Author Archives: Dorothy Ordogh

Oops… Lenovo’s Mistake

Posted on February 22, 2015 | 3 comments

YouTube Preview Image
Video: “CNET Update – Lenovo poisoned its own PCs with Superfish adware” uploaded by CNET

Have you, or someone you know, purchased a Lenovo computer lately? Over the past few days, Lenovo has been making the news due to the recently discovered adware the company has been pre-installing onto their Windows machines. Adware is a type of software that automatically produces ads or changes search results to include ads or sponsored websites. Examples of this are the ads that appear on a person’s Facebook news feed, and the ads that appear as the top results of a Google search. The point of adware is to earn extra revenue by having users click on the ads or the advertised company sponsoring the company displaying the ads. This is exactly what Lenovo did.

Lenovo Yoga Tablet

Attribution: “lenovo-tablet-yoga-10-keyboard-cover-9” uploaded by lenovophotolibrary on flickr.

Lenovo thought they could earn a bit of extra cash by pre-installing an adware called Superfish Visual Discovery on computers that were shipped out between October and December 2014. Sounds annoying but harmless, doesn’t it? Not quite. It turns out Superfish is not just considered by many anti-virus programs as malware (malware is malicious software like a virus), but it is a backdoor for hackers to access your information. Superfish works by recognizing images viewed on the computer, finding items that are similar, and then intercepting all of the messages sent to and from a web server to inject pages that appear in your browser with additional information (like an ad). Usually, there is a mechanism in place on a web server, which verifies each user it speaks to, but Superfish circumvents this by creating a false certificate–a certificate is what the server uses to verify the connection–that all sites will see and accept. This means that any site, including secure ones like your bank or your Amazon account (any site that starts with https://…) is intercepted. Most people call this functionality a man-in-the-middle attack. In essence, a man-in-the-middle attack is when an entity redirects traffic to go through them. This allows the hacker to eavesdrop on, or inject information into the conversation.

Man-in-the-middle attack diagram

Diagram of how a man-in-the-middle attack works.

Starting to sound a little scary, isn’t it? Well, another noteworthy point is that Superfish designed their software to create the same certificate for any instance of the software. This means that every computer running Superfish has the exact same certificate and encoding code. Thus, if someone were to figure out the key or “password” to the encryption, then they could hack every single computer running Superfish by having the same certificate. Suddenly, the pool of targets just got a lot bigger.

To avoid vulnerabilities, if you or someone you know has just bought a Lenovo computer, I suggest finding out if Superfish is installed by crosschecking the model of computer with the list of models that may have been affected. If Superfish is installed, follow Lenovo’s instructions to remove it. Lenovo made a huge mistake by pre-installing this adware on their products, but two software engineers, Chris Palmer and Mike Shaver, from Google and Facebook respectively, are to thank for bringing global attention to this security issue and subsequently protecting users.

Signing off,
Dorothy Ordogh

3 Comments

Posted in Science in the News

Tagged , , , ,

Understanding Hacking in the News

Posted on January 25, 2015 | 3 comments

YouTube Preview Image
Video: “Hack reveals scandalous Sony secrets” uploaded by CNN

I’m sure you’ve heard about the most recent Sony hack and the following controversy regarding the movie “The Interview” that depicts a plot to assassinate the leader of North Korea. Sony isn’t the only company to get hacked, and they certainly won’t be the last, but the following information should help you understand the jargon you might hear in the news when the next attack happens.

Let’s start with phishing. This is the type of hacking that you will likely hear about most because it happens all of the time. It is usually done by sending out mass emails in the guise of a legitimate financial or institutional service asking to confirm payment or Social Insurance Numbers. This technique is used to steal a person’s money or identity. When you hear about these attacks in the news, or even from an institution, you generally hear something like “There have been recent reports of fraudulent emails sent to you from us. Please do not respond or open them.” Even UBC staff and students have been affected.

Phishing

Phishing – the fishing of the internet age Attribution: By Tabor at en.wikipedia (Transferred from en.wikipedia) [Public domain], from Wikimedia Commons

The next form of hacking used to be the go-to for TV shows and movies from the mid 2000s when someone hacked into another’s computer. That’s right, the Trojan virus. Again, the Trojan virus usually targets individual people; however, it is often used to get past the gates of a company’s system. In this case, an email will be sent to a large list of individuals with a file attachment (usually a photograph or document) that disguises the malicious program built into the file. Once you open the file the harmful program will start running. A program like this can do all sorts of awful things from completely wiping your computer of all of its data, recording every key stroke, or collecting all of your data. It is believed that the most recent Sony Pictures Entertainment hack–the one that fueled harsh words and actions between the US and North Korea­–began with a Trojan virus.

Finally, the other most common attack you will hear about is denial of service. Now, denial of service itself is not a form of hacking, but a result of certain attack strategies. The goal with this type of attack is to suspend or interrupt a service so that the company providing the service loses money or users. The strategy to cause this interruption almost always includes overloading the system by causing too much traffic on, or to a website. A good example of this was was when PlayStation‘s network was so overloaded by millions of fake users that it had to be shutdown.

YouTube Preview Image
Video: “Google Ideas: Distributed Denial of Service Attacks” uploaded by Google Ideas

By now, you are probably thinking that the Internet is a very dangerous place, which it is. The first step in protecting yourself is with strong passwords. The CBC reported ways to make your passwords stronger, with it, SplashData’s list of the most used passwords in 2014 (please don’t use “123456” like many other people did). Additionally, the Government of Canada has provided a wealth of information on how to protect yourself from cyber criminals.

Signing off,
Dorothy Ordogh

3 Comments

Posted in Science Communication

Tagged , , , ,