The statement, e-mailed to Ars by a Superfish spokeswoman and attributed to company CEO Adi Pinhas, is notable for making no reference to secure sockets layer, transport layer security, HTTPS, or any other form of encryption. Those technologies are at the core of security researchers' criticisms. They say the self-signed certificates, registered to Superfish and installed in the root level of every PC's SSL/TLS folder, makes it easy for malicious hackers and even script kiddies to build websites that trick affected browsers into behaving as if they're connected to servers for Bank of America, Google, or any other HTTPS-protected website on the Internet. In fact, there's near-universal agreement about this. Earlier today, the US CERT joined the growing chorus of critics with an advisory headlined "Lenovo Computers Vulnerable to HTTPS Spoofing."
Update: It turns out the vulnerability is easier to exploit than previously known. As this post was being prepared, a security researcher published new findings showing that a malicious hacker doesn't need the easily-extracted Superfish private key to perform a man-in-the-middle attack on PCs that have the Komodia proxy installed. That's because the proxy will re-sign invalid certs and make them appear valid to the browser.
Despite all of this, Pinhas's statement doesn't address the criticism. Instead, it attacks an argument that no one has made—that Superfish somehow shares personal information without users' permission. Here is the statement in full:
Superfish Statement from CEO
There has been significant misinformation circulating about Superfish software that was pre-installed on certain Lenovo laptops. The software shipped on a limited number of computers in 2014 in an effort to enhance the online shopping experience for Lenovo customers. Superfish's software utilizes visual search technology to help users achieve more relevant search results based on images of products they have browsed.
Despite the false and misleading statements made by some media commentators and bloggers, the Superfish software does not present a security risk. In no way does Superfish store personal data or share such data with anyone. Unfortunately, in this situation a vulnerability was introduced unintentionally by a 3rd party. Both Lenovo and Superfish did extensive testing of the solution but this issue wasn't identified before some laptops shipped. Fortunately, our partnership with Lenovo was limited in scale. We were able to address the issue quickly. The software was disabled on the server side (i.e., Superfish's search engine) in January 2015.
Superfish takes great pride in the quality of its software, the transparency of its business practices, and its strong relationship with the Superfish user community. Superfish's visual search technology enables millions of people to explore and learn about the world in an engaging and highly intuitive manner. A positive user experience has been the cornerstone of Superfish's success.
The Superfish spokeswoman didn't respond to an e-mail from Ars requesting an interview with the CEO.
It's hard to fathom how a technology company versed in the inner workings of HTTPS can continue to say that the implementation of Superfish that was installed on an undisclosed number of Lenovo laptops posed no security threat. The certificate that makes the security vulnerability possible clearly carries the Superfish name, was installed as part of the Superfish software, and was produced in collaboration with Komodia, a company Superfish has acknowledged it hired to work on the Lenovo implementation. It's possible the oblique reference to a vulnerability from a third party gave Superfish officials the wiggle room they thought would insulate them. But all it's really doing is making it clear that Pinhas has trouble owning up to the decisions made by his own company.
That's too bad. The CEO had a chance to regain the trust of some people by providing a detailed autopsy that explained how software with his company's name on it put so many Lenovo users at risk. This missed opportunity may make it impossible for him to repair the damage now.
No comments:
Post a Comment