leanovo lol

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > leanovo lol

ClassActionFursuit: Mar 15, 2006

had to dig for this thread idk if this is worth it

"arse technica" posted:

Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections

Lenovo is selling computers that come preinstalled with adware that hijacks encrypted Web sessions and may make users vulnerable to HTTPS man-in-the-middle attacks that are trivial for attackers to carry out, security researchers said.

The critical threat is present on Lenovo PCs that have adware from a company called Superfish installed. As unsavory as many people find software that injects ads into Web pages, there's something much more nefarious about the Superfish package. It installs a self-signed root HTTPS certificate that can intercept encrypted traffic for every website a user visits. When a user visits an HTTPS site, the site certificate is signed and controlled by Superfish and falsely represents itself as the official website certificate.

Even worse, the private encryption key accompanying the Superfish-signed Transport Layer Security certificate appears to be the same for every Lenovo machine. Attackers may be able to use the key to certify imposter HTTPS websites that masquerade as Bank of America, Google, or any other secure destination on the Internet. Under such a scenario, PCs that have the Superfish root certificate installed will fail to flag the sites as forgeries�a failure that completely undermines the reason HTTPS protections exist in the first place.

The adware and its effect on Web encryption has been discussed since at least September in Lenovo customer forum threads such as those here and here. In the latter post, dated January 21, a user showed a root certificate titled Superfish was installed:

He then went on to show how the certificate tampered with the HTTPS connection to a banking website, behavior that allowed Superfish to collect all data unencrypted.

Surprisingly, the behavior largely escaped the notice of security and privacy advocates, until now. On Wednesday evening, following several lengthy Twitter discussions about the overlooked behavior, security researcher Chris Palmer bought a Lenovo Yoga 2 Pro for $600 at a San Francisco Bay Area Best Buy store. He quickly confirmed that the model was pre-installed with the Superfish software and self-signed key.

When Palmer visited https://www.bankofamerica.com/, he found that the certificate presented to his browser wasn't signed by certificate authority VeriSign as one would expect, but rather by Superfish.

Palmer was later able to confirm that the private key for the Superfish certificate installed on his Yoga 2 contained the same private key as a Superfish certificate installed on a different person's Lenovo PC. That means there's a good chance attackers could use the certificate to create fake HTTPS websites that wouldn't be detected by vulnerable Lenovo machines. At the time this report was being prepared, there were no reports of anyone testing and confirming the hypothesis, but several researchers agreed the scenario seemed highly likely.

No, certificate pinning won't save you

The Superfish software hijacks encrypted Web sessions no matter which browser someone uses. Worse yet, certificate pinning in Google Chrome will do nothing to alert users that something is amiss. As Google points out in a post explaining certificate pinning, the mechanism isn't set up to validate certificates chained to a private anchor, such as a root certificate installed in the operating system of the connecting device. "A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites," the Google page warned. "'Data loss prevention' appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning."

It's not known exactly which Lenovo computers come with Superfish pre-installed. A Lenovo representative said in a forum that Superfish has been uninstalled and cited "some issues (browser pop up behavior for example)" as the reason. On Twitter Wednesday evening, a Lenovo representative reiterated that the adware was removed on new machines. But as Palmer's experience demonstrated, it's still possible to buy Lenovo PCs that have it pre-installed. And it remains unclear if there's an update mechanism in place to remove it from machines that already have it installed. It's also unknown if PCs from other manufacturers come with Superfish pre-installed. Readers should be aware that even after uninstalling the Superfish adware from their machines, the Superfish root certificate will remain.

Superfish presumably installs the root certificates so it can inject ads into encrypted Web pages. By many people's standards, that's bad. But adware that breaks HTTPS connections and may make users vulnerable to man-in-the-middle attacks that are trivial to carry out is orders of magnitude worse. Stay tuned. We'll all be hearing much more about the Superfish debacle in the days and weeks ahead.

# ¿ Feb 19, 2015 13:40

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 17:30

ClassActionFursuit: Mar 15, 2006

dont worry im sure the relentless race to the bottom will make quality hardware a reality any day now

i mean its not like the commoditization of hardware necessary for low cost computers running indistinguishable software is a recipe for a market completely devoid of anything above the barest minimum of operational hardware coupled with massive incentives to subsidize the costs by any means necessary up to and including installing malware on the devices

i mean poo poo if that were the case the only sensible action would be eschew such a broken ecosystem by moving to another platform entirely

if only there was some company who wasnt selling the cheapest hardware possible but instead competed by offering good hardware and distinguished themselves from their competitors by developing better software. then they could wouldnt be constantly tempted to fill their computers with garbage paid for by malware companies and cover their equipment in stickers paid for by component manufacturers. i bet theyd sell fewer computers as they wouldnt be competing on price but i wonder how much money theyd make not relying on spyware for their profit margin?

# ¿ Feb 21, 2015 01:46

ClassActionFursuit: Mar 15, 2006

Bloody posted:

im pretty sure the microsoft surface pro 3 is still in the hole but i think its a good idea regardless

a yes the laptop unusable on a lap in a form factor wherein the top part is the heavy part with an os that had touch support tacked on in an unusable fashion for tablet use and with one of the worst trackpads and keyboards ever manufactured (even by windows standards) for kb/mouse use

truly the wave of the future and at only twice the price of a macbook air what a bargain

# ¿ Feb 21, 2015 01:52

ClassActionFursuit: Mar 15, 2006

infernal machines posted:

the surface was built for windows 8 and windows 8 was built for the surface

it's an ouroboros of poo poo created to appeal to a customer that doesn't exist

this is exactly it in re: the surface

the point still remains that every windows laptop manufacturer is selling to the same market and that market by the very nature of the consumer theyre selling to and the product theyre selling will only produce crap

its just inescapable regardless of whether you like windows or not

# ¿ Feb 21, 2015 02:28

ClassActionFursuit: Mar 15, 2006

pointsofdata posted:

you'd think that dell or asus or someone would look at apple's profit margins, compare it to their own and think hmm maybe we should be more like them.

but they cant because theyre selling windows machines and thus compete against companies that also sell windows machines

you arent going to sell your high quality windows laptop for $1200 when hp will sell a laptop with the same specs running the same software for $300 at walmart

its the same reason no one will ever buy microsoft signature devices at the microsoft store and why google cant sell nexus phones. if what youre selling is a commodity the only thing that matters is the price

# ¿ Feb 22, 2015 20:42

ClassActionFursuit: Mar 15, 2006

A Yolo Wizard posted:

aren't the signature devices the same price

i suppose well never know because no one has ever gone into a microsoft store

even if they were the same price or cheaper it wouldnt make any difference to my point which is that no one is ever going to look for a "quality" windows pc. just as no one travels across town to get the good white bread or the best 2% milk no one gives a gently caress which windows computer they buy so long as its cheap as gently caress and completely disposable

it is unfathomable to the average person that one windows computer could possibly be better than any other to them theyre all garbage that if they must have they will expend the least amount of money and effort to obtain

# ¿ Feb 23, 2015 05:08

Adbot: ADBOT LOVES YOU

# ¿ Apr 28, 2024 17:30

ClassActionFursuit: Mar 15, 2006

annapacketstormaya posted:

i bought my current laptop from the microsoft store

"well right across from here theres a store selling good computers but its packed so i may as well go into this microsoft store because the ratio of employees to customers is 20:1"

# ¿ Feb 23, 2015 23:19