Superfish

Last updated

Superfish
Type Private
IndustryInternet
Founded2006 (2006)
DefunctMay 2015
FateClosed
SuccessorJustVisual.com
Headquarters
Palo Alto, California
,
United States
Key people
  • Adi Pinhas (co-founder & CEO)
  • Michael Chertok (co-founder & CTO)
ServicesVisual search [1]
Revenuec. $40 million
Number of employees
90

Superfish was an advertising company that developed various advertising-supported software products based on a visual search engine. The company was based in Palo Alto, California. [1] It was founded in Israel in 2006 [2] and has been regarded as part of the country's "Download Valley" cluster of adware companies. [3] Superfish's software is malware and adware. [4] [5] [6] [7] [8] The software was bundled with various applications as early as 2010, and Lenovo began to bundle the software with some of its computers in September 2014. [4] On February 20, 2015, the United States Department of Homeland Security advised uninstalling it and its associated root certificate, because they make computers vulnerable to serious cyberattacks, including interception of passwords and sensitive data being transmitted through browsers. [4] [9]

Contents

History

Superfish was founded in 2006 by Adi Pinhas and Michael Chertok. [2] [10] Pinhas is a graduate of Tel Aviv University. [11] In 1999, he co-founded Vigilant Technology, which "invented digital video recording for the surveillance market", according to his LinkedIn profile.[ better source needed ] Before that, he worked at Verint, an intelligence company that analyzed telephone signals and had allegedly tapped Verizon communication lines. [12] Chertok is a graduate of Technion and Bar-Ilan University with 10 years of experience in "large scale real-time data mining systems". [13]

Since its founding, Superfish has used a team of "a dozen or so PhDs" primarily to develop algorithms for the comparison and matching of images. It released its first product, WindowShopper, in 2011. [14] WindowShopper immediately prompted a large number of complaints on Internet message boards, from users who did not know how the software had been installed on their machines. [12]

Superfish initially received funding from Draper Fisher Jurvetson, and to date has raised over $20 million, mostly from DFJ and Vintage Investment Partners. [15] Forbes listed the company as number 64 on their list of America's most promising companies. [16]

Pinhas in 2014 stated that "Visual search is not here to replace the keyboard ... visual search is for the cases in which I have no words to describe what I see." [17]

As of 2014, Superfish products had over 80 million users. [18]

In May 2015, following the Lenovo security incident (see below) and to distance itself from the fallout, the team behind Superfish changed its name and moved its activities to JustVisual.com. [19]

Lenovo security incident

Users had expressed concerns about scans of SSL-encrypted web traffic by Superfish Visual Search software pre-installed on Lenovo machines since at least early December 2014.[ citation needed ] This became a major public issue, however, only in February 2015. The installation included a universal self-signed certificate authority; the certificate authority allows a man-in-the-middle attack to introduce ads even on encrypted pages. The certificate authority had the same private key across laptops; this allowed third-party eavesdroppers to intercept or modify HTTPS secure communications without triggering browser warnings by either extracting the private key or using a self-signed certificate. [5] [8] [20] On February 20, 2015, Microsoft released an update for Windows Defender which removes Superfish. [6] In an article in Slate tech writer David Auerbach compares the incident to the Sony DRM rootkit scandal and says of Lenovo's actions, "installing Superfish is one of the most irresponsible mistakes an established tech company has ever made." [21] On February 24, 2015, Heise Security published an article revealing that the certificate in question would also be spread by a number of applications from other companies including SAY Media and Lavasoft's Ad-Aware Web Companion. [22]

Criticisms of Superfish software predated the "Lenovo incident" and were not limited to the Lenovo user community: as early as 2010, users of computers from other manufacturers had expressed concerns in online support and discussion forums that Superfish software had been installed on their computers without their knowledge, by being bundled with other software. [12]

CEO Pinhas, in a statement prompted by the Lenovo disclosures, maintained that the security flaw introduced by Superfish software was not, directly, attributable to its own code; rather, "it appears [a] third-party add-on introduced a potential vulnerability that we did not know about" into the product. He identified the source of the problem as code authored by the tech company Komodia, which deals with, among other things, website security certificates. [23] Komodia was founded by Barak Weichselbaum, a former programmer for Israel's IDF Intelligence Core. [24] Komodia code is also present in other applications, among them, parental-control software; and experts have said "the Komodia tool could imperil any company or program using the same code" as that found within Superfish. [25] In fact, Komodia itself refers to its HTTPS-decrypting and interception software as an "SSL hijacker", and has been doing so since at least January 2011. [26] Its use by more than 100 corporate clients may jeopardize "the sensitive data of not just Lenovo customers but also a much larger base of PC users". [27] Komodia was closed in 2018. [28]

