Ars: SSL-Busting Code That Threatened Lenovo Users Found In a Dozen More Apps 113
Ars Technica reports on the continuing revelations about the same junkware that Lenovo has shipped on their computers, but which is known now to be present in at least 14 pieces of software.
The list of software known to use the same HTTPS-breaking technology recently found preinstalled on Lenovo laptops has risen dramatically with the discovery of at least 12 new titles, including one that's categorized as a malicious trojan by a major antivirus provider. ... What all these applications have in common is that they make people less secure through their use of an easily obtained root CA [certificate authority], they provide little information about the risks of the technology, and in some cases they are difficult to remove," Matt Richard, a threats researcher on the Facebook security team, wrote in Friday's post. "Furthermore, it is likely that these intercepting SSL proxies won't keep up with the HTTPS features in browsers (e.g., certificate pinning and forward secrecy), meaning they could potentially expose private data to network attackers. Some of these deficiencies can be detected by antivirus products as malware or adware, though from our research, detection successes are sporadic."
List 'em in the summary, slashdot. (Score:5, Interesting)
List 'em in the summary, slashdot.
Re:List 'em in the summary, slashdot. (Score:5, Informative)
CartCrunch Israel LTD
WiredTools LTD
Say Media Group LTD
Over the Rainbow Tech
System Alerts
ArcadeGiant
Objectify Media Inc
Catalytix Web Services
OptimizerMonitor
Re: (Score:3, Insightful)
That's supposed to be the list? Thanks, Ars Technicrap. Nnot only is that not "at least 12", the few things on that list that are actual software are already known to be malware.
Re: (Score:1)
Superfish is present in Flash Video Downloader (Score:1)
The last time I checked a version of Superfish was installed in the Flash Video Downloader for Android available from the official Mozilla Addons download website.
In the FVD source I have locally, the files of interest are superfish_titles.txt and superfish.js which are both in the modules/ directory.
I can't remember if the same source kit is used for desktop Firefox.
Re:Superfish is present in Flash Video Downloader (Score:5, Informative)
You may be right, I don't know. I just want to point out an open-source javacript is called superfish, and I'm pretty sure this library is something else entirely, and benign. http://users.tpg.com.au/j_birc... [tpg.com.au]
Re: (Score:3)
This is the top of the superfish.js listing. Not that I understand Javascript very well (where are the line numbers?) but it seems fairly innocuous...
* ;(function($){
* Superfish v1.4.8 - jQuery menu widget
* Copyright (c) 2008 Joel Birch
*
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/lice... [opensource.org]
* http://www.gnu.org/licenses/gp... [gnu.org]
*
* CHANGELOG: http://users.tpg.com.au/j_birc... [tpg.com.au]
*/
Re: (Score:3)
Re: (Score:3)
So basically, all of the names make it look like it's an Adware firm. Awesome.
Is this really news to the security community at this point? I've been saying that Adware is a virus for almost a decade now and they're finally starting to see it?
Does this mean that the AV Firms (MS, Mcafee, Norton, ETC) are finally going to get tough on adware infections? Something tells me no. I'll believe it when Conduit, Dealio, Wajam and the like get flagged my more than 1/2 of the AV Vendors out there.
Re: (Score:1)
More importantly, they wouldn't get their cut of the ad revenues generated after sending people to other sites.
Mossad connection (Score:4, Interesting)
CartCrunch Israel LTD
WiredTools LTD
Say Media Group LTD
Over the Rainbow Tech
System Alerts
ArcadeGiant
Objectify Media Inc
Catalytix Web Services
OptimizerMonitor
Hey look, there's Israel again (at least 3 times in fact). This Komodia/Superfish crap is likely Mossad sponsored. That would also help explain why Homeland Security put out urgent guidance to remove the crapware and even Microsoft added detection directly to their anti-malware tools. NSA doesn't like being upstaged on its own turf.
Re: (Score:1, Funny)
But Israel is an ally.
