Uncle CornCob
Footballguy
Can't imagine who thought this was a great idea & green lit this
http://arstechnica.com/security/2015/02/lenovo-cto-says-we-didnt-do-enough-promises-to-wipe-superfish-off-pcs/
Lenovo officials are starting to come around to something most people in security circles are saying in an almost unanimous voice—the pre-installation of a fake HTTPS certificate on consumer laptops puts banking passwords and other sensitive information at risk of theft by man-in-the-middle hackers.
"We agree that this was not something we want to have on the system, and we realized we needed to do more," Lenovo CTO Peter Hortensius said in an interview with The Wall Street Journal, referring to adware from a company called Superfish. "Obviously in this case we didn't do enough."
Hortensius went on to say company developers are in the process of writing software that will completely remove all code and data associated with the adware, which is marketed by a company called Superfish. He didn't provide a timeline for when the removal software would be available to end users. Hortensius' statement and the pledge to remove Superfish represent an about-face from Lenovo's previous position that there were no security concerns associated with the adware.
FURTHER READING
LENOVO PCS SHIP WITH MAN-IN-THE-MIDDLE ADWARE THAT BREAKS HTTPS CONNECTIONS [uPDATED] Superfish may make it trivial for attackers to spoof any HTTPS website.
As Ars reported earlier, Laptops currently available from retail stores such as Best Buy come pre-installed with a root Transport Layer Security certificate that hijacks encrypted Web sessions and makes users vulnerable to HTTPS man-in-the-middle attacks that are trivial for attackers to carry out. Security professionals sharply criticized the adware because it installs a certificate digitally signed by Superfish that misrepresents itself as the official certificate for Bank of America, Google, and every other HTTPS website on the Internet. Even worse, it installed the same, easy-to-crack private key on every laptop, making it trivial for malicious hackers to create man-in-the-middle sites that can't be detected by machines that have the certificate installed.
In response to the criticism Lenovo officials released astatement earlier that said: "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." Later updates struck the sentence, although the newer statements made no mention of any change. Officials at Superfish, meanwhile, told Ars earlier Thursday that they stood by the claims made in the early version of the Lenovo statement. A Superfish spokeswoman told Ars the company plans to issue a more detailed comment late Thursday. Now that Superfish seems to be the only one claiming there's no security risk posed by its adware, it will be interesting to see if Superfish also backs down.
Lenovo should be applauded for backing away from statements that there's no merit to security researchers' concerns. But the company should also remember that at the moment, an unknown number of customers remain vulnerable to man-in-the-middle attacks that can completely undermine the entire reason HTTPS protections exist in the first place. Removal software does nothing to protect vulnerable customers now. If Lenovo is truly sorry, the company should offer affected customers a replacement machine at no cost and ensure all vulnerable machines are removed from the supply chain.
http://arstechnica.com/security/2015/02/lenovo-cto-says-we-didnt-do-enough-promises-to-wipe-superfish-off-pcs/
Lenovo officials are starting to come around to something most people in security circles are saying in an almost unanimous voice—the pre-installation of a fake HTTPS certificate on consumer laptops puts banking passwords and other sensitive information at risk of theft by man-in-the-middle hackers.
"We agree that this was not something we want to have on the system, and we realized we needed to do more," Lenovo CTO Peter Hortensius said in an interview with The Wall Street Journal, referring to adware from a company called Superfish. "Obviously in this case we didn't do enough."
Hortensius went on to say company developers are in the process of writing software that will completely remove all code and data associated with the adware, which is marketed by a company called Superfish. He didn't provide a timeline for when the removal software would be available to end users. Hortensius' statement and the pledge to remove Superfish represent an about-face from Lenovo's previous position that there were no security concerns associated with the adware.
FURTHER READING
LENOVO PCS SHIP WITH MAN-IN-THE-MIDDLE ADWARE THAT BREAKS HTTPS CONNECTIONS [uPDATED] Superfish may make it trivial for attackers to spoof any HTTPS website.As Ars reported earlier, Laptops currently available from retail stores such as Best Buy come pre-installed with a root Transport Layer Security certificate that hijacks encrypted Web sessions and makes users vulnerable to HTTPS man-in-the-middle attacks that are trivial for attackers to carry out. Security professionals sharply criticized the adware because it installs a certificate digitally signed by Superfish that misrepresents itself as the official certificate for Bank of America, Google, and every other HTTPS website on the Internet. Even worse, it installed the same, easy-to-crack private key on every laptop, making it trivial for malicious hackers to create man-in-the-middle sites that can't be detected by machines that have the certificate installed.
In response to the criticism Lenovo officials released astatement earlier that said: "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." Later updates struck the sentence, although the newer statements made no mention of any change. Officials at Superfish, meanwhile, told Ars earlier Thursday that they stood by the claims made in the early version of the Lenovo statement. A Superfish spokeswoman told Ars the company plans to issue a more detailed comment late Thursday. Now that Superfish seems to be the only one claiming there's no security risk posed by its adware, it will be interesting to see if Superfish also backs down.
Lenovo should be applauded for backing away from statements that there's no merit to security researchers' concerns. But the company should also remember that at the moment, an unknown number of customers remain vulnerable to man-in-the-middle attacks that can completely undermine the entire reason HTTPS protections exist in the first place. Removal software does nothing to protect vulnerable customers now. If Lenovo is truly sorry, the company should offer affected customers a replacement machine at no cost and ensure all vulnerable machines are removed from the supply chain.