Products

Superfish's first product, WindowShopper, was developed as a browser add-on for desktop and mobile devices, directing users who hover over browser images to shopping Web sites to purchase similar products. As of 2014, WindowShopper had approximately 100 million monthly users, and according to Xconomy, "a high conversion to sale rate for soft goods". Superfish's business model is based on receiving affiliate fees on each sale. [15]

The core technology, Superfish VisualDiscovery, is installed as a man-in-the-middle proxy on some Lenovo laptops. It injects advertising into results from Internet search engines; it also intercepts encrypted (SSL/TLS) connections. [7] [29]

In 2014, Superfish released new apps based on its image search technology.

See also

Related Research Articles

<span class="mw-page-title-main">Adware</span> Software with, often unwanted, adverts

Adware, often called advertising-supported software by its developers, is software that generates revenue for its developer by automatically generating online advertisements in the user interface of the software or on a screen presented to the user during the installation process. The software may generate two types of revenue: one is for the display of the advertisement and another on a "pay-per-click" basis, if the user clicks on the advertisement. Some advertisements also act as spyware, collecting and reporting data about the user, to be sold or used for targeted advertising or user profiling. The software may implement advertisements in a variety of ways, including a static box display, a banner display, a full screen, a video, a pop-up ad or in some other form. All forms of advertising carry health, ethical, privacy and security risks for users.

<span class="mw-page-title-main">Malware</span> Malicious software

Malware is any software intentionally designed to cause disruption to a computer, server, client, or computer network, leak private information, gain unauthorized access to information or systems, deprive access to information, or which unknowingly interferes with the user's computer security and privacy. Researchers tend to classify malware into one or more sub-types.

<span class="mw-page-title-main">Spybot – Search & Destroy</span> Spyware removal software

Spybot – Search & Destroy (S&D) is a spyware and adware removal computer program compatible with Microsoft Windows. Dating back to the first Adwares in 2000, Spybot scans the computer hard disk and/or RAM for malicious software.

<span class="mw-page-title-main">Lenovo</span> Chinese multinational technology company

Lenovo Group Limited, often shortened to Lenovo, is a Chinese multinational technology company specializing in designing, manufacturing, and marketing consumer electronics, personal computers, software, business solutions, and related services. Products manufactured by the company include desktop computers, laptops, tablet computers, smartphones, workstations, servers, supercomputers, data storage devices, IT management software, and smart televisions. Its best-known brands include its ThinkPad business line of laptop computers, the IdeaPad, Yoga, and Legion consumer lines of laptop computers, and the IdeaCentre and ThinkCentre lines of desktop computers. As of 2021, Lenovo is the world's largest personal computer vendor by unit sales.

<span class="mw-page-title-main">FileZilla</span> Free software, cross-platform file transfer protocol application

FileZilla is a free and open-source, cross-platform FTP application, consisting of FileZilla Client and FileZilla Server. Clients are available for Windows, Linux, and macOS. Both server and client support FTP and FTPS, while the client can in addition connect to SFTP servers.

CNET Download is an Internet download directory website launched in 1996 as a part of CNET. Initially it resided on the domain download.com, and then download.com.com for a while, and is now download.cnet.com. The domain download.com attracted at least 113 million visitors annually by 2008 according to a Compete.com study.

Xcitium, formerly known as Comodo Security Solutions, Inc., is a cybersecurity company headquartered in Bloomfield, New Jersey.

<span class="mw-page-title-main">Lavasoft</span> Software company of Canada

Adaware, formerly known as Lavasoft, is a software development company that produces spyware and malware detection software, including Adaware. It operates as a subsidiary of Avanquest, a division of Claranova.

<span class="mw-page-title-main">Rogue security software</span> Form of malicious software

Rogue security software is a form of malicious software and internet fraud that misleads users into believing there is a virus on their computer and aims to convince them to pay for a fake malware removal tool that actually installs malware on their computer. It is a form of scareware that manipulates users through fear, and a form of ransomware. Rogue security software has been a serious security threat in desktop computing since 2008. An early example that gained infamy was SpySheriff and its clones, such as Nava Shield.

<span class="mw-page-title-main">AVG Technologies</span> Brand of cybersecurity, privacy, performance and utility applications

AVG Technologies is a brand of cybersecurity, privacy, performance and utility software applications for desktop computers and mobile devices developed by Avast, a part of Gen Digital. AVG was a cybersecurity software company founded in 1991 and it merged into Avast following an acquisition in 2017. It typically offers freeware, earning revenues from advertisers and from users that upgrade to paid versions for access to more features.