Re: (Score:1, Insightful)
Israel is an "ally" only to the extent we allow them to be in order to serve our own interests. Mossad isn't a friend so much as the (irresponsible and unhinged) enemy of an enemy.
Re: (Score:1)
Ziva David is still hot though, right?
Re: (Score:2)
The relationship "is an enemy of an enemy" is so far reaching that Israel is an enemy of an enemy of Iran, Iran is an enemy of an enemy of the US and the US is an enemy of an enemy of Israel. So, Iran and the US should ally to destroy Israel, or US and Israel should ally to destroy Iran, or Iran and Israel should ally to destroy the US. Or have everyone kill each other, but it isn't easy to ensure total destruction of everyone in this scenario. More satisfying solutions are "do nothing" (no one dies), or ev
Re: (Score:3)
Gentlemen, you can't fight in here! This is the War Room!
Re:Mossad connection (Score:5, Insightful)
They're a paper ally because they provide a convenient way to funnel our "aid" money into domestic arms production. A state that is always at war always needs bullets and we're only too happy to buy them on the American taxpayer's behalf, "gratis". This helps float the MIC when we're in between wars. Holocaust guilt prevents any criticism from gaining public traction.
Re: (Score:3)
They are an ally because they have developed several weapons technologies that the US military uses. They are US allies because the US intelligence community comes in a distant second place when it comes to collecting data in that part of the world and need Israel to provide the information they are incapable of collecting on their own. They are US allies because it is the only thing keeping Israel from selling their weapons technology on the open market. China has already shown interest in the Israeli miss
Re: Mossad connection (Score:2)
Re: (Score:2)
oooh. someone "gets it". Finally.
Re: (Score:3, Interesting)
Re:Mossad connection is a red herring (Score:2)
Israel doesn't have a lot of revenue sources or natural resources, so high-tech products like software are important to them, even more so than growing oranges on Palestinian land. And everybody has to serve in the army, except a few specially exempted groups, so just about everybody with a college education has been in the Army before they got that high-tech job, and a lot of them did computer jobs in the Army as well as marching around with Uzis, because every army these days needs computer technology.
Re: (Score:3)
Besides, if it really was Mossad, they'd have done a much better job.
If it was really Mossad they'd be installing the code onto PCs used by their enemies for intelligence gathering. They wouldn't be installing it onto new PCs so they could popup ads for penis enlargement pills.
Re: (Score:2)
It is more likely that this guy left their services and applied some of the tricks he learned to a commercial purpose - writing a library that allows various spyware / adware libraries to hijack clicks and traffic and inject their o
Re: (Score:2)
Re: (Score:2)
Not actually true. Ultra-orthodox Jews do not (yet) have to serve in the army.
<sarcasm>After all, the ultra-orthodox never provoke any trouble with the Palestinians, so why should they contribute to defence?</sarcasm>
Not "any" HDD Re:Mossad connection (Score:1)
The NSA program can flash permanently any HDD. FOREVER!!
There are some older drives out there that aren't flashable, at least not over the normal computer/drive connection (look for "service" connections on late-1990s/early-2000s drives).
In light of these revelations, expect vendors to sell (at a premium of course) drives which can't be "flashed" without setting a physical switch/jumper.
Re: (Score:2)
>drives which can't be "flashed" without setting a physical switch/jumper.
Protects existing kit from updates, but we have heard of supposed intercept programs by the NSA where they capture your hardware in shipping and replace it.
Re:Mossad connection (Score:4, Insightful)
Hey look, there's Israel again (at least 3 times in fact). This Komodia/Superfish crap is likely Mossad sponsored. That would also help explain why Homeland Security put out urgent guidance to remove the crapware and even Microsoft added detection directly to their anti-malware tools. NSA doesn't like being upstaged on its own turf.
