Probably you have heard about the Lenovo debacle, many of their laptop series are preloaded adware/spyware Superfish (you can also call Superfish a dirty piece of malware) that will intercept all your secure connections and this will allow criminals to do it too. Superfish uses an “SSL hijacker” (Komodia Redirector with SSL Digestor) and an untrustworthy Komodia root certificate. Komodia Redirector with SSL Digestor installs non-unique root CA certificates and private keys, making systems broadly vulnerable to HTTPS spoofing. In this way an attacker can spoof HTTPS sites and intercept HTTPS traffic without triggering browser certificate warnings in affected systems.
Many other softwares do similar because Komodia sold its malicious kit to other companies as well, some of these companies/vendors are e.g. Atom Security, Inc, Infoweise, KeepMyFamilySecure, Kurupira, Lavasoft, Qustodio and Websecure Ltd. There will be others as well.
Superfish removal can be done via Windows standard add/remove programs utility, find Superfish Inc VisualDiscovery, tick it, and click uninstall. Uninstalling Superfish and other Komodia-type programs does not remove the root certificates, so you need to do this: type certmgr.msc into the Windows search box, right click on the programs name, and select “run as administrator” from the pop-up menu. Subsequent click the action menu item and select “find certificates”. Type Superfish etc into the search box and click the “find now” button. If you find an unwanted certificate, right-click and select delete.
Fwiw never download from unsafe places such as CNet’s Download.com or from Google search ads, downloading software from such places can be really dangerous, in many cases the downloaded software can and will be contaminated with adware, spyware and/or malware.
There’s a simple way to check your machine on the existence of Superfish, Komodia, PrivDog & Co, we advise you to visit the filippo vulnerability test page and perform the vulnerability test: https://filippo.io/Badfish/ Important: do the test with all browsers installed.
Instructions for identifying and removing a root certificate from Windows here: http://windows.microsoft.com/en-us/windows-vista/view-or-manage-your-certificates
Finally we know that many AV (antivirus) products will find and remove the Superfish, Komodia, PrivDog and similar crap, despite we still strongly advise to perform the filippo vulnerability test and to check your machine also on the existence of untrustworthy certificates.
March 1, 2015 Posted by Smokey | Uncategorized | advisory, adware, browser certificate warnings, CA certificates, certmgr.msc, filippo vulnerability test, hhttps sites, Komodia, Malware, private keys, PrivDog, redirector, removing root certificate, spoofing, spyware, SSL Digestor, SSL hijacker, Superfish, Superfish removal, traffic, unsafe download places, untrustworthy root certificate | Leave a comment
Text from the song Spark by Amy Macdonald
I am the light in the dark
I am the march
I am the spark
Just dry your tears and I’ll be there
Don’t live for anger all this pain
Don’t worry, I’m ok, I’m ok now
Always in our hearts – R.I.P. Donna Buenaventura
Welcome to Smokey’s Security Weblog!
Let’s introduce myself: my (nick)name is Smokey aka Smokey Bear.
Like my board Smokey’s Security Forums, this blog is mainly devoted to Security and all related issues. However, other issues like e.g. major occurances on my forum and social topics will be blogged too.
My board offer free security and malware related Support, Help, Advice and Education forums, however is not limited to such issues. Smokey’s have also forums with comprehensive Microsoft Windows related issues like Microsoft and Windows OS Based Products News, MS Download Center, MSDN Developer Information, software reviews, browser and tools forums, Webware, Social Networks info, Hardware- and Gadgets forums and last but not least a dedicated Windows Drivers, Linux Drivers, Firmware and BIOS Survey & Updates section containing (recently) released Drivers, Firmware and BIOSses, Windows 7 releases included. Note: most info on Smokey’s is real-time and therefore always up-to-date.
As extra service we have a OTL (formerly OTListIt2) Log Analyzing and Malware Removal/Cleaning Help Forum, full qualified OTL Log Analysers/Malware Hunters will be pleased to help you for free to clean your malware infected PC.
Smokey’s host and maintain the Official Jetico Inc. Support Forums, including the following products:
– Jetico Personal Firewall V1
– Jetico Personal Firewall V2
– Jetico BestCrypt for Windows
– Jetico BestCrypt for Linux
– Jetico BestCrypt for Mac
– Jetico BestCrypt Volume Encryption
– Jetico BCArchive
– Jetico BCWipe for Windows
– Jetico BCWipe for UNIX
Disclaimer: information in this blog can be based on (not confirmed) statements of (anonymous) sources, Smokey’s Security Weblog don’t take any responsabilty for the credibility of these sources and their statements. Also, statements and opinions expressed in articles, reviews and other materials herein, reproduced by me, are those of the authors.
