Hacker News Reader

Comment by gojomo | Hacker News Reader

Bullet point 4 is what I'd been wondering about:

• The Superfish proxy accepts its own certificate, so now that the private key has been leaked, an attacker can mimic an arbitrary site in Chrome and IE

I thought there might be a chance that despite all the other idiocy here, they might have refused external certificates from their own CA, mitigating the risks somewhat. But no suck luck for Lenovo customers!

View on HN

The Superfish proxy accepts any certificate. If you're being MITMed (before Superfish MITMs you), Superfish will help them by replacing their certificate with Superfish's.

I don't believe that's true, but if so – for example if it replaces self-signed certs, or certs from any untrusted CA, with its own (force-trusted) cert – then that would be worthy of another scary explicit bullet point.

(It might just accept all CAs locally-configured, and it's accepting its own because they didn't special-case a rejection.)

It is true. I can't remember where I read it, but I remember seeing it either here on HN or on Twitter.

Komodia's own info says that it will generate an invalid certificate if the real certificate was invalid or untrusted "so it will not cause a security problem". They may be lying, but that page is fairly open about the way it works:

http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cer...

I wouldn't go as far as say lying, they just failed to consider the SAN. Unfortunately they pulled the doc, possibly due to what they claim to be a DDOS but it's still in Google cache:

http://webcache.googleusercontent.com/search?q=cache:XUbVSX8...

'SAN'?

http://en.wikipedia.org/wiki/SubjectAltName

SubjectAltName.

It's TRUE, confirmed, and replicated by others. See my other post to this parent. And you are correct, this is worthy of another scary explicit bullet point!

And this matters because even if you uninstall the program, it leaves the certificate behind, right? So you have to manually remove the cert to shield yourself against future attacks, in addition to removing the program

Not that this excuses Lenovo in any regard whatsoever, the removal instructions[1] Lenovo link to in their press release[2][3] includes the removal of a certificate.

[1] http://support.lenovo.com/us/en/product_security/superfish_u...

[2] http://news.lenovo.com/article_display.cfm?article_id=1929

[3] http://support.lenovo.com/us/en/product_security/superfish

Good, though TBH, it didn't include removal of a certificate just few hours ago. I guess they're breaking under the pressure of PR shitstorm.

That would have been comical, considering uninstalling doesn't remove the root cert, so a user would have been more secure with superfish installed than uninstalled.

Nope. Look at my reply to the parent. The Superfish solution is not properly passing the validation state of the public cert provided by the cert to the browser. As a result its fairly trivial to MitM HTTPS without need of the private when the Superfish software is installed. To be clear, it is absolutely worse to have Superfish installed than to have it removed.

Reply on news.ycombinator.com