I love a good conspiracy as much as the next one but calm yourself. No idea why you got the + mod points. Jumping to random conclusions based on conjecture is silly. That said, I'm sure MOSSAD likes to get up to all kinds of evil shit. Just like their Five Eyes, Russian, and Chinese colleges do. Homeland Security and Microsoft reacted to Superfish because the information was in the public domain. In the same way we are reacting to it by discussing it right now.
Re: (Score:3)
Hey look, there's Israel again (at least 3 times in fact). This Komodia/Superfish crap is likely Mossad sponsored.
Yep. Definitely Mossad. Coz who else would use Komodia as the certificate password [marcrogers.org]. Not enough proof? The guy who runs Komodia used to be a programmer for Mossad. (till they gave him the boot for being a moron)
In other news, spyware modules in an attack against a movie studio prove it was North Korea - obviously pissed about an intelligent blockbuster satire that threatened to provoke a rebellion. Don't listen to those communists like Krebbs who pedal the SAAS [marcrogers.org] malware lie.
Still not convinced it's all a sim
If the software is this bad (Score:4, Interesting)
I would contend there are problems in the hardware also. This one runs deep. Everything on the market needs further inspection. More so now with all the governments demanding backdoors.
Re:If the software is this bad (Score:5, Informative)
Re: (Score:1)
Sounds like computer cleanup is a great business opportunity.
Re: (Score:3, Insightful)
Sure, but in the bigger picture, the lion's share of all these security problems lay firmly in Window's lap. It's almost impossible to imagine an app with this kimodia garbage getting signed by Apple, or inserted into a Linux/BSD repo.
We're not even talking about PEBKAC here, it's an extraordinarily serious issue that affects the entire Windows ecosphere because it's prepackaged. Every box that ships with Windows comes from a vendor who only cares about making a few extra cents per unit.
Notice I didn't ne
Legality (Score:5, Interesting)
I'm fairly certain just installing this software is illegal.
Its not protected by some EULA because the device is sold before the EULA can be read, which courts have already ruled invalidates the EULA.
It violates the same laws that were used to put Kevin Mitnick in jail (and lets be clear, he deserved it), unauthorized access to a computer system and unauthorized access to data flowing across a network.
Hang'em high, I say. Bring Lenovo's leaders out to the chopping block, as well as the leadership of the companies who made any other software that works like this. Its a scam from the very beginning, theres no 'well, maybe its not bad' or 'maybe it was an accident' to it. This is outright bullshit behavior by companies trying to sell a product to someone and then turn that someone into the product for someone else. The entire legal system AND THE PUBLIC need to come down on this like a ton of bricks and make it clear that its unacceptable and will not be tolerated. And by not tolerated I mean 'you will be jailed, not fined'.
Re: (Score:3)
Re: (Score:2, Funny)
git: 'gud' is not a git command. See 'git --help'.
Re: (Score:3)
Yes it would in fringe on your freedoms. Its the MMU's job to enforce the Law not big brother Compilers.
Re: (Score:3)
Hang'em high, I say. Bring Lenovo's leaders out to the chopping block, as well as the leadership of the companies who made any other software that works like this
Yeah! And while we're at it, I'd like a pony. A white one.
Re: Legality (Score:5, Funny)
Dude, we want a UNICORN pony! (Score:3)
Not just any boring vanilla pony - we want a unicorn pony and rainbows and the whole bit!
Lenovo probably will fire somebody, for embarrassing them, but it won't change the number of vendors of crapware out there. Lenovo's certainly not going to take the kind of financial hit that Gemalto did when the public found that the GCHQ had pwned all the SIM cards they sold. Maybe one or two adware companies will lose a non-trivial percentage, but there's a market for sleazy advertising and there's a market for
Re: (Score:2)
In my experience, the average person buying a system with crapware on this doesn't care about it, provided it doesn't slow their machine down. It is just like the people who spill their lives onto social networks. They don't care who reads it, so likely wouldn't care to be tracked by "marketing browser experience enhancement" software.
