Facebook warns of new Superfish threat

The fake security certificate used by the Lenovo-installed adware can be re-used by hackers, says social network

Hackers

Hackers are easily able to extract the fake security certificate used by Superfish to make their malware even more dangerous, Facebook has warned.

Superfish, the adware program that came pre-installed on Lenovo machines, used a self-signed security certificate, known as a Certificate Authority (CA), to impersonate any SSL-enabled website.

That means it could trick a user's computer into connecting with a website by offering up its own, insecure CA, rather than the website's own, which a computer must receive to confirm the website is what it claims to be.

Known as a man-in-the-middle attack, this undermines the security of web browsers and operating systems, because it can see all of a computer user's actions, including banking, email and Facebook activity.

Lenovo was quick to state it didn't profile or monitor user behaviour, or record user information, and has now stopped shipping devices with the adware pre-installed.

However, Facebook security researcher Matt Richard warned other threat actors could re-use the Superfish CA on their own applications.

He wrote: "By reusing the same certificate, a bad actor could potentially obtain that CA file and perform "man-in-the-middle" (MITM) attacks on untrusted networks like public Wi-Fi, set up authentic-looking phishing pages, or sign software that makes people vulnerable to other malicious code as they browse the internet.

"In this case, the certificate used by the Superfish software is relatively easy to extract. Although we are not aware of anyone abusing this certificate in the wild, it's a real risk and would be hard to detect."

He said the social network has found more than 12 other software applications using the same fake certificate program as Superfish.

While Facebook is yet to determine the purpose of these applications, some of which appear to be Superfish-esque adware, he said a number of them are suspicious.

"What all of these applications have in common is that they make people less secure through their use of an easily obtained root CA, they provide little information about the risks of the technology, and in some cases they are difficult to remove," Richard added.

These applications are also unlikely to keep up with updates to the secure browser HTTPS protocol, meaning there's a risk they could expose private data to network attackers.

Superfish's fake CA comes from a company called Komodia, and Facebook found a Trojan horse, known as Trojan.Nurjax, using the Komodia's libraries of software development kits.

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

Google, Facebook fined €210 million for making it difficult for users to reject cookies
Policy & legislation

Google, Facebook fined €210 million for making it difficult for users to reject cookies

6 Jan 2022
The IT Pro Products of the Year 2021: The year’s best hardware and software
Hardware

The IT Pro Products of the Year 2021: The year’s best hardware and software

31 Dec 2021
Lenovo ThinkPads vulnerable to privilege escalation exploit, researchers warn
exploits

Lenovo ThinkPads vulnerable to privilege escalation exploit, researchers warn

17 Dec 2021
Lenovo Tab P11 Pro review: A superb Android tablet with a convenient keyboard case
tablets

Lenovo Tab P11 Pro review: A superb Android tablet with a convenient keyboard case

13 Dec 2021

Most Popular

Sony pulls out of MWC 2022
Business operations

Sony pulls out of MWC 2022

14 Jan 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

6 Jan 2022
Dell XPS 15 (2021) review: The best just got better
Laptops

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022