<span class="mw-page-title-main">Malwarebytes</span> Internet security company

Malwarebytes Inc. is an American Internet security company that specializes in protecting home computers, smartphones, and companies from malware and other threats. It has offices in Santa Clara, California; Clearwater, Florida; Tallinn, Estonia; Bastia Umbra, Italy; and Cork, Ireland.

Pre-installed software is software already installed and licensed on a computer or smartphone bought from an original equipment manufacturer (OEM). The operating system is usually factory-installed, but because it is a general requirement, this term is used for additional software apart from the bare necessary amount, usually from other sources.

<span class="mw-page-title-main">Chrome Web Store</span> Googles online store for its Chrome web browser

Chrome Web Store is Google's online store for its Chrome web browser. As of 2022, Chrome Web Store hosts about 123,000 extensions and 29,000 themes.

<span class="mw-page-title-main">Genieo</span> Israeli company specializing in Mac malware

Genieo Innovation is an Israeli company, specializing in unwanted software which includes advertising and user tracking software, commonly referred to as a potentially unwanted program, adware, privacy-invasive software, grayware, or malware. They are best known for Genieo, an application of this type. They also own and operate InstallMac which distributes additional 'optional' search modifying software with other applications. In 2014, Genieo Innovation was acquired for $34 million by Somoto, another company which "bundles legitimate applications with offers for additional third party applications that may be unwanted by the user". This sector of the Israeli software industry is frequently referred to as Download Valley.

Browser security is the application of Internet security to web browsers in order to protect networked data and computer systems from breaches of privacy or malware. Security exploits of browsers often use JavaScript, sometimes with cross-site scripting (XSS) with a secondary payload using Adobe Flash. Security exploits can also take advantage of vulnerabilities that are commonly exploited in all browsers.

SweetLabs is a software distribution company based in San Diego and Seattle. SweetLabs has raised $21.5 million in venture capital from Bessemer Venture Partners, Google Ventures, Intel Capital, and O’Reilly AlphaTech Ventures.

Download Valley is a cluster of software companies in Israel, producing and delivering adware to be installed alongside downloads of other software. The primary purpose is to monetize shareware and downloads. These software items are commonly browser toolbars, adware, browser hijackers, spyware, and malware. Another group of products are download managers, possibly designed to induce or trick the user to install adware, when downloading a piece of desired software or mobile app from a certain source.

Conduit Ltd. is an international software company. From its founding in 2005 to 2013, its most well-known product was the Conduit toolbar, which was widely-described as malware. In 2013, it spun off its toolbar business; today, its main product is a mobile development platform that allows users to create native and web mobile applications for smartphones.

A potentially unwanted program (PUP) or potentially unwanted application (PUA) is software that a user may perceive as unwanted or unnecessary. It is used as a subjective tagging criterion by security and parental control products. Such software may use an implementation that can compromise privacy or weaken the computer's security. Companies often bundle a wanted program download with a wrapper application and may offer to install an unwanted application, and in some cases without providing a clear opt-out method. Antivirus companies define the software bundled as potentially unwanted programs which can include software that displays intrusive advertising (adware), or tracks the user's Internet usage to sell information to advertisers (spyware), injects its own advertising into web pages that a user looks at, or uses premium SMS services to rack up charges for the user. A growing number of open-source software projects have expressed dismay at third-party websites wrapping their downloads with unwanted bundles, without the project's knowledge or consent. Nearly every third-party free download site bundles their downloads with potentially unwanted software. The practice is widely considered unethical because it violates the security interests of users without their informed consent. Some unwanted software bundles install a root certificate on a user's device, which allows hackers to intercept private data such as banking details, without a browser giving security warnings. The United States Department of Homeland Security has advised removing an insecure root certificate, because they make computers vulnerable to serious cyberattacks. Software developers and security experts recommend that people always download the latest version from the official project website, or a trusted package manager or app store.

Fireball is a browser hijacking malware discovered by the security company Check Point. It takes over target browsers and turns them into zombies.

