Joint effort guts Superfish

Microsoft's malware detection data shows that Lenovo's crapware has been scrubbed from about 250K Windows PCs

malware bug virus security magnifying glass detection
Credit: Shutterstock

Microsoft earlier this week said that search-and-destroy work by it, Lenovo and other software makers has reduced the daily number of Lenovo PCs found infected with the Superfish adware to below 1,000.

In a blog post announcing the addition of another Superfish clean-up tool, Microsoft's security team said that the number of infected PCs detected by its software peaked at around 60,000 on Feb. 21, slumped slightly over the next two days before falling precipitously. By Feb. 25, the daily number of infected PCs encountered by Microsoft's tools had dropped to around 3,000, sliding further over the next several days to what appeared to be less than 1,000 each day.

All told, Microsoft implied that about a quarter of a million Lenovo PCs were cleansed of Superfish between Feb. 20 and March 4.

Microsoft's numbers came from its Malicious Software Removal Tool (MSRT), a free utility pushed to Windows PCs monthly via Windows Update. MSRT, a companion to real-time security software like antivirus programs, includes a smaller set of "fingerprints" that detect and delete malware that Microsoft believes is the most pervasive or threatening.

The company added a fingerprint for Superfish Visual Discovery, an ad-injection program pre-loaded on Lenovo's consumer PCs for several months late last year, and according to reports, still contained on the Chinese PC maker's machines that remain in the sales channel.

To implant ads on encrypted websites, Superfish installed a self-signed root certificate into the Windows certificate store, then re-signed all certificates presented by domains using HTTPS. That meant a browser trusted all the fake certificates generated by Superfish, which was effectively conducting a classic "man-in-the-middle" (MITM) attack able to spy on supposedly secure traffic between a browser and a server.

Once hackers cracked the encryption key for the Superfish certificate -- a laughably easy job, as it turned out -- they could launch their own MITM attacks by duping Lenovo PC users into connecting to a malicious Wi-Fi hotspot in a public place, like a coffee shop, airport or school campus.

Lenovo published instructions for manually removing Superfish and its certificate, then followed that on Feb. 21 with an automated tool. Between Lenovo's two moves, Microsoft updated its free Windows Defender and Security Essentials antivirus programs with a signature that sniffed out and deleted the rogue certificate.

While it's impossible to tell the impact of a specific tool -- whether Lenovo's, Microsoft's or others' -- on the Superfish infection numbers, the cumulative effort did suppress the adware.

Microsoft acknowledged that other software besides Superfish used the same security-threatening tactic, but said its tools only targeted Lenovo PCs.

Superfish detections Microsoft

Microsoft said that its daily detections of the rogue Superfish adware -- which raised a storm last month when news broke that Lenovo had pre-loaded the crapware on its consumer computers -- had plunged within days of the debut of automated scrubbing tools. 

The brave new world of Windows 10 license activation
View Comments
Join the discussion
Be the first to comment on this article. Our Commenting Policies