Advertising Company Superfish Closes Doors After Storm Of Criticism

Advertising company Superfish, early this year in the center was a storm of criticism, the doors closed.Superfish delivered to Lenovo a program that intercepted on all kinds of laptop models SSL connections to inject ads.

The adware used for this purpose its own root certificate. Researchers managed to crack the password using the private key of the Superfish certificate. This makes it possible in some cases to perform man-in-the-middle attacks against systems running Superfish and the certificate installed. Because of the incident Lenovo Superfish decided not to deliver laptops and offered a tool to remove. In addition, there were all kinds of lawsuits.

Co-founder Adi Pinhas has now decided to close Superfish and the company's technology through a new company, Visual Just to be used. Instead of injecting ads Visual works Just to smartphone apps that can recognize pictures and can search for similar images, without any text labels are required. According Pinhas was the move to this "visual search software" is already underway, but which was accelerated by all the criticism that erupted after the vulnerability.

That's not to say Just Visual nothing to do with the ads will have. The visual search engine is in fact focused on the search for specific objects by telephone. The search engine can then show ads of similar products. In addition, the company hopes to make money on licenses for the use of technology. Well Just Visual will follow industry standards for safety and privacy, as late as Chief Product Officer Keven Lee opposite the Associated Press know.

Lenovo Provides Free Recovery Media Without Superfish

Owners of a Lenovo laptop can now apply for recovery media to install Windows and additional software without even the Super Fish-adware is installed together, so has let the computer manufacturer on the private forum know. Super Fish is a program that intercepted SSL connections to inject ads. The adware used for this purpose its own root certificate. Researchers managed to crack the password using the private key of the Superfish certificate.

This makes it possible in certain cases to Man-in-the-middle attacks against systems that perform Superfish and the certificate installed. In total Superfish appeared on more than 40 different types of laptops to be installed. Because of the Superfish debacle Lenovo announced several measures. For example, published a removal tool and put the manufacturer's promise that it will provide cleaner machines with less pre-installed software in the future. Also followed a free subscription of six months on the McAfee virus scanner.

Current owners of a laptop sit with the problem on their recovery media, such as a special recovery partition, Superfish is still present. If the computer is reinstalled using the recovery media is also Superfish replaced. Last month, Lenovo's own forum know that they worked to restore clean media without Superfish which can be requested via the support department. An employee of Lenovo claims that the recovery media will not be sent in bulk. "But if you need due to specific circumstances recovery media, please contact the service desk." Whether the media via CD or USB stick will be offered the employee does not know. We have asked for clarification about Lenovo.

Microsoft Removes Superfish 240,000 Lenovo Laptops

In a week's time Microsoft about 240,000 Lenovo laptops have removed the Super Fish-adware, according to figures that released the software giant. Because of the vulnerability that was caused by Superfish decided to release on February 19, Microsoft updates its own virus scanners so that they could remove the adware and the corresponding certificate. In a week's time, Microsoft has identified about 240,000 machines Superfish.

The adware was Lenovo laptops at more than 40 models installed and aimed to intercept SSL connections to then inject ads.The adware used for this purpose its own root certificate. Researchers managed to crack the password using the private key of the Superfish certificate. This makes it possible in some cases to Man-in-the-middle attacks against systems that perform Superfish and the certificate installed.

In a blog posting , Microsoft explains the different ways in which Lenovo users could be attacked. This could be via a malicious WiFi network, phishing domain or DNS poisoning can. Lenovo provides all in January for carrying laptops with Superfish, although in February even laptops with Superfish sold. In addition, different virus scanners now detect and remove Superfish. In the case does not recognize the installed security software Superfish, Microsoft recommends that a single scan using the Microsoft Safety Scanner to perform.

Lenovo Provides Customers With Superfish-Adware 6 Months McAfee

Customers of computer manufacturer Lenovo laptop with the Superfish-adware can receive from next week try a virus McAfee for a period of six months without charge, as the company has let know .Because of the Superfish debacle Lenovo announced several measures. Was published as a removal tool and put the manufacturer's promise that it will provide cleaner machines with less pre-installed software in the future.

In addition, the customers a free subscription offer of a half years at McAfee Live Safe. The security software can be used on multiple devices and to protect systems against malware and other online threats. Duped consumers can already download the trial version of the software, to activate it, then next week on 16 March. In case users the security itself already bought their existing subscription will be extended by six months.

In total, more than 40 different types of laptops that Superfish standard was installed qualify for the program. Super Fish is a program that intercepted SSL connections to inject ads. The adware used for this purpose its own root certificate.Researchers managed to crack the password using the private key of the Superfish certificate. This makes it possible in some cases to Man-in-the-middle attacks against systems that perform Superfish and the certificate installed.

Lenovo Sold In February Even Laptop With Superfish-Adware

Although Lenovo has stopped installing Superfish consumers should still see if the offending adware is not on newly delivered systems. Discovered two readers of Ars Technica . On a laptop in early February by their neighbor was ordered discovered readers Superfish.

"Lenovo may say they Superfish installed no more since December, but the problem is that they still deliver systems that Superfish state," said Laura Buddine. Superfish intercepted SSL connections for injecting ads. A vulnerability in the adware meant that users could be attacked. The installed version of Windows on the investigated laptop dated for December.

According Buddine this shows that Lenovo's problem will not large enough to install the laptops in the warehouses again without Superfish. It also showed that the Super Fish-removal tool from Lenovo not removed all traces of adware. Thus were discovered after the delete several files of the adware and the certificate. Analysis of the source code of the removal tool that Lenovo posted on the Internet, it appears that there has recently released a new version that fixes several problems, including the removal of the Superfish files.