The real takeaway from this is for people to pack their own parachute -- image off the drive's original software (just in case), wipe the drive [1], then install the OS from
Re:Legality (Score:4)
Its not protected by some EULA because the device is sold before the EULA can be read, which courts have already ruled invalidates the EULA.
Says who?
What is confusing you is that the sale isn't completed until you accept the EULA. It may be true that you can't read the EULA when you hand over the money, but in that case you can take the computer or software home, read the EULA, decide that you don't want to accept it, take the computer back to the store and get your money back.
That said, a computer which allows a third party to read for example a credit card number that I enter into my browser, is not "fit for purpose", and on these grounds you should be able to return it to the seller and get your money back if you live in the EU or some other places.
Re: (Score:2)
Its not protected by some EULA because the device is sold before the EULA can be read, which courts have already ruled invalidates the EULA.
Do you have a citation for that. I'm pretty sure the courts have ruled nothing of the sort. Now I've heard the ruling that someone can't refuse a refund in full for a product where the EULA could not be ready before the purchase, but I have never heard of a EULA being invalidated unless there was no way to signify acceptance. What I mean by that is "By turning this product on you agree to our EULA" is invalid, but turning the product on, being presented with the EULA and then being given the option to accep
Re: (Score:1)
Hang'em high, I say.
Sorry, they are too big to fail.
Build your own (Score:1)
Which is why you should always build your own system.
Woz was right.
Your mean "Code you own"? (Score:3)
This is a software issue, not a hardware issue. Unless you propose to personally code the entire operating system and every application program, that is not practical.
That said, replacing the preinstalled OS with a free one is my first step when buying a new computer. Most recently I managed to buy a PC without an OS at all, but that's rare,
Block off programmatic access to cert trust. (Score:4, Interesting)
The browsers/OSes should harden by eliminating the ability for 3rd party software to automatically install a certificate or CA as trusted into the system database. They should also remove any functionality that allows a 'globally' wildcarded certifacte to be deployed to the browser
Basically, when the computer's hostname is assigned, or during user profile creation, the trusted certificate store should be reinitialized with only stock certificates approved by the OS maker or browser vendor.
A machine-specific keypair should be generated and used to stamp all the certificates with a local trust signature.
Any access to the machine keypair / stamp should be available only through an interactive approval process.
Sysprep'ing an image or changing the product key should invalidate the local trust mark and require manual re-approval of all certs not in the browser vendor's official trust list.
Re:Block off programmatic access to cert trust. (Score:5, Insightful)
And if your machine can automatically do all those things ... so can third party software because in order for you to do everything you want to do, there has to be a pragmatic way to do so, and if the OS can do it, so can any other software that has admin rights.
Either way, you don't want to put that sort of power into the vendors hands, since it means they effectively have created the Apple App store, and if thats what you really want, just buy a Mac and stop using Windows (your first mistake).
The only way to prevent this sort of thing is by not installing software that does it.
But lets ignore all the problems with what you're suggesting and assume it works ... Lenovo would have just approved the certs before they shipped the machine. Or the machine would prompt the user, who would blindly do so on boot, just like all the other things users blindly do.
If you want to prevent this from happening, put the people who do this AND the people who make the decisions to do this, IN JAIL.
Both the developers who write the code to do it and the management who tells them to do so. Assign some personal responsibility for this shit and watch how it suddenly changes. The problem in America is that anyone in a company can basically do whatever they want and hide behind 'the company' who then gets some minor fine (Relatively) and the guy who did it doesn't care one bit.
Re: (Score:2)
There shouldn't be any ability to tamper with the OS so fundamentally and so easily.
Guess what? If you use a windows machine at work, your boss can already install whatever bogus root CA's he wants into your machine without you knowing it, via GP. And he'll claim he has to, because w/o it, the corporate proxy can't MITM you.
Re: (Score:2)
and if the OS can do it, so can any other software that has admin rights.
What would cause you to think that?
Administrator is a user privilege level inside the operating system. Nothing says that an admin level user can necessarily do everything. You can even make an operating system that has no such thing as admin rights, if you want.
