Ranljivost

Lonsarg je 22. feb 2015 ob 11:01 izjavil:

Glugy je 22. feb 2015 ob 04:07 izjavil:

Jz sicer nimam Lenovo ampak sem vseen probu: https://filippo.io/Badfish/ če bi mel. In mi napiše "YES, your connections can be tampered with" . Pol sledim navodilom pa nikjer sledu o Superfish-u. Tko da nism mogu nč zbrisat, tud programa ni. ..tko da sploh ne razumem od kje mam ranljivost.

In kaj točno napiše, superfish ali kaka druga ranljivost od te firme? Neki so upgradal, bi moralo točno napisat kaj.

crniangeo je 22. feb 2015 ob 10:19 izjavil:

@gandalfar: upam da ne smetim, just for @Glugy: Predlagam da poskusiš pogledat, če boš zadevo našu s tem programom: http://www.pcdecrapifier.com/..
@gandalfar: če sem šel preveč offtopic pa se lahko zrbriše post, vem samo , da sem si enkrat s to zadevo na prednaloženimi Lenovi zelo pomagal ker je blo res polno bloatwara..

Sem probu (zagnal kot skrbnik) pa mi ne najde nobenih nepravilnosti. Pol pa ne vem od česa bi to blo. Zdej edin če je ta test bil mišljem samo za Windows 8 in da je taka reakcija (zgornji zajem slike) normalna za Windows 7. Sam mi je pa res čudn ker se ni noben oknčk pojavu ki bi me sprašval.

Najdel sem rešitev. Bom napisal če koga zanima.
Ok problem je bil v tem da sem imel nameščen PrivDog. Ko sem ga odstranil je ranljivost izginila.

Namig o tem sem dobil medtem ko sem iskal po spletu:
http://arstechnica.com/security/2015/02...

"The second security-marketed software was "PrivDog," which is the creation of Comodo CEO Melih Abdulhayoglu. Valsorda told Ars that the stand-alone version of PrivDog will cause most browsers to trust any self-signed certificate, a breath-taking vulnerability that leaves users wide open to easily executed man-in-the-middle attacks that completely bypass HTTPS protections. Besides its ties to Comodo--a certificate authority that's trusted by all major operating systems--PrivDog is notable for not containing any traces of Komodia technology. The version of PrivDog that's bundled with Comodo Internet Security does not contain the same critical weakness, Valsorda said.

PrivDog bills itself as software that enhances security and privacy by replacing ads in web pages with ads from trusted sources. Presumably, the vulnerable version of PrivDog is using the man-in-the-middle proxy and certificate to replace ads in HTTPS-protected sites. Abdulhayoglu and other Comodo officials didn't respond to e-mail seeking comment for this post. Until we know more, readers with either Lavasoft Ad-aware Web Companion or the stand-alone version of PrivDog should err on the side of caution and uninstall both the app and the underlying root certificate as soon as possible"

Kaj vse folk nalaga na sisteme, kot da ni dovolj, da nam že OEMi vsiljujejo zadeve:)