42

The site has already a discussion of the security risks of "Superfish". It seems to me that anything that tampers with the bits of one's connection is bad. If it tampers with TLS connections, it is evil.

How can I determine if I am vulnerable to Superfish?

Lenovo has issued a statement on Superfish (after they got caught red-handed) saying it has been "disabled."

As I can no longer trust Lenovo, is there a way to remove it completely other than format c:?

Edit: the Lenovo statement linked above now has a list of model numbers on which Superfish may have been installed. Um, but it says "appeared" rather than "installed," rather like it sneaked on those computers in the middle of the night.

  • You can start by removing the rogue CA from your trust store – Dillinur Feb 19 '15 at 16:05
  • 5
    If you don't trust Lenovo I'm afraid the best solution is to indeed "format c:", as there may be something else (rootkit?) planted in your system that's more sneaky than Superfish. – user42178 Feb 19 '15 at 17:25
  • 3
    @cpast: As far as I know, you are correct... only their consumer line computers. But if they'll compromise the security of some of their customers, they may have other bad habits. Once they've pulled something like this, it will be hard to trust them with anything in the future. – Bob Brown Feb 19 '15 at 18:37
  • 8
    "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns.". Hum... besides the fact they were apparently shipping the same trusted CA certificate and its private key (embedded somewhere in that software) to all affected units. Terrible statement. – Bruno Feb 19 '15 at 19:36
  • 1
    @cpast I have a ThinkPad Edge E520 that I bought in January of 2012 with its original drivers. I've confirmed that it does not have Superfish certificates installed. Even so, very concerning that they'd even consider installing this kind of software. – JDB Feb 19 '15 at 23:29
40

You can check to see if you're machine is vulnerable by browsing to this site: https://badssl.com/dashboard/

Everyone keeps saying that you need to completely reinstall a clean version of Windows. I would first try to remove Superfish first. To remove the executable you should be able to use the normal Windows Add/Remove programs method. I believe the executable is called Visual Discovery.

To remove the certificate follow these steps from StackOverflow:

FYI, this Superfish software is now a major news headline: http://arstechnica.com/security/2015/02/lenovo-pcs-ship-with-man-in-the-middle-adware-that-breaks-https-connections/

It is preloaded by Lenovo (there may be other vendors). You have to uninstall it, but that will not remove the certificate. To remove the certificate, you must do the following:

  1. Run mmc.exe
  2. Go to File -> Add/Remove Snap-in
  3. Pick Certificates, click Add
  4. Pick Computer Account, click Next
  5. Pick Local Computer, click Finish
  6. Click OK
  7. Look under Trusted Root Certification Authorities -> Certificates.
  8. Find the one issued to Superfish and delete it.

If you are really paranoid, the best solution would be to reformat your laptop and install Windows with Microsoft media, not the factory recovery stuff.

While the above removes it from the Microsoft Trusted Store, this link indicates that the root certificate might be injected into browser trusted stores. Check that your browser also does not trust the Superfish Inc certificate. Chrome and IE both use the operating system's trusted root store. If you're using FireFox you need to manually remove it.

Remove Trusted CA from FireFox Trusted Store

  1. Click the menu button, then choose Preferences
  2. Click the Advanced in the upper tab menu
  3. Then click Certificates in the lower tab menu.
  4. Click View Certificates
  5. Under the Authorities tab check for the Superfish Inc certificate
  6. If it's found, then click on the certificate and then click Delete or Distrust
  7. Finally click the Ok button to confirm that you're removing it.
  • 1
    Does that mean uninstalling through "add/remove programs" gets rid of the executable part? – Bob Brown Feb 19 '15 at 16:33
  • 2
    I believe so, yes. – RoraΖ Feb 19 '15 at 16:37
  • Bit defender does a good Job + Firefox Update ans removal of the certificate. – Daniel W. Feb 21 '15 at 0:24
0

I did everything that raz mentioned in his answer - the https://filippo.io/Badfish site checked out OK, I had nothing named "Visual Discovery" in my Add/Remove Programs, and I found no Superfish certificates in mmc or Firefox. But I still found a variant of Superfish on my machine, and I don't even have a Lenovo computer.

I searched for filenames containing the string "superfish", and I found 2 files in a subdirectory of the Flash Video Downloader addon for Firefox (one of the most popular addons):

  • superfish_titles.txt (contains a long list of web site names)
  • superfish.js (appears to have the ability to modify web pages in your browser and load material from that best-deals-products site)

Based on reading a few forums, some browser addons nowadays include adware/malware such as this. The unfortunate thing is that neither the MBAM scanner nor VirusTotal recognized those files as malware. Hopefully just uninstalling the addon is enough to remove all traces of it from the system.

  • Superfish is not a Lenovo thing - it's a legitimate company doing advertising. It will not be surprising to see references to the company on any computer. The real problem was the trusted CA. – schroeder Feb 23 '15 at 17:55
  • @schroeder: I'm sorry, but I have to disagree with "legitimate" when applied to a company whose business model is to modify others' web pages without the consent of the authors of the pages being modified. – Bob Brown Feb 24 '15 at 1:15
  • As far as I can tell, superfish.js is not connected with the "Superfish" of Lenovo fame, or maybe there are two different files of that name. One is a jQuery menu enhancer and has MIT and GPL license notices at the top. That one, as far as I know, is harmless, and is likely to be found only in your browser's cache. I have no experience with superfish_titles.txt but it sounds suspicious. – Bob Brown Feb 24 '15 at 1:22
  • 1
    @BobBrown I just posted the superfish.js and superfish_titles.txt files to pastebin. Neither one is related to the jQuery menu enhancer. As you can see, superfish.js connects to best-deals-products.com, which is the same site I've seen mentioned in articles about the Superfish of Lenovo fame, such as this article. – pacoverflow Feb 24 '15 at 2:09
  • @pacoverflow: EEeewww... There are two of superfish.js, one of which is evil. Thank you for following this up. – Bob Brown Feb 24 '15 at 2:25
-5

Or, the network administrator can bar access to SuperFish all together. This will circumvent all attempts to get a cert even if this app or certificate gets re-installed as so many Windows viruses do so very well.

  • 3
    How would you go about doing that? The software is pre-installed and the bogus certificates are created on the fly. There isn't any "access." Superfish does a MITM attack from within the computer. (Yes, you could bar access to whatever serves the ads, but that doesn't really help.) – Bob Brown Feb 21 '15 at 0:21
  • I may be wrong as I have not looked at the whole architecture of the exploit. If Superfish needs to contact its own CA to do its 'thing' and it cannot because the server is inaccessible - then it may need to fall-back and do things without the exploit or die horribly. – fmotta Feb 21 '15 at 0:31
  • 7
    Superfish doesn't need to contact anything. It comes with its own built-in CA. – Mark Feb 21 '15 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.