I'll be updating this post as I get more information .
For non-techies, skip to the last paragraph of the post for instructions on how to get rid of this adware.
Today a rather severe vulnerability on certain Lenovo laptops was discovered.
Software (well, adware) called "Superfish" came preinstalled on some of their machines (it seems like it's the Yoga series).
The software ostensibly scans images of products on the web to provide the user with alternative (perhaps cheaper) offers. Sounds like a mix of annoying and slightly useful, right?
Except to achieve this, they do something extremely unsafe. They install a new root CA certificate into the Windows certificate store. The software works via a local proxy server which does a man in the middle attack on your web requests. Of course, most websites of importance these days use HTTPS, so to be able to successfully decrypt and inject content on these, the proxy needs to have the ability to issue arbitrary certificates. It's a single certificate as far as we can tell (you can find it here in plaintext form)
It also leaves the certificate in the system even if the user does not accept the terms of use.
This means that a nontrivial portion of the population has a untrusted certificate on their machines.
It's actually worse than that, because to execute the MITM attack, the proxy server should have the private key for that certificate.
So a nontrivial portion of the population has the private key to said untrusted certificate. Anyone owning one of these laptops who has some reverse engineering skills has the ability to intercept, modify, and duplicate the connections of anyone else owning one of these laptops. Bank logins, email, credit card numbers, everything. One usually needs physical proximity or control of a network to do this right, but it's quite feasible that this key could be sold to someone who has this level of access (e.g. a secretly evil ISP). Update: The key is now publicly known
This is really bad.
Installing random crapware on laptops is pretty much the norm now; and that's not the issue. Installing crapware which causes a huge security vulnerability? No thanks. What's especially annoying is their attitude towards it; they haven't even acknowledged the security hole they've caused.
The EFF has a rather nice article on this here.
As far as we can tell, Firefox isn't affected by this since it maintains its own root CA store, however we are still trying to verify this, and will see if we can block it in case Firefox is affected, for example, if Superfish installs the cert in Firefox as well. If you have an affected system and can provide information about this, feel free to comment on that bug or tweet at @ManishEarth.
The application seems to detect Firefox and install some add ons as well as the certificate. We're looking into this, further insights would be valuable.
Superfish does NOT infect Firefox.
Chrome uses the OS's root CA store, so it is affected. So is IE.
It turns out that internally they're using something called Komodia to generate the MITM; and Komodia uses a similar (broken) framework everywhere -- the private key is bundled with it; and the password is "komodia".
If you have friends at Microsoft who can look into this, please see if a hotfix can be pushed, blacklisting the certificate. Whilst it is possible for an "arms race" to happen between Superfish and Windows, it's unlikely since there's more scrutiny now and it would just end up creating more trouble for Superfish. The main concern right now is that rogue root CA cert is installed on many laptops, and the privkey is out there too.
Update: Microsoft has pulled the program and certificates via Windows Defender! Yay! Firefox is probably going to follow suit -- now that the program itself should be gone, blacklisting the certificate won't make infected users have unusable browsers.
If you own a Lenovo laptop that came preinstalled with Windows (especially one of these models), please check in your task manager for an app called "VisualDiscovery" or "Superfish". Here's a small guide on how to do this. It's slightly outdated, but the section on uninstalling the program itself should work. Then, follow the steps here to remove all certificates with the name "Superfish" from the root store. Then go and change all your passwords; and check your bank history amongst other things (/email/paypal/etc) for any suspicious transactions. Chances are that you haven't been targeted, but it's good to be sure.
Alternatively, open Windows Defender, update and scan. There are more methods here
For non-techies, skip to the last paragraph of the post for instructions on how to get rid of this adware.
Today a rather severe vulnerability on certain Lenovo laptops was discovered.
Software (well, adware) called "Superfish" came preinstalled on some of their machines (it seems like it's the Yoga series).
The software ostensibly scans images of products on the web to provide the user with alternative (perhaps cheaper) offers. Sounds like a mix of annoying and slightly useful, right?
Except to achieve this, they do something extremely unsafe. They install a new root CA certificate into the Windows certificate store. The software works via a local proxy server which does a man in the middle attack on your web requests. Of course, most websites of importance these days use HTTPS, so to be able to successfully decrypt and inject content on these, the proxy needs to have the ability to issue arbitrary certificates. It's a single certificate as far as we can tell (you can find it here in plaintext form)
It also leaves the certificate in the system even if the user does not accept the terms of use.
This means that a nontrivial portion of the population has a untrusted certificate on their machines.
It's actually worse than that, because to execute the MITM attack, the proxy server should have the private key for that certificate.
So a nontrivial portion of the population has the private key to said untrusted certificate. Anyone owning one of these laptops who has some reverse engineering skills has the ability to intercept, modify, and duplicate the connections of anyone else owning one of these laptops. Bank logins, email, credit card numbers, everything. One usually needs physical proximity or control of a network to do this right, but it's quite feasible that this key could be sold to someone who has this level of access (e.g. a secretly evil ISP). Update: The key is now publicly known
This is really bad.
Installing random crapware on laptops is pretty much the norm now; and that's not the issue. Installing crapware which causes a huge security vulnerability? No thanks. What's especially annoying is their attitude towards it; they haven't even acknowledged the security hole they've caused.
The EFF has a rather nice article on this here.
Superfish does NOT infect Firefox.
Chrome uses the OS's root CA store, so it is affected. So is IE.
It turns out that internally they're using something called Komodia to generate the MITM; and Komodia uses a similar (broken) framework everywhere -- the private key is bundled with it; and the password is "komodia".
Update: Microsoft has pulled the program and certificates via Windows Defender! Yay! Firefox is probably going to follow suit -- now that the program itself should be gone, blacklisting the certificate won't make infected users have unusable browsers.
If you own a Lenovo laptop that came preinstalled with Windows (especially one of these models), please check in your task manager for an app called "VisualDiscovery" or "Superfish". Here's a small guide on how to do this. It's slightly outdated, but the section on uninstalling the program itself should work. Then, follow the steps here to remove all certificates with the name "Superfish" from the root store. Then go and change all your passwords; and check your bank history amongst other things (/email/paypal/etc) for any suspicious transactions. Chances are that you haven't been targeted, but it's good to be sure.
Alternatively, open Windows Defender, update and scan. There are more methods here
