Story

Assurances on the demise of the dangerous adware are (somewhat) exaggerated.

Mozilla has issued a hot fix for Firefox that removes the Superfish root certificate from the browser's trusted root store. The patch only removes the certificate if the Superfish software has been removed from the machine already, however.

Report suggests Lenovo can be bought for peanuts as Mozilla kills dirty cert Lenovo bagged a paltry US$250,000 from the deal that saw it install the Superfish certificate slurper onto PCs, according to reports.…

Lenovo-Rechner sollen künftig nur noch mit den nötigsten Programmen ausgeliefert werden, verspricht der Hersteller. In der auf einigen Laptops vorinstallierten Adware Superfish wurde zuvor eine schwere Sicherheitslücke entdeckt.

After its security disaster, company promises "cleaner, safer PCs."

Certificate flaws spotted in variety of important sites The Electronic Frontier Foundation (EFF) says it has found evidence that the security problems with Superfish could be much worse than first thought.…

Anthony has a new Lenovo laptop and wonders if he should be concerned. Jack Schofield says that’s the tip of the iceberg and everyone should be worried.When I started working abroad about three months ago, my company provided me with a new Lenovo laptop. Should I be worried? AnthonyEveryone should be worried, but not for the obvious reason.

Crypto-busting apps may have been exploited against visitors of Google and dozens more.

Valuable Lenovo.com is hijacked, allowing attackers to intercept Lenovo email.

But it gets worse. Filippo Valsorda has shown that you didn't even need to crack Komodia's weak password to launch a man-in-the-middle attack, but its SSL validation is broken, such that even if Komodia's proxy client sees an invalid certificate, it just makes it valid. Seriously.

Reg reader up in arms about bundled bloatware As Lenovo struggles to extricate itself from the controversy surrounding pre-installed Superfish scumware on its machines, a blast of cruft from the past may give the PC slinger's critics extra ammo this week.…

Die Affäre um gefährliche CA-Zertifikate weitet sich aus; nunmehr sind mehr als ein Dutzend Anwendungen bekannt, die Computer anfällig für Man-in-the-Middle-Angriffe machen. Ausgangspunkt: Die SSL-Unterbrechungs-Technologie SSL Digestor von Komodia.

Don't Panic, says malware-pusher, Superfish never swam on our servers or arrays Lenovo's chief technology officer Peter Hortensius has issued another statement on how the company plans to handle Superfish.…

At least one lawsuit has been filed and one investigation has begun.

CTO pledges new policy to prevent similar mishaps in the future.

Should be open and shut (laptop) case A California woman has filed the first lawsuit against Lenovo and Superfish over the pair's adware debacle, claiming the "malware" injected smutty pictures into her web browser on her Yoga laptop.…

Komodia’s SSL hijacking package that could leave users open to security breach discovered in other software besides Lenovo-bundled adware

While Lenovo now scrambles into Damage Control mode in the wake of the Superfish scandal, the question for our readers is: how will this affect Lenovo's ability to sell to the U.S. Federal supercomputing market?

Cert-jacking 'Komodia' library looks to be widespread Facebook security researcher Matt Richard says The Social Network has found at least ten more outfits using the library that gave the Superfish bloat/ad/malware its nasty certificate-evading powers.…

Titles from security firms Lavasoft and Comodo leave users open to easier attacks.

Green-lighted blacklist of compromised certs could be ready in a day Firefox-maker Mozilla may neuter the likes of Superfish by blacklisting dangerous root certificates revealed less than a week ago to be used in Lenovo laptops.…

Chinese vendor belatedly tools up against ad-scumware A bruised Lenovo has released a removal tool for the Superfish vuln that hijacks web browsers to inject ads into pages.…

Der Windows Defender erkennt die Adware Superfish neuerdings als schädlich. Neu ist daran aber nur die Art der Einstufung, denn als problematisch hat Microsoft Superfish bereits vor Jahren erkannt.

Rebuilding trust with Trevor, lesson 1: Be open Sysadmin blog Everyone and their dog has an opinion on the Superfish debacle which has struck once mighty Lolnovo Lenovo a potentially critical public relations blow. The Register's own Ian Thomson had little nice to say on the subject, and both social media and anecdotal experience indicate to me that his feelings are reasonably widespread.…

Lenovo liefert ein Säuberungsprogramm gegen die auf Laptops vorinstallierte Adware Superfish Visual Discovery. Jene hat im Zusammenhang mit Verschlüsselungszertifikaten für Schlagzeilen gesorgt; sie macht PCs anfällig für Man-in-the-Middle-Angriffe.

Comments

I pointed out earlier that it was fairly astounding that Superfish was basically remaining mostly quiet on the whole controversy over its software. If you've been under a rock, earlier this week, the security community pointed out how Superfish's software (installed by default on certain Lenovo laptops) created a massive security vulnerability. Superfish itself is adware, but that's the least of the problems. The software doesn't track your behavior like other adware, but instead tries to insert other buying options when you're viewing images of certain products. It tries to find the same or similar products that you can buy for less and tell you about them. I could see how that might be interesting for some people on some shopping sites if they chose to use the software. But, by being a default bloatware install on Lenovo laptops, there was no choice. Furthermore, it apparently was trying to do this on every website. And that's where the real problem came in.

Denial comes despite near-unanimous agreement that it left Lenovo users wide open.

Homeland Security puts a bullet in scumware Updated The US government's Computer Emergency Readiness Team (US-CERT) today said the Superfish ad-injecting malware installed by Lenovo on its new laptops is a "critical" threat to security.…

Lenovo wasn't the only one using SSL certs that unlock every SSL site on the Internet.

Signature update removes the dangerous certificate and the VisualDiscovery app.