Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections [Updated]

Lenovo is selling computers that come preinstalled with adware that hijacks encrypted Web sessions and may make users vulnerable to HTTPS man-in-the-middle attacks that are trivial for attackers to carry out, security researchers said.

The critical threat is present on Lenovo PCs that have adware from a company called Superfish installed. As unsavory as many people find software that injects ads into Web pages, there's something much more nefarious about the Superfish package. It installs a self-signed root HTTPS certificate that can intercept encrypted traffic for every website a user visits. When a user visits an HTTPS site, the site certificate is signed and controlled by Superfish and falsely represents itself as the official website certificate.

Even worse, the private encryption key accompanying the Superfish-signed Transport Layer Security certificate appears to be the same for every Lenovo machine. Attackers may be able to use the key to certify imposter HTTPS websites that masquerade as Bank of America, Google, or any other secure destination on the Internet. Under such a scenario, PCs that have the Superfish root certificate installed will fail to flag the sites as forgeries—a failure that completely undermines the reason HTTPS protections exist in the first place.

[Update: Rob Graham, CEO of security firm Errata Security, has cracked the cryptographic key encrypting the Superfish certificate. That means anyone can now use the private key to launch man-in-the-middle HTTPS attacks that won't be detected by machines that have the certificate installed. It took Graham just three hours to figure out that the password was "komodia" (minus the quotes). He told Ars the certificate works against Google even when an end-user is using Chrome. That confirms earlier statements that certificate pinning in the browser is not a defense against this attack (more about that below). Graham has a detailed explanation how he did it here.]

The adware and its effect on Web encryption has been discussed since at least September in Lenovo customer forum threads such as those here and here. In the latter post, dated January 21, a user showed a root certificate titled Superfish was installed:

He then went on to show how the certificate tampered with the HTTPS connection to a banking website, behavior that allowed Superfish to collect all data unencrypted.

Surprisingly, the behavior largely escaped the notice of security and privacy advocates, until now. On Wednesday evening, following several lengthy Twitter discussions about the overlooked behavior, security researcher Chris Palmer bought a Lenovo Yoga 2 Pro for $600 at a San Francisco Bay Area Best Buy store. He quickly confirmed that the model was pre-installed with the Superfish software and self-signed key.

When Palmer visited https://www.bankofamerica.com/, he found that the certificate presented to his browser wasn't signed by certificate authority VeriSign as one would expect, but rather by Superfish.

He saw the same Superfish-signed certificate misrepresenting itself when he visited other HTTPS-protected websites. In fact, there isn't a single TLS-protected website that wasn't affected.

Palmer was later able to confirm that the private key for the Superfish certificate installed on his Yoga 2 contained the same private key as a Superfish certificate installed on a different person's Lenovo PC. That means there's a good chance attackers could use the certificate to create fake HTTPS websites that wouldn't be detected by vulnerable Lenovo machines. At the time this report was being prepared, there were no reports of anyone testing and confirming the hypothesis, but several researchers agreed the scenario seemed highly likely.

No, certificate pinning won't save you

The Superfish software hijacks encrypted Web sessions no matter which browser someone uses. Worse yet, certificate pinning in Google Chrome will do nothing to alert users that something is amiss. As Google points out in a post explaining certificate pinning, the mechanism isn't set up to validate certificates chained to a private anchor, such as a root certificate installed in the operating system of the connecting device. "A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites," the Google page warned. "'Data loss prevention' appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning."

It's not known exactly which Lenovo computers come with Superfish pre-installed. A Lenovo representative said in a forum that Superfish has been uninstalled and cited "some issues (browser pop up behavior for example)" as the reason. On Twitter Wednesday evening, a Lenovo representative reiterated that the adware was removed on new machines. But as Palmer's experience demonstrated, it's still possible to buy Lenovo PCs that have it pre-installed. And it remains unclear if there's an update mechanism in place to remove it from machines that already have it installed. It's also unknown if PCs from other manufacturers come with Superfish pre-installed. Readers should be aware that even after uninstalling the Superfish adware from their machines, the Superfish root certificate will remain.

[Update: Lenovo has released a statement saying Superfish was installed on consumer laptops shipped between October and December 2014. The manufacturer said it stopped preloading Superfish in January 2015 and has no plans to resume the practice. Amazingly, the company said it did "not find any evidence to substantiate security concerns," but added that it's responding to them anyway. People who are concerned their PC may contain this critical vulnerability can check at https://filippo.io/Badfish/. The website was designed by one of the same researchers who published a site to scan websites for the catastrophic Heartbleed weakness in OpenSSL.

The company's claim that it didn't add Superfish until October is at odds with this post from June, in which a Lenovo user complains that the very same program was causing problems connecting to the Internet. Correction: The post is dated December. Ars regrets the error.]

Superfish presumably installs the root certificates so it can inject ads into encrypted Web pages. By many people's standards, that's bad. But adware that breaks HTTPS connections and may make users vulnerable to man-in-the-middle attacks that are trivial to carry out is orders of magnitude worse. Stay tuned. We'll all be hearing much more about the Superfish debacle in the days and weeks ahead.

[Update: Lenovo has released a list of models that may have had Superfish installed.

G Series: G410, G510, G710, G40-70, G50-70, G40-30, G50-30, G40-45, G50-45
U Series: U330P, U430P, U330Touch, U430Touch, U530Touch
Y Series: Y430P, Y40-70, Y50-70
Z Series: Z40-75, Z50-75, Z40-70, Z50-70
S Series: S310, S410, S40-70, S415, S415Touch, S20-30, S20-30Touch
Flex Series: Flex2 14D, Flex2 15D, Flex2 14, Flex2 15, Flex2 14(BTM), Flex2 15(BTM), Flex 10
MIIX Series: MIIX2-8, MIIX2-10, MIIX2-11
YOGA Series: YOGA2Pro-13, YOGA2-13, YOGA2-11BTM, YOGA2-11HSW
E Series: E10-30]