With vendors often doing little in the way of due diligence, third-party software can include those with backdoors, or which could present privacy problems, or contain ways to trick users into paying for subscriptions. More often the focus is on pushing content and advertising, based on tracking user\u2019s web browsing habits, or targeted marketing, where search results from trusted sites such as Google are tampered with before they\u2019re presented to the user.<\/p>\n
SSL redirect<\/h3>\n
Lenovo\u2019s own-goal was to include Superfish<\/a>: adware that alters search results in order to inject its own, and offers competing products whenever the user mouse-overs keywords in the page.<\/p>\n Encrypted communications require a private and a public key<\/a>, separate but mathematically linked. The public key, which is published and available, is used by others to encrypt messages and send them to the owner of the public key. The public key\u2019s owner uses their secret, private key to decrypt them.<\/p>\n In order to be sure public keys belong to who they claim to, they are verified by certificates signed by trusted authorities. Superfish, however, in order to intercept encrypted search requests made over HTTPS (typically used by Google), installs a self-signed root certificate on the system. This, despite offering no checking or verification of keys, allows Superfish to takes control of encrypted traffic by masquerading as the site\u2019s own certificate. So, for example, when connecting to the Bank of America, the Superfish certificate would claim to be from the Bank of America.<\/p>\n Superfish<\/p><\/div>\n This is called a man-in-the-middle attack<\/a>, where one site impersonates another in order to fool other parties into communicating with it. The user thinks they are connecting to a valid site as the browser reports it has checked the site\u2019s identity via its certificate, but in fact traffic is going to another site, using another connection.<\/p>\n Can you see the problem? In an effort to pry into user\u2019s searches in order to show more adverts, Superfish created a security hole through which others can get in too. This was done as the private key for securing the data sent to Superfish has been cracked. Doing so also allows intruders to see search queries or any other traffic, even though it appears to the user that they are communicating securely with Google.<\/p>\n Man in the middle attack<\/p><\/div>\n At the core of this problem is the use of SSL hijacker<\/a> software developed by a firm called Komodia. As their website states:<\/p>\n The SSL hijacker uses Komodia\u2019s Redirector platform to allow you easy access to the data and the ability to modify, redirect, block, and record the data without triggering the target browser\u2019s certification warning.<\/p><\/blockquote>\n So we have a piece of software that can trick the user into connecting to website that is not necessarily what it seems or claims to be, bypassing the browser\u2019s built-in security that would alert them.<\/p>\n As if this wasn\u2019t bad enough, Superfish embedded the private key used to secure the traffic sent over the encrypted link along with its public key in the certificate. This should never happen, as a private key should not be shared. Not only does the certificate contain both keys, but the private key password has been cracked (it\u2019s \u201ckomedia\u201d, would you believe) and is the same for each on of the millions of computers on which Superfish is installed. And not just Superfish: the same weak certificates are bundled with many other software<\/a> too.<\/p>\n SSL redirect<\/p><\/div>\n This is a spectacular security risk, meaning any intruder can access the data passing between any user with the certificate installed and any encrypted website they\u2019re connected to. It\u2019s like finding the best locks to secure your home, and then putting the keys under a plant pot outside the front door.<\/p>\n This wouldn\u2019t be the first time that security has failed in this way \u2013 not by defeating the encryption, but through a flawed set up and weak, easily guessable password. Antivirus software firms and Microsoft are already rolling out patches in order to detect and remove this software and its certificate.<\/p>\n Lenovo have sold over 16m Windows computers in the last quarter of 2014 \u2013 and many of these vulnerable. Not only that, but every one of those computers could potentially eavesdrop on the secure communications of every other, as the certificate password is the same for all.<\/p>\n This is likely to be extremely costly for Lenovo, in brand reputation but also in legal actions which have already begun<\/a>. Although the issue was raised in January<\/a> on the Lenovo forums, the firm claims to have had no idea of the problem it represented \u2013 that is bad enough in itself.<\/p>\n This article was originally published on The Conversation<\/a>. Read the original article<\/a>.<\/p>\n Your Lenovo laptop may have malware pre-installed<\/a><\/strong><\/p>\n![\"Superfish\"](\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2015\/02\/Superfish.png\")
<\/a>![\"Man](\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2015\/02\/Man-in-the-middle-attack.jpg\")
<\/a>Bad software used for bad ends<\/h3>\n
![\"SSL](\"http:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2015\/02\/SSL-redirect.png\")
<\/a>More on Lenovo<\/h3>\n