The posts/articles in this blog can be supplemented with so called “Possibly related posts” links. Because these links are automatically generated by WordPress.com, Smokey’s Security Weblog have no influence on the links itself and/or content of them. Therefore this Weblog don’t take any responsability for these links and all related issues.
About Copyright and this Blog: it is allowed to reproduce (parts of) posts in this blog if this reproduction is provided with a direct link to the original blog post. It is NOT allowed to copy, use and/or reproduce any image or blog banner.
Blog comments policy: to restrain indecent and off-topic comments and spam, comments are reviewed before publishing. Therefore, delay in comment publishing is unavoidable. Obligatory language of comments is English.
My main task
* Smokey’s Choice Awards *
** Smokey’s Hall of Shame **
Recommended: Free network protection with OpenDNS
Recommended: F-Secure PC Health Check
Recommended: Dr.Web CureIt! Free Malware Scan
Recommended: Kaspersky Online Antivirus Scan
Recommended: Online Safe Password Generator
Weblog Top Posts
- How to enable LTE/4G on Samsung Galaxy Note 3 (SM-N9005)
- How to recover a really dead Windows XP (SP2/SP3) TCP/IP stack
- Review Updated 2015 MateGo MG380G Full HD - SONY CMOS sensor - built-in-GPS Dashcam Car DVR
- Warning: NOT the real VirusTotal.com - don't fall for scam!!
- Windows Vista / USB device detection problems: How-To-Fix
Weblog Top Clicks
- shilpa on How to enable LTE/4G on Samsung Galaxy Note 3 (SM-N9005)
- Aravind on How to enable LTE/4G on Samsung Galaxy Note 3 (SM-N9005)
- Rajiv Bhalla on How to enable LTE/4G on Samsung Galaxy Note 3 (SM-N9005)
- POOJA AGARWAL on How to enable LTE/4G on Samsung Galaxy Note 3 (SM-N9005)
- Antony on Review Updated 2015 MateGo MG380G Full HD – SONY CMOS sensor – built-in-GPS Dashcam Car DVR
- January 2016 (1)
- October 2015 (1)
- June 2015 (1)
- May 2015 (1)
- March 2015 (2)
- June 2014 (1)
- May 2014 (1)
- April 2014 (1)
- March 2014 (1)
- August 2013 (1)
- May 2013 (1)
- January 2013 (4)
- December 2012 (1)
- August 2012 (1)
- July 2012 (1)
- June 2012 (1)
- February 2012 (2)
- December 2011 (2)
- October 2011 (2)
- May 2011 (3)
- April 2011 (2)
- December 2010 (5)
- September 2010 (1)
- August 2010 (2)
- July 2010 (1)
- June 2010 (1)
- May 2010 (1)
- April 2010 (2)
- March 2010 (2)
- February 2010 (2)
- January 2010 (3)
- December 2009 (7)
- November 2009 (5)
- October 2009 (2)
- September 2009 (1)
- August 2009 (3)
- July 2009 (3)
- June 2009 (2)
- May 2009 (10)
- April 2009 (6)
- March 2009 (2)
- February 2009 (3)
- January 2009 (7)
- December 2008 (14)
- November 2008 (13)
- October 2008 (8)
- September 2008 (7)
- August 2008 (12)
- July 2008 (14)
- June 2008 (13)
- May 2008 (10)
- April 2008 (31)
- March 2008 (21)
Smokey’s is Friend of WOT – Web of Trust
Keywords Smokey's Security Weblog
Smokey’s Weblog Google FeedBurner
Smokey’s Weblog Email Subscription Request
Add Smokey’s Weblog to your Technorati Favorites
- GFI OneGuard (Beta) introduces a new view on system administration December 6, 2016
- GFI OneConnect Beta brings advanced protection and email continuity November 15, 2016
- Great improvements for even greater GFI Support October 6, 2016
- GFI Prime Brings More Value to Customers by Providing Additional Products and Value for Free September 1, 2016
- WMF Vulnerability checker January 2, 2006
- Updated version of Ilfak Guilfanov’s WMF patch January 1, 2006
- WMF files that currently bypass all detections January 1, 2006
- New WMF exploit confirmed in spam attacks January 1, 2006
- What’s with all the bandwidth? Ah — silly putty! December 31, 2005
- Computer History Museum assembling histories of companies December 31, 2005
- An error has occurred; the feed is probably down. Try again later.
Giveaway of the Day: commercial software for FREE
Advertisement: Link Logger from Binary Visons
Your IP and location
Blog Visitor Statistics
Site infoSmokey's Security Weblog
Blog at WordPress.com.