Joint effort guts Superfish

Microsoft earlier this week said that search-and-destroy work by it, Lenovo and other software makers has reduced the daily number of Lenovo PCs found infected with the Superfish adware to below 1,000.

In a blog post announcing the addition of another Superfish clean-up tool, Microsoft’s security team said that the number of infected PCs detected by its software peaked at around 60,000 on Feb. 21, slumped slightly over the next two days before falling precipitously. By Feb. 25, the daily number of infected PCs encountered by Microsoft’s tools had dropped to around 3,000, sliding further over the next several days to what appeared to be less than 1,000 each day.

All told, Microsoft implied that about a quarter of a million Lenovo PCs were cleansed of Superfish between Feb. 20 and March 4.

Microsoft’s numbers came from its Malicious Software Removal Tool (MSRT), a free utility pushed to Windows PCs monthly via Windows Update. MSRT, a companion to real-time security software like antivirus programs, includes a smaller set of “fingerprints” that detect and delete malware that Microsoft believes is the most pervasive or threatening.

The company added a fingerprint for Superfish Visual Discovery, an ad-injection program pre-loaded on Lenovo’s consumer PCs for several months late last year, and according to reports, still contained on the Chinese PC maker’s machines that remain in the sales channel.

To implant ads on encrypted websites, Superfish installed a self-signed root certificate into the Windows certificate store, then re-signed all certificates presented by domains using HTTPS. That meant a browser trusted all the fake certificates generated by Superfish, which was effectively conducting a classic “man-in-the-middle” (MITM) attack able to spy on supposedly secure traffic between a browser and a server.

Once hackers cracked the encryption key for the Superfish certificate — a laughably easy job, as it turned out — they could launch their own MITM attacks by duping Lenovo PC users into connecting to a malicious Wi-Fi hotspot in a public place, like a coffee shop, airport or school campus.

Lenovo published instructions for manually removing Superfish and its certificate, then followed that on Feb. 21 with an automated tool. Between Lenovo’s two moves, Microsoft updated its free Windows Defender and Security Essentials antivirus programs with a signature that sniffed out and deleted the rogue certificate.

While it’s impossible to tell the impact of a specific tool — whether Lenovo’s, Microsoft’s or others’ — on the Superfish infection numbers, the cumulative effort did suppress the adware.

Microsoft acknowledged that other software besides Superfish used the same security-threatening tactic, but said its tools only targeted Lenovo PCs.