Superfish: adware preinstalled on Lenovo laptops

On February 19th of 2015, it came out that Lenovo’s laptops had been shipped with an adware Superfish preinstalled. There are two major problems with this issue. The first one is

On February 19th of 2015, it came out that Lenovo’s laptops had been shipped with an adware Superfish preinstalled. There are two major problems with this issue.

The first one is the fact that the hardware maker had been shipping consumer laptops with an adware pre-installed for several months — starting in September 2014 and till February 2015.

Another problem is related to how Superfish behaves. Its ability to produce self-signed certificate possibly allows a malicious third person to intercept SSL/TLS connections or, to put it simply, web browser sessions to “https” links.

 

 

Now, let’s take a closer look at the latter problem by watching actual behaviour of Superfish.

 

Below is a screenshot of an online banking website, accessed via Internet Explorer from a clean PC without the adware. Clicking on the lock icon, it shows the information of the SSL certificate:

superfish-scr-2

Fig 1. Accessing online banking site from a clean laptop]

 

 

SSL certificate is issued by Certificate Authority (CA) to ensure the ownership of the web site. In this case, VeriSign is the certificate issuer who guarantees the identity of “Japan xxxx BANK Co,Ltd.” The certificate is also used to encrypt a user ID or a password on an encrypted session. Safety of a connection is guaranteed in this way.

Next screenshot is of the same web site. But this time it is accessed via Internet Explorer from a Superfish-infected PC. Its SSL certificate now shows “Superfish” as its issuer instead of “VeriSign”.

superfish-scr-2

What is the cause of this change, then? Superfish has its own CA on its software. This makes it possible to hijack user’s web session, generate a self-signed certificate, and establish SSL connection using it. Unfortunately, web browsers treat the Superfish-generated certificate as legitimate. So, the CA is now Superfish, not VeriSign.

</strong> <strong>The worst possible scenario is a data theft from a web session with an online banking site

In addition, a private key for generating a certificate is included in the software and available to anyone who wants it. The password of the key has been revealed on the Internet. With the key-password pair, someone with malicious intent possibly eavesdrop the data transmitted through encrypted connection or inject malicious code in it. The worst possible scenario in this case is a data theft from a web session with an online banking site.

Users of Lenovo laptop with Superfish are strongly recommended to delete both a software named “Superfish Inc. Visual Discovery” (from Windows Control Panel) and Superfish’s certificate (from the list of Trusted Root Certification Authorities).

Kaspersky products can help you specify, if you laptop is affected: our product detects the adware as Not-a-virus:AdWare.Win32.Superfish.b.

 

Fig 2. Accessing online banking site from an infected laptop.

Fig 2. Accessing online banking site from an infected laptop.

Lenovo is offering Automatic Removal Tool for Superfish in their Security Advisory (LEN-2015-101)

Tips
Sign up to receive our headlines in your inbox
  • For all other countries