Komodia is a company that makes an SSL hijacking product, as described on their site:
Our advanced SSL hijacker SDK is a brand new technology that allows you to
access data that was encrypted using SSL and perform on the fly SSL
decryption. The hijacker uses Komodia’s Redirector platform to allow you
easy access to the data and the ability to modify, redirect, block, and
record the data without triggering the target browser’s certification
warning. [1]
A necessary feature of such a product appears to be the inclusion of the private SSL key in any product using their hijacking tech and the installation of komodia as a valid certificate in the OS certificate store. Therefore, anyone who wants can buy a product using Komodia, extract the private SSL key, and MITM at will any computer infected with any product using Komodia software.Any website protected by SSL where that SSL authority isn't pinned by chrome (do other browsers have such tech?) is now trivially vulnerable to SSL hijacking by, eg, anyone in the same coffee shop or local network. And, of course, between that user and their destination site.
The current kerfuffle is due to the fact that Lenovo was caught pre-installing Superfish, an adware/spyware product -- for the users benefit! -- that, in turn, installed the Komodia ssl hijacking toolkit and broke SSL on any such infected computer.
The race is now on for every goddamn script kiddie in the entire world to the bank accounts of any suckers that trusted Lenovo. Go up to Seattle where windows laptops are more common, roll into a coffee shop, and I bet you can earn yourself some bank account logins.
ps -- this is a reason people buy macs. You get a vanilla OS install; that's currently only really available for Windows afaik from the Microsoft store.