Facebook warns of new Superfish threat

The fake security certificate used by the Lenovo-installed adware can be re-used by hackers, says social network


Hackers are easily able to extract the fake security certificate used by Superfish to make their malware even more dangerous, Facebook has warned.

Superfish, the adware program that came pre-installed on Lenovo machines, used a self-signed security certificate, known as a Certificate Authority (CA), to impersonate any SSL-enabled website.

Advertisement - Article continues below

That means it could trick a user's computer into connecting with a website by offering up its own, insecure CA, rather than the website's own, which a computer must receive to confirm the website is what it claims to be.

Known as a man-in-the-middle attack, this undermines the security of web browsers and operating systems, because it can see all of a computer user's actions, including banking, email and Facebook activity.

Lenovo was quick to state it didn't profile or monitor user behaviour, or record user information, and has now stopped shipping devices with the adware pre-installed.

However, Facebook security researcher Matt Richard warned other threat actors could re-use the Superfish CA on their own applications.

He wrote: "By reusing the same certificate, a bad actor could potentially obtain that CA file and perform "man-in-the-middle" (MITM) attacks on untrusted networks like public Wi-Fi, set up authentic-looking phishing pages, or sign software that makes people vulnerable to other malicious code as they browse the internet.

Advertisement - Article continues below
Advertisement - Article continues below

"In this case, the certificate used by the Superfish software is relatively easy to extract. Although we are not aware of anyone abusing this certificate in the wild, it's a real risk and would be hard to detect."

He said the social network has found more than 12 other software applications using the same fake certificate program as Superfish.

While Facebook is yet to determine the purpose of these applications, some of which appear to be Superfish-esque adware, he said a number of them are suspicious.

"What all of these applications have in common is that they make people less secure through their use of an easily obtained root CA, they provide little information about the risks of the technology, and in some cases they are difficult to remove," Richard added.

These applications are also unlikely to keep up with updates to the secure browser HTTPS protocol, meaning there's a risk they could expose private data to network attackers.

Superfish's fake CA comes from a company called Komodia, and Facebook found a Trojan horse, known as Trojan.Nurjax, using the Komodia's libraries of software development kits.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now


Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
social media

Stop Hate for Profit calls on Facebook to address hate on the platform

6 Jul 2020

Facebook flaw gave 5,000 developers access to users' data

2 Jul 2020
social media

Facebook bans “violent” boogaloo network

1 Jul 2020

Most Popular

Business operations

Nvidia overtakes Intel as most valuable US chipmaker

9 Jul 2020

How to find RAM speed, size and type

24 Jun 2020
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020