You can certainly lockdown certain capabilities so they are available to the OS but not to 3rd party software.
One thing they could require you to do would be to visit a
Re: (Score:2)
Woo, and now a company can't have its own internal CA deployed automatically. And how would software with their own certificate store (ie: Firefox doesn't use the system store) be able to harden itself so much? Its just a piece of software like any other.
And its probably not a "globally wildcarded certificate" that's deployed to the browser, its just a CA. And if a CA is trusted, it can sign arbitrary certificates. You want to be able to do this automatically at least in corporate environment, and manually
Re: (Score:2)
You want to be able to do this automatically at least in corporate environment, and manually for development tools.
We buy certs for corporate resources. It's not necessary to have an internal CA, and from a security standpoint it's probably not very safe, since the CA is more likely to be compromised than a public CA which has more carefully implemented and audited controls.
Woo, and now a company can't have its own internal CA deployed automatically.
Why not? Just make it so that upon joining to a
Re: (Score:2)
We buy certs for corporate resources.
Purchased certs are too expensive to buy for every possible thing you might want to encrypt without a certificate error. There's all manner of internally facing services that don't need public certificate verification and a perfectly useful method of distributing trust for those certificates.
I would grant you, though, that there should be some kind of security setting that makes adding a root CA much more difficult for non-domain members. But don't make it impossible,
Re: (Score:2)
That is a feature, not a bug. The whole point to Windows GP is to allow your boss to push bogus root CAs into your work machines' store (without you knowing it, let alone preventing it) so the corp proxy can MITM sniff all of your https traffic at will. Remove that ability, and expect your local PHB to whine incessantly.
Never mind that the idiots running the IT dept have no clue how bad it is to deploy a CA that can automatically sign forged certs arbitrarily. And most employees are clueless enough to never
Re: (Score:2)
Re: (Score:2)
Unrestricted MS group policy push means all of TLS/SSL is a complete sham.
Correct me if I am wrong.... but group policy is downloaded over CIFS via SYSVOL, and there is no encryption or digital signing of the file being downloaded, so a MITM could insert an altered group policy of the attacker's choice, including bogus certificates to be installed... of the attacker's choice.
Microsoft's fault (Score:4, Insightful)
Microsoft needs to grow a pair and lay down the law to any company that wants to be an OEM for their products. Apple wouldn't let the carriers pull this stunt on their phones.
Re: (Score:2)
Because somehow Apple doesn't get hit with anti-trust suits over it because anyone with the power to hit them is using an iphone and wouldn't want their convenience to take a hit.
The rest of the world however, has to at least give the law some lip service.
Re: (Score:2)
Re: (Score:2)
Allowing unrestricted remote access to your machine's trusted root CA list via GP is a feature of windows.
Why would they remove it? It is for the "enterprise".
Re: (Score:3)
I think Apple prohibiting carriers from doing this sort of stuff is more about keeping competitors under their thumb, not about protecting users. They're not above pulling this crap themselves at their users' expense. They surreptitiously slurped up users' location and wifi SSID data [wired.com] to build their own wifi map (the following year,
Re: Time to switch to chromebook (Score:1)
Yea, definitely put 100% of your data in googles cloud. It'll be safe there... /s
Only 1 categorized as a malicious trojan??? (Score:1)
of at least 12 new titles, including one that's categorized as a malicious trojan by a major antivirus provider.
Why aren't they all categorized as malicious trojans by all major antivirus providers?
pick a nit (Score:2)
[bypasses] secure sockets layer protections by modifying the network stack of computers that run its underlying code. Specifically, Komodia installs a self-signed root CA certificate
Picking a nit:
1. Installing a new CA certificate does not modify the network stack. Adding and removing CA certificates is an ordinary operation.
2. All root certificates are self-signed. If your certificate is signed by something else, it's not a root certificate.
Browser warning? (Score:2)
Aaaarrrggghhh!!! No Mod points (Score:2)