definitely checks the certificate and pops up a warning dialog if there's somethi…
Presumably (hopefully!) when you installed Proxomitron, it generated a new unique private key for your own personal MITM. Apparently Superfish ships from Lenovo with the same private key on every machine. So all a bad guy needs to do is extract that private key from one machine, and now they can MITM all the Superfish Lenovo machines from basically anywhere on the Internet.
It does come with its own certificate by default, with instructions for generating your own, but it doesn't trust that certificate for external connections; it uses a separate database of trusted roots which doesn't include the MITM certificate.
Has anyone confirmed the certificate validation behaviour in Superfish? I have a feeling it will be "none at all", which would be really bad...
Re: Lenovo Caught Installing Adware on New Computers
#395Earlier quoted context omitted.
Yes it is, you can even buy laptops with no OS pre-installed or a gnu/linux distro. Chromebooks are the worst possible thing, I tell everyone to stay away from these crippled google branded piece of slavery. I advise either a second hand quality laptop or a brand new one while budgeting a little extra for cleaning the crap that manufacturers preload inside to allow for such a low selling price.
Chromebooks are great. I've recommended them to at least a dozen people by now and they are all super happy with them. And free from MITM!
Free from Lenovo's MITM anyway.
Re: Lenovo Caught Installing Adware on New Computers
#396Earlier quoted context omitted.
Aaaand here it is: http://blog.erratasec.com/2015/02/extracting-superfish-certi...
Why did he expect to find the password in the clear in the memory dump? He indeed found it there, but why would one expect to?
The password to the key must be in the binary - either in clear or encoded form and at some point it needs to be in memory in decoded form. Otherwise the binary could not decode the key itself. You could drop the passphrase immediately after decoding the key to make it harder for the attacker, but fundamentally all info to decode the key must be somewhere on the machine itself.
Trying all strings from the binary if any of them matches is a cheap and easy operation, so try it first, if it doesn't work use a more elaborate approach.
Re: Lenovo Caught Installing Adware on New Computers
#397I don't see myself ever bothering to keep the default windows install on a thinkpad but this really hurts my impression of the company regardless. I've had my eye on the new X1s and had planned to upgrade my X201 this year but now I'm having second thoughts. Who if anyone has taken over the place of great laptop for linux / development?
There's also another crowdsupply linux laptop that's a little more practical than the Novena: Purism's Librem. Its whole raison d'etre is to be a high-end laptop that's libre everything -- pretty apropos, I think:
Re: Lenovo Caught Installing Adware on New Computers
#398Does anyone know when this started happening (installing of superfish)? Seems mid-2014 according to the article?
Re: Lenovo Caught Installing Adware on New Computers
#399Earlier quoted context omitted.
Not if the proxy checks the certificate of the site it's connecting to and doesn't trust it's own self-signed cert (there is no point in doing so if it's pure adware). But yeah... I have no idea what it does...
I honestly doubt that someone who was clueless and lazy enough to use the same self-signed certificate on all machines would put in the extra effort not to trust that certificate. Besides, the certificate is left behind after the software's uninstalled and no longer proxying connections.
Wow...
Now Lenovo is "soon" going to explain how to remove this certificate after the "uninstall" in a buried forum post...
http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-...
Re: Lenovo Caught Installing Adware on New Computers
#400Superfish, the movie http://imgur.com/WT33KBJ