Mozilla Pushes Hot Fix to Remove Superfish Cert From Firefox

Mozilla has issued a hot fix for Firefox that removes the Superfish root certificate from the browser’s trusted root store. The patch only removes the certificate if the Superfish software has been removed from the machine already, however. The Superfish adware performs SSL interception–essential...

Dennis Fisher and Mike Mimoso Discuss the Week in News: Superfish, Gemalto and NSA

Mike Mimoso and Dennis Fisher discuss the news of the last week, including the Superfish fiasco, the Gemalto SIM hack controversy and the continuing NSA drama. Download: digitalunderground187.mp3 Music by Chris Gonsalves...

Komodia Certificate Manipulation Enabled Man-In-The-Middle Attacks

The shoddy state of SSL certificate validation on the Internet again floated to the surface, this time by the Superfish mess, which continues to get worse. The Electronic Frontier Foundation on Wednesday released a report based on data scoured from the Decentralized SSL Observatory which it...

Lenovo Website has been Hacked

Lenovo.com, the official website of world's largest PC maker has been hacked. At the time of writing, users visiting Lenovo.com website saw a teenager's slideshow and hacker also added song "Breaking Free" from High School Musical movie to the page background. It appears that Lizard Squad hacking...

Design/Logic Flaw

The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker alpha 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across...

CVE-2015-2077

The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker alpha 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across...

CVE-2015-2077

CVE-2015-2077 concerns the Komodia Redirector with SSL Digestor SDK, used in multiple products (e.g., Lavasoft Ad-Aware Web Companion, Ad-Aware AdBlocker alpha, Qustodio for Windows, StaffCop 5.8). The root cause is reuse of the same X.509 certificate private key for a root CA across different cu...

CVE-2015-2077

The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker alpha 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across...

PrivDog Poses Bigger Risk Than Superfish

Update Move over Superfish. Another piece of software has been thrust into the spotlight that also breaks HTTPS connections, but is arguably worse than Superfish, which was pre-installed adware on new Lenovo laptops manufactured at the tail end of 2014. Researcher Hanno Bock yesterday reported th...

KLA10461 Security bypass vulnerability in multiple products

Using of the same certificate was found in multiple products. By exploiting this vulnerability malicious users bypass security restrictions. This vulnerability can be exploited remotely via a man-in-the-middle attack. Original advisories - Related products VisualDiscovery CVE list CVE-2015-2077...

Komodia Website Under DDoS Attack

Komodia.com, home to the SSL interception module at the heart of the Superfish adware dustup, is currently under a distributed denial-of-service attack. As of 2 p.m. Eastern time, its home page had been replaced with a notice that the site was offline because it was under attack. “Some people say...

Superfish-like Vulnerability Found in Over 12 More Apps

'SuperFish' advertising software recently found pre-installed on Lenovo laptops is more widespread than what we all thought. Facebook has discovered at least 12 more titles using the same HTTPS-breaking technology that gave the Superfish malware capability to evade rogue certificate. The Superfis...

Lenovo Admits and Released an Automatic Superfish Removal Tool

The computer giant Lenovo has released a tool to remove the dangerous "SuperFish" adware program that the company had pre-installed onto many of its consumer-grade Lenovo laptops sold before January 2015. The Superfish removal tool comes few days after the story broke about the nasty Superfish...

Lenovo Computers Vulnerable to HTTPS Spoofing

Lenovo consumer personal computers employing the pre-installed Superfish VisualDiscovery software contain a critical vulnerability through a compromised root CA certificate. Exploitation of this vulnerability could allow a remote attacker to read all encrypted web browser traffic HTTPS,...

SuperFish Adware Root Certificate

SuperFish Adware is a software that uses SSL man-in-the-middle MitM technique in order to intercept SSL sessions and inject its own content into the session. Successful exploitation might result in disclosure of confidential or private information passed over the SSL channel, or in such informati...

Lenovo Superfish Certificate Password Cracked

Lenovo laptop owners are at risk for man-in-the-middle attacks as a vulnerability disclosed in pre-installed Superfish adware went nuclear this morning. Researcher Rob Graham of Errata Security published a report in which he said he cracked the password protecting the digital certificate shipped...

Lenovo Shipping PCs with Pre-Installed 'Superfish Malware' that Kills HTTPS

One of the most popular computer manufacturers Lenovo is being criticized for selling laptops pre-installed with invasive marketing software, or malware that, experts say, opens up a door for hackers and cyber crooks. The software, dubbed ‘Superfish Malware’, analyzes users’ Internet habits and...

Superfish 7.x-1.9 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Superfish 7.x-1.9 Cross Site Scripting Vulnerability ==================================================== Author: Ubani A Balogun Reported: June 25, 2014 Product Description: - -------------------- Superfish integrates jQuery Superfish plugin with you...