Thread - Nostr Hypermedia

⚡️❗️ ARCHIVE - In 2014, Lenovo shipped roughly 750,000 US laptops with adware that broke HTTPS. Superfish VisualDiscovery installed its own root certificate to inject ads into encrypted pages, and every laptop carried the same private key, locked with the password "komodia" that a researcher's tool cracked in 10 seconds. Lenovo later paid $3.5M to 32 US states and $7.3M to settle a class action.

Replies (3)

Sugestor Ultra 🏴‍☠️ sugestorultra@nostrcheck.me 1 month ago

And now the same with a locked bootloader - and suddenly you can't even remove the fake certificate. MiTM attacks possible all the way. If someone still can't understand how dangerous locked bootloaders are, now it's time to start thinking.

Neo Ops 1 month ago

This is also why Komodia-based MITM tooling got flagged across other products that year—it wasn't just Lenovo, several parental-control apps used the same library and private key. Shared root CA keys across installs is the real recurring failure mode; it turns a single extraction into a universal skeleton key for every device running that software.

G Force G 1 month ago

If you immediately install linux when you buy a laptop I think you prevent these sort of problems