Checking For The Superfish Certificate (My Dad's Laptop Had It)

So by now you've probably heard some version of the Lenovo/Superfish thing that blew up this week. Short version if you missed it: a bunch of Lenovo consumer laptops sold since sometime last year came preloaded with an adware program called Superfish Visual Discovery. It injects ads into your search results and shopping pages, which is annoying but not exactly new for the "junk preinstalled on consumer laptops" genre. The actual problem is way worse than that. To do its ad injection on HTTPS pages, Superfish installs its own self-signed root certificate into Windows and then intercepts secure traffic to rewrite it. And the private key for that root cert turned out to be the same on every single machine, and security researchers cracked it within a day of looking. Which means, in plain terms, anyone on your coffee shop wifi could spoof your bank's login page, your Gmail, whatever, and your affected laptop would show the little green lock like everything's fine.

I don't own a Lenovo. But my dad bought a Yoga 2 last summer because it was on sale at Best Buy and he liked that it folds into a tablet, and I've been meaning to set up his email properly for months and kept putting it off. Guess what finally got me to drive over there.

How to actually check for this yourself

If you're on Windows and want to know whether your machine has the cert, here's what I did, no downloads required:

1. Hit the Windows key, type certmgr.msc, hit enter. This opens the Certificate Manager.
2. In the left pane, expand Trusted Root Certification Authorities and click on Certificates.
3. Scroll the list (it's alphabetical) and look for one called Superfish, Inc.

If it's there, it's there. My dad's had it. Issued back in October, sitting quietly in his trusted root store this whole time, which means for however many months, any site he visited over HTTPS could theoretically have been intercepted by someone who bothered to grab the leaked private key off the internet, which by Wednesday was trivially easy to find.

Getting rid of it isn't hard once you know it's there. You can select the certificate and just delete it manually, though Microsoft pushed an update to Windows Defender and Microsoft Security Essentials yesterday that detects Superfish and removes both the program and the certificate automatically, which is honestly the easier route for anyone who isn't comfortable poking around in certmgr. Lenovo also has an actual removal tool up on their support site now. I ran both, just to be safe, and then double checked the cert list was clean afterward. Takes maybe ten minutes total including the reboot.

A couple of things worth doing after you clean it off, that I did for my dad's machine: change his email password and his banking password, since there's no real way to know for certain nothing was intercepted while the hole was open. Is that probably overkill for a guy whose laptop mostly gets used for solitaire and looking at grandkid photos on Facebook? Maybe. But it's a fifteen minute annoyance versus finding out the hard way, and honestly resetting a couple passwords should just be something people do periodically anyway.

What actually gets me about this whole story isn't even the adware part, companies have been shoveling garbage onto new PCs since forever and I complain about it every single time I set up a machine for a relative. It's that whoever signed off on shipping the same private key across an entire consumer product line clearly never had anyone on the security side in the room when that decision got made. That's not a bug, that's a process failure, somebody wrote that code, somebody approved it, and it went out the door on actual retail hardware that actual non-technical people bought at actual stores.

If you or anyone in your family bought a Lenovo laptop in the last several months, go check. It takes two minutes and the certmgr trick works whether or not Windows Update has caught up with you yet. I'd rather people run the manual check than assume Windows Defender already grabbed it, because updates don't always land the same day for everyone, and this isn't the kind of thing you want to be wrong about.