References

  1. 1 2 Hoge, Patrick (October 21, 2014). "Superfish dives deep into visual search". San Francisco Business Times. Retrieved November 16, 2014.
  2. 1 2 "Microsoft, Lenovo scramble to protect users from Superfish security flaw". CBSnews.com. CBS/AP. February 22, 2015. Retrieved September 11, 2015.
  3. ↑ Hirschauge, Orr (December 25, 2013). "Another blow to Israel's 'Download Valley' as Google bans toolbars". Haaretz.com. Retrieved September 11, 2015. Among the companies in Download Valley most likely to be hurt by the change are the startups Revizer, Superfish, CrossReader and the Client Connect division of the company Conduit …
  4. 1 2 3 "Alert: Lenovo "Superfish" Adware Vulnerable to HTTPS Spoofing". United States Computer Emergency Readiness Team. February 20, 2015. Retrieved February 20, 2015.
  5. 1 2 Fox-Brewster, Thomas (February 19, 2015). "How Lenovo's Superfish 'Malware' Works And What You Can Do To Kill It". Forbes. Retrieved February 20, 2015.
  6. 1 2 Chacos, Brad (February 20, 2015). "Bravo! Windows Defender update fully removes Lenovo's dangerous Superfish malware". PC World. Retrieved February 20, 2015.
  7. 1 2 Williams, Owen (February 19, 2015). "Lenovo caught installing adware on new computers". The Next Web. Retrieved February 19, 2015.
  8. 1 2 Hern, Alex (February 19, 2015). "Lenovo accused of compromising user security by installing adware on new PCs". The Guardian. Retrieved February 19, 2015.
  9. ↑ "U.S. government urges Lenovo customers to remove Superfish software". Reuters. February 20, 2015. Retrieved February 20, 2015.
  10. ↑ "Superfish gets $10M for image search". San Francisco Business Times. July 30, 2013.
  11. ↑ "Q&A: Adi Pinhas, founder and CEO of tech startup Superfish". San Jose Mercury News. January 2, 2015.
  12. 1 2 3 Fox-Brewster, Thomas (February 19, 2015). "Superfish: A History Of Malware Complaints And International Surveillance". Forbes. Retrieved February 21, 2015.
  13. ↑ "Executive Profile – Michael Chertok – Co-Founder and Chief Technology Officer, Superfish, Inc". Bloomberg, retrieved. Retrieved February 20, 2015.
  14. ↑ Craig, Elise (July 16, 2014). "Superfish Aims to Dominate Visual Search, One Product at a Time". Xconomy. Retrieved November 17, 2014.
  15. 1 2 Craig, Elise (July 16, 2014). "Superfish Aims to Dominate Visual Search, One Product at a Time". Xconomy. p. 2. Retrieved November 17, 2014.
  16. ↑ "America's Most Promising Companies". Forbes. January 2015. Retrieved February 21, 2015.
  17. ↑ "What Will It Take for Visual Search to Catch On?". eMarketer. November 11, 2014. Retrieved November 17, 2014.
  18. ↑ Weiss, Vered (September 3, 2014). "Adi Pinhas' Superfish #1 Fastest Growing Private Software Company in the US". Jewish Business News. Retrieved November 17, 2014.
  19. ↑ "After Security Scandal, a Tech Firm Says It's Changing Focus". ABC News. May 28, 2015. Archived from the original on May 29, 2015. Retrieved May 31, 2015.
  20. ↑ Valsorda, Filippo (February 20, 2015). "Komodia/Superfish SSL Validation is broken" . Retrieved February 25, 2015.
  21. ↑ Auerbach, David (February 20, 2015). "You Had One Job, Lenovo". Slate. Retrieved February 21, 2015.
  22. ↑ "Gefährliche Adware: Mehr als ein Dutzend Anwendungen verbreiten Superfish-Zertifikat" [Dangerous Aware: More than a Dozen Applications spreading Superfish Certificate]. Heise Security (in German). February 24, 2015. Retrieved May 5, 2015.
  23. ↑ "Superfish denies blame in Lenovo security mess". The Mercury News: siliconbeat. February 20, 2015.
  24. ↑ Brewster, Thomas (February 20, 2015). "The Company Behind Lenovo's Dangerous Superfish Tech Claims It's Under Attack". forbes.com. Retrieved January 25, 2023. In a brief email conversation with Barak Weichselbaum, Komodia's founder who was once a programmer in Israel's IDF's Intelligence Core,...
  25. ↑ "Palo Alto startup points fingers over Lenovo ad software security flaws". Contra Costa Times. February 23, 2015.
  26. ↑ "Komodia's SSL Decoder/Digestor product page". Komodia Inc. December 14, 2010. Archived from the original on January 22, 2011. Retrieved February 27, 2015.
  27. ↑ ""SSL hijacker" behind Superfish debacle imperils large number of users". ars technica. February 20, 2015.
  28. ↑ "About". Komodia. December 13, 2010.
  29. ↑ Duckett, Chris (February 19, 2015). "Lenovo accused of pushing Superfish self-signed MITM proxy". DNet. Retrieved February 19, 2015.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.