# MA-455.022015: MyCERT Alert - Lenovo â€œSuperfishâ€ Adware Vulnerable to HTTPS Spoofing

**Date:** 23 Feb 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-455.022015  
**Advisory ID:** MA-455.022015

---

#### **1.0 Introduction**
MyCERT have received information and made aware that Lenovo consumer Notebooks are vulnerable to the HTTPS spoofing. The “Superfish” adware can enable remote attackers to read encrypted web traffic, redirect traffic from official websites to spoof websites, and perform other malicious activities.
Superfish is an adware type of application pre-installed on Lenovo consumer notebooks. It is a Visual Discovery software which is setting itself up as a proxy so that all of user web traffic runs through the software. Lenovo uses Superfish to place adverts into Google search results based on what user search keywords result.
**2.0 Affected Systems**
Lenovo consumer notebooks that have Superfish VisualDiscovery installed.
According to Lenovo, ThinkPad, Think Centre, Lenovo Desktop, ThinkStation and System X products are not affected.
**3.0 Impact**
Lenovo consumer notebooks with Superfish VisualDiscovery installed will be vulnerable to SSL spoofing attacks without a warning from the browser. This means websites, such as banking and email, can be spoofed and lead to Man in the Middle attack (MITM).
**4.0 Detection and Removal4.1 Detection**
Users may check if their laptop is vulnerable to the Superfish vulnerability at the below Superfish Checker:
LastPass Superfish Checker:
[www.LastPass.com/superfish](https://lastpass.com/superfish/)
**4.2 Removal**
1. 1. First user need to uninstall Superfish software from Lenovo computer.
2. Uninstalling the Superfish software does not remove the certificate. Thus, to remove the certificate use the following step:
1. Run **mmc.exe**
2. Goto **File** > **Add/remove Snap-in**
3. Select **Certificates**, click **Add**
4. Select **Computer Account**, click **Next**
5. Select **Local Computer**, click **Finish**
6. Click **OK**.
7. Look into **Trusted Root Certification Authorities** tree and select **Certificates**.
8. Find the one issued to **Superfish** and delete it.
**NOTE:** Chrome and Internet Explorer are using operating system  trusted root store. To remove certificate on Mozilla Firefox use the next step:
1. 1. Remove Trusted CA from Firefox Trusted Store:
1. Open **Mozilla Firefox**
2. Click the menu button and choose **Preferences** (or Shortcut key ALT+T+O)
3. Click the **Advanced** tab.
4. Then click **Certificates** tab.
5. Under the **Authorities** tab check for the **Superfish Inc** certificate.
6. If it is exist, click on the certificate and then click **Delete**.
7. Click **OK** to confirm the deletion.
**5.0 Preventions**
1. Uninstall any existence of Superfish software.
2. Remove Superfish certificate.
3. Install an Anti-virus software in their computers and keep it up to date with latest signatures. Perform regular scan of your systems for the maware detection and other security risks.
4. Users must not click unsolicited web links and attachments in email messages.
5. Users must always keep their browsers updated with latest patches.
6. Operating  system providers such as Microsoft, periodically releases updates and patches that improves the security of your operating system. You should periodically check for these updates and keep your system up to date or configure it to do so automatically.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**6.0 References**
6.1. <http://news.lenovo.com/article_display.cfm?article_id=1929>
6.2. <http://www.kb.cert.org/vuls/id/529496>
6.3. <https://www.us-cert.gov/ncas/alerts/TA15-051A>
6.4  <http://support.lenovo.com/us/en/product_security/superfish>
6.5  <http://support.lenovo.com/us/en/product_security/superfish_uninstall>