PrivDog: Only 57,000 Users At Risk

Adware PrivDog developer has released a security update after there was a vulnerability in the software detects allowing users targeted by Man-in-the-middle attack could be. In total, this "only" 57,000 users have run risk, says the developer. However, this is not the PrivDog software that comes with the programs of security provider and Certificate Authority Comodo. PrivDog makes adware that SSL connections are intercepted and software advertisements of "reliable partners" can inject.

Researchers discovered that PrivDog install a root certificate and thus intercepted each SSL certificate of websites using a self-signed certificate, even when it comes to SSL certificates that are not valid. As a result, the browser will accept HTTPS each certificate that is, whether by a Certificate Authority (CA) is signed or not. For example, users of public Wi-Fi networks could thus be the victim of a Man-in-the-middle attack. The vulnerability is present in versions 3.0.96.0 and 3.0.97.0 PrivDog.

These versions intercept SSL traffic and were downloaded from the website of PrivDog. Contrary to what was thought yesterday is Comodo Internet Security with an earlier version of PrivDog bundled working with a browser extension and thus is not directly vulnerable to this threat. That says researcher Hanno Boeck in addition to his research. PrivDog also confirms that the PrivDogplug-in that comes with the Comodo Browsers problem has not.

Globally, more than 57,000 people have downloaded the vulnerable PrivDog versions. According adware developer made ​​sure that the problem with some sites that use a self-signed certificate no certificate warning was given. However, the encryption was offered to the end user would remain intact, says PrivDog. Tonight there is rolled out an automatic update that fixes the problem by users.

Privdog Software Worse Than Superfish Adware

After computer manufacturer Lenovo appears to combine security provider Comodo adware with its own software SSL traffic intercepted, only the impact is much greater than with Lenovo's Superfish was. That says researcher Hanno Bock . Comodo is known software like Comodo Internet Security and Comodo Dragon Browser. With some of the programs PrivDog-adware is included.

Like Superfish intercepted PrivDog HTTPS traffic to inject ads from "reliable partners". Late last year, the ability to filter HTTPS traffic was already on the forum Comodo discussed . The software is after Superfish scandal now in the spotlight. A user decided because Superfish a test page to do, which warns users if their HTTPS connection is manipulated. Although the user is not used Superfish he got a warning. Then this user reported on Hacker News that the possible was the PrivDog-adware.

PrivDog not have the same vulnerability as Superfish, using a weak certificate and a weak password to protect the private key of the certificate, but one which is many times as possible according to Bock. Although Superfish same certificate and key used for all installations, PrivDog makes for each installation a separate key and certificate. The biggest problem is that each certificate PrivDog intercepted and replaced by a self-signed certificate.

It is also about certificates that were not valid in the first place. As a result, the browser will accept HTTPS each certificate that is, whether by a Certificate Authority (CA) is signed or not. "We are still trying to find out the details, but it looks bad," Bock says. The researcher also finds it strange that Comodo, which is itself a CA bundle adware with their own software. "If the CA would be their job to protect HTTPS, not break," the researcher concludes.

Meanwhile warns also the CERT Coordination Center (CERT / CC) at Carnegie Mellon University for PrivDog. An attacker could according to the CERT / CC HTTPS sites spoof and intercept HTTPS traffic without users see a certificate warning.Users will also be advised to remove PrivDog. This would also be the root certificate in question to be removed.

US-CERT writes: "Adtrustmedia PrivDog is promoted by the Comodo Group, which is an organization that offers SSL certificates and authentication solutions." A variant of PrivDog that is not affected by this issue is shipped with products produced by Comodo (see below). This makes this case especially interesting because Comodo itself is a certificate authority (they had issues before). As ACLU technologist Christopher Soghoian points out on Twitter the founder of PrivDog is the CEO of Comodo. (See this blog post.)

Update/Clarification: The dangerous TLS interception behaviour is part of the latest version of PrivDog 3.0.96.0, which can be downloaded from the PrivDog webpage. Comodo Internet Security bundles an earlier version of PrivDog that works with a browser extension, so it is not directly vulnerable to this threat. According to online sources PrivDog 3.0.96.0 was released in December 2014 and changed the TLS interception technology.

Update 2: Privdog published an Advisory.

Virus Scanners Microsoft Remove Superfish-Adware

Microsoft released an update for the virus Security Essentials and Windows Defender that addresses the Super Fish-adware on Lenovo laptops as well as the self-signed certificate that the adware used will be deleted. Also the free Microsoft Safety Scanner is able to detect and remove Superfish.This was discovered by Filippo Valsorda of the CloudFlare Security Team.

Meanwhile, Microsoft has also the definition put the Super Fish-adware line, where the threat as a Trojan horse is described.In addition to Microsoft also have several other providers of anti-virus solutions now released an update to detect and remove Superfish. A survey on VirusTotal shows that Superfish yesterday by 17 of the 55 virus was detected. Earlier in the day there were still six .

Besides the anti-virus companies warn the American and Dutch government for Superfish. The Computer Emergency Readiness Team (US-CERT) that part of the US Department of Homeland Security has issued this warning off. Consumers get it advised to remove the adware and the certificate installed. The Dutch government through veiliginternetten.nl published, an initiative of Economic Affairs, the National Cyber ​​Security Center and the ECP, a short article about Superfish.