Facebook warns of new Superfish threat

Hackers are easily able to extract the fake security certificate used by Superfish to make their malware even more dangerous, Facebook has warned.

Superfish, the adware program that came pre-installed on Lenovo machines, used a self-signed security certificate, known as a Certificate Authority (CA), to impersonate any SSL-enabled website.

That means it could trick a user's computer into connecting with a website by offering up its own, insecure CA, rather than the website's own, which a computer must receive to confirm the website is what it claims to be.

Known as a man-in-the-middle attack, this undermines the security of web browsers and operating systems, because it can see all of a computer user's actions, including banking, email and Facebook activity.

Lenovo was quick to state it didn't profile or monitor user behaviour, or record user information, and has now stopped shipping devices with the adware pre-installed.

However, Facebook security researcher Matt Richard warned other threat actors could re-use the Superfish CA on their own applications.

He wrote: "By reusing the same certificate, a bad actor could potentially obtain that CA file and perform "man-in-the-middle" (MITM) attacks on untrusted networks like public Wi-Fi, set up authentic-looking phishing pages, or sign software that makes people vulnerable to other malicious code as they browse the internet.

"In this case, the certificate used by the Superfish software is relatively easy to extract. Although we are not aware of anyone abusing this certificate in the wild, it's a real risk and would be hard to detect."

He said the social network has found more than 12 other software applications using the same fake certificate program as Superfish.

While Facebook is yet to determine the purpose of these applications, some of which appear to be Superfish-esque adware, he said a number of them are suspicious.

"What all of these applications have in common is that they make people less secure through their use of an easily obtained root CA, they provide little information about the risks of the technology, and in some cases they are difficult to remove," Richard added.

These applications are also unlikely to keep up with updates to the secure browser HTTPS protocol, meaning there's a risk they could expose private data to network attackers.

Superfish's fake CA comes from a company called Komodia, and Facebook found a Trojan horse, known as Trojan.Nurjax, using the Komodia's libraries of software development kits.