https://www.cnet.com/news/superfish-torments-lenovo-owners-w...
It did MITM to inject ads, including adding their cert to the trust store to MITM SSL connections.
Of course the software needed the private key to work, which they shipped to every laptop and was quickly put online.
All of the sudden banking at coffee shops on a lot of Lenovo models was no longer private.
I'm not sure if captured traffic could be retroactively decrypted, but I wouldn't doubt it. PFS support probably wasn't high on Superfish's priorities.
Not to excuse Lenovo - they fucked up big.
https://thehackernews.com/2015/09/lenovo-laptop-virus.html?m...
The firmware rootkit, to my knowledge, has never been found on ThinkPads.
Have you configured your browser(s) to "fail closed" when it comes to OCSP queries? CRL and OCSP behavior has been, well, "not ideal" since basically forever.
in the case of a starbucks, the AP itself is not necessarily secure (under a counter somewhere?) so it's possible users are connecting to a malicious AP.
the threat model depends on the level of risk: the convenience may outweigh those risks, it may not. for myself it is one of a few tasks i wouldn't engage in on a network i don't have more trust in, but in retrospect this advice was indeed probably too strong for most.
Again, what’s the threat model here? Exploiting a browser vulnerability? Maybe?
Please explain this further.
Not snark, genuinely curious.
Maybe Lenovo will include a sketchy driver, but I trust Lenovo to not use that driver to drop ransomware on my machine. In the same sense I trust Google with my location and emails. You may trust an AV company that can upload any file on your machine to not grab your tax returns and open a new credit card in your name.
Even if Lenovo starts intercepting my private web traffic or placing files on my machine there is only so much damage they can do. They are not about to frame me by dropping plans to overthrow the government in my downloads folder then blackmailing me to design more secure drivers for no pay.
There are threats I'm afraid of and a computer manufacturer, no matter how negligent, is not one of them. Is OP avoiding Intel too? Meh.
What is the threat model? They will not be using the rootkit for hiding useland malware. Are they extracting my documents and misuing them? Are they performing MITM on my connections and doing something harmful? While the capability is there, I don't see the software being used in a way that will inconvenience me.
It is a weak point in the system, maybe someone else exploits it, but I have so much software that I can say that about. When looking at threats the question for me is what is most likely to get me owned. It will probably be phishing or a malicious document. That's not going to change based on the manufacturer I buy from.
If I do get owned by some targeted malware that uses a Lenovo driver for priv esc, well they were probably going to get me with or without that. As good as it would feel to boycott a company with poor security practices, I'm over running unrefined System76 laptops.