26

I recently bought a new laptop, every https:// connection I do to any site regardless of browser chain back to a root certificate issued by "superfish, inc". I have had a dig around but I can't seem to find the origin of the certificate and at no point did I authorise adding the "superfish" root certificate to my local certificate store.

My thoughts are that it could potentially be one of the pre-packaged security applications that came with the machine generating the certificates so that it can scan https:// traffic which I am not 100% comfortable with and at no point did I authorise it. I can't seem to find an affiliation with the superfish SSL certificate and any of the scanning software so I am a bit confused.

Has anyone else come across this, know where it came from and how I can remove this so that all my https:// traffic chain to their respective correct root certificates ? - apart from plucking it straight out of MMC.

Improve this question
2
  • 7
    If the laptop is a Lenovo running Windows, superfish "shopping" adware may have come preinstalled from the factory. We have seen it on several brand new Lenovos, and it breaks some web pages because of what it injects. If so, it is fortunately reasonably easy to remove in "Programs and Features" / "Add Remove Programs". Just search the list of programs for "superfish" and uninstall it.
    – Mark Wilkins
    Dec 12, 2014 at 16:01
  • 3
    For what it's worth: I just bought and unboxed a Lenovo Ideapad Z710 two days ago (17. Feb. 2015). The pre-installed Windows was prepared on 10. Nov. 2014 (it seems). There are no signs of Superfish application or Superfish root certificates on this installation. I don't know if Lenovo has abandoned Superfish entirely as of 10. Nov. 2014 or earlier, or if only a subset of their pre-installed images includes it. Any other observations on this? Are Lenovo still shipping this junk?
    – Barfred
    Feb 19, 2015 at 14:35

2 Answers 2

Reset to default
39

FYI, this Superfish software is now a major news headline.

It is preloaded by Lenovo (there may be other vendors). You have to uninstall it, but that will not remove the certificate(s). To remove the certificate(s), you must do the following:

  1. Run mmc.exe
  2. Go to File -> Add/Remove Snap-in
  3. Pick Certificates, click Add
  4. Pick Computer Account, click Next
  5. Pick Local Computer, click Finish
  6. Click OK
  7. Look under Trusted Root Certification Authorities -> Certificates
  8. Find any certificates issued to Superfish or Visual Discovery and delete them.
  9. Also check under Intermediate Certification Authorities -> Certificate

Note that if you have Firefox installed, you will have to clean up its certificate store as well (the above links are for IE/Chrome). See here: http://support.lenovo.com/us/en/product_security/superfish_uninstall

If you are really paranoid, the best solution would be to reformat your laptop and install Windows with Microsoft media, not the factory recovery tools.

Note that people are already attacking the Superfish certificate, so don't be surprised if you start to see malware that uses their certificate to cause havoc. If you have a Lenovo PC with this software, you should remove it ASAP.

Edit: Here are some more detailed instructions with pictures.

Improve this answer
6
2

Superfish is malware that performs a Man in the Middle attack on all your SSL traffic so it can inject ads, track traffic, insert affiliate tracking links .... and so on.

Because the Superfish crypto certificate is a root certificate it cannot be removed. Because Superfish shares their private key, expect to see signed malware by the end of the week.

This is a complete and total compromise of security of your Windows installation by Lenovo.

Improve this answer
3
  • I think you and OP aren't talking about the same "Superfish"
    – Rizier123
    Feb 19, 2015 at 8:41
  • 8
    @Rizier123 Unfortunately for Lenovo, they are
    – WheresWardy
    Feb 19, 2015 at 9:44
  • 6
    @EtherealMind : What do you mean that the certificate can not be removed? I suppose I can find it in Windows certificate manager (mmc -> add snap-in -> Certificates), and delete it from there? Not a favourite cup of tea for the average windows user I admit, but should be possible.
    – Barfred
    Feb 19, 2015 at 12:07

You must log in to answer this question.