Monthly Archives: February 2015

US-CERT

Lenovo Computers Vulnerable to HTTPS Spoofing

Original release date: February 20, 2015

Lenovo consumer personal computers employing the pre-installed Superfish Visual Discovery software contain a critical vulnerability through a compromised root CA certificate. Exploitation of this vulnerability could allow a remote attacker to read all encrypted web browser traffic (HTTPS), successfully impersonate (spoof) any website, or perform other attacks on the affected system.

US-CERT recommends users and administrators review Vulnerability Note VU#529496 and US-CERT Alert TA15-051A for additional information and mitigation details.

This product is provided subject to this Notification and this Privacy & Use policy.

AVG

The Internet of Things Made Simple

The Internet of Things is one of the hottest terms in the technology industry. It seems that hardly a week goes by without hearing about our connected world or the Internet of Things.

So what does the Internet of Things really mean and how can we explain it in a way that everyone can understand?

I was recently asked how I would explain the Internet of Things to a five year old and I came up with the following:

 

We all like to talk to our family and friends, our electronic devices (TVs, tablets, cameras) like to speak to each other too. They speak a different language – their own computer language, called the Internet of Things.

Just like when your parents ask you to tidy your room, or you ask them for help with your homework, our devices speak to each other to solve problems and get things done.

For example, if a bad guy came in to steal your toys, the burglar alarm would tell the police to come over and stop them, or the smoke detector could call the fire engine if there was a fire at home.

By talking to each other through the Internet of Things, our computers work together as a team to help us – just like we help our families and friends.”

 

While this is of course simplistic, it is the fundamental function of the Internet of Things, our connected devices sharing information over the Internet.

What kind of connected devices are we talking about? The Internet of Things is made up of all sorts of connected devices including:

  • Smartphones
  • Televisions
  • Alarm Systems
  • Fitness Trackers
  • Games Consoles

Any Internet connected device has the potential to be part of the Internet of Things, all that is required is that they connect and communicate with each other in order to fulfil a wider function.

If you’d like more information on the Internet of Things and the challenges that it presents, read my recent blog on Privacy and The Internet of Things.

US-CERT

TA15-051A: Lenovo Superfish Adware Vulnerable to HTTPS Spoofing

Original release date: February 20, 2015

Systems Affected

Lenovo consumer PCs that have Superfish VisualDiscovery installed and potentially others.

Overview

Superfish adware installed on some Lenovo PCs install a non-unique trusted root certification authority (CA) certificate, allowing an attacker to spoof HTTPS traffic.

Description

Starting in September 2014, Lenovo pre-installed Superfish VisualDiscovery spyware on some of their PCs.  However, Superfish was reportedly bundled with other applications as early as 2010. This software intercepts users’ web traffic to provide targeted advertisements.  In order to intercept encrypted connections (those using HTTPS), the software installs a trusted root CA certificate for Superfish. All browser-based encrypted traffic to the Internet is intercepted, decrypted, and re-encrypted to the user’s browser by the application – a classic man-in-the-middle attack.  Because the certificates used by Superfish are signed by the CA installed by the software, the browser will not display any warnings that the traffic is being tampered with.  Since the private key can easily be recovered from the Superfish software, an attacker can generate a certificate for any website that will be trusted by a system with the Superfish software installed.  This means websites, such as banking and email, can be spoofed without a warning from the browser.

Although Lenovo has stated they have discontinued the practice of pre-installing Superfish VisualDiscovery, the systems that came with the software already installed will continue to be vulnerable until corrective actions have been taken.

The underlying SSL decryption library from Komodia has been found to be present on other applications, including KeepMyFamilySecure. Please refer to CERT Vulnerability Note VU#529496 for more details and updates.

To detect a system with Superfish installed, look for a HTTP GET request to:

superfish.aistcdn.com

The full request will look like:

http://superfish.aistcdn.com/set.php?ID=[GUID]&Action=[ACTION]

Where [ACTION] is at least 1, 2, or 3.  1 and then 2 are sent when a computer is turned on. 3 is sent when a computer is turned off.

Impact

A machine with Superfish VisualDiscovery installed will be vulnerable to SSL spoofing attacks without a warning from the browser.

Solution

Uninstall Superfish VisualDiscovery and associated root CA certificate

Uninstall any software that includes the Komodia Redirector and SSL Digestor libraries. In the case of Lenovo PCs, this includes Superfish VisualDiscovery.

It is also necessary to remove affected root CA certificates. Simply uninstalling the software does not remove the certificate. Microsoft provides guidance on deleting and managing certificates in the Windows certificate store. In the case of Superfish VisualDiscovery, the offending trusted root certification authority certificate is issued to “Superfish, Inc.”

Mozilla provides similar guidance for their software, including the Firefox and Thunderbird certificate stores.

References

Revision History

  • February 20, 2015: Initial release
  • February 20, 2015: Clarified software release dates

This product is provided subject to this Notification and this Privacy & Use policy.

NVD

CVE-2014-5355 (kerberos)

MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a ” character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the ” character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.