2

On my Toshiba laptop there are a variety of different Toshiba programs that came pre-installed. Many of them are some sort of utility, optimizer, checkup, and update kind of programs that I guess are commonly referred to as bloatware.

One of these programs in particular, called "Toshiba Laptop Checkup" tries to run its "checkup" every so often automatically, and when it does, the following error message is displayed:

Security Alert

A secure connection with this site cannot be verified. Would you still like to proceed? The certificate you are viewing does not match the name of the site you are trying to view.

If I click "Show Certificate" details, I get a certificate with the following information:

Issued to: www.bcrea.bc.ca

Issued by: Go Daddy Secure Certificate Authority - G2

Valid from 3/10/2015 to 10/2/2017

When I google www.bcrea.bc.ca , the top result is the British Columbia Real Estate Association .

That is extremely random and unrelated to me, and the "Toshiba Laptop Checkup", so what gives?

I have read this article about Superfish. While a lot of information there and elsewhere about Superfish is over my head, and I don't really understand it the technical details, I remember that the vulnerability involves certificates and pre-installed software on computers. That also made me wonder just what is going on here?

3

It is hard to tell you exactly what is going on because we don't know what request actually triggered the message and you do.

What it looks like, however, is that for some reason, a secure request intended for Toshiba's update server went to www.bcrea.bc.ca. There can be many reason for this but few are really encouraging:

  • Something in your DNS resolution is being exploited to redirect requests to different web site. Given the nature of the target web site (a real estate company), that purpose could be either advertising or a DDoS attempt. Note that this could very well be the result of a locally installed trojan.
  • Toshiba's DNS server (or, possibly, the CDN that handle their traffic) is misconfigured and pointing you to the wrong (network) location.
  • The update client you're using is incorrectly interpreting the answer it is getting from Toshiba's update server and it is using a link sent as advertisement as a link to the actual content it is expecting.

At this point, it is hard to give you any more details since there isn't much more information. I would suggest that you treat your system as potentially compromised (running an AV check would be a first step). You might as well ask the question to Toshiba support: since they are the ones who provided you with the problematic tool, they might help you figure out what is happening.

In all likeliness, however, you aren't seeing the result of superfish (or similar TLS terminating proxy software) since the certificate details you provided reference a valid CA but an invalid host name.

  • where you say: "...we don't know what request actually triggered the message and you do." , im not sure im following what you mean? Is there additional information i can provide to help shed more light on things? – Churning Butter Mar 30 '15 at 13:52
  • When you establish a TLS connection, you start by a DNS request for the relevant host name, connect to the IP address you get back, perform the TLS handshake and compare the certificate received by the server. The error you mentioned indicates that this certificate does not refer to the host name you started your query with. Since we do not know what that host name was, it is hard to know exactly what is going on. Furthermore, we have little indication about what part of the application is issuing this request (add display or real data request) – Stephane Mar 30 '15 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.