Did you hear about superfish this year?
[Sean] Yes. This is the Lenovo laptop scandal, isn't it?
Yeah this is the bit of software that was installed on pretty much every consumer Lenovo laptop.
It was so bad that the US department of homeland security issued an advisory saying that this needs to be uninstalled.
And to understand why it's so bad we need to understand Man In The Middle attacks.
There have been a lot of techniques for intercepting traffic for a long long time.
One of the earliest ones I remember was called ARP spoofing or ARP poisoning.
You've got your router sitting in the middle. Cause all routers have a little aerial and some lights on them.
And you've got computers connected to this.
And what you do is you bring your computer onto an open Wi-Fi network, something like that,
connect your computer, and your computer just announces, "Hello! I'm now the router."
I'm simplifying massively here but basically the network is built on trust.
And so the computers just kind of believe it.
And so the computers and the router and sending all their packets to you first and then you're forwarding them on to the right locations.
So everything's going through you. 10 or 15 years ago this was terrible because pretty much everything was sent in plain text.
Email passwords, websites, everything was going through plain text.
So you could just sit there
and provided your computer was fast enough, your network card was good enough,
you could see every bit of traffic on this network and just kind of slurp all the password out.
Obviously massively illegal without the consent of everyone on the network so Don't do that!
Umm, but the solution to that is SSL.
Your computer sitting here, and the server out here. As all servers look like computers from the 1990s.
Your computer sends requests saying "Hello, I would like to talk securely."
"These are the protocols I can support. These are my details."
And the server comes back, "Yeah, okay. Here's my public key."
I know Computerphile has done, you've done public and private key before. -Yeah, he's sat behind me.
So yeah, go watch his video about public and private key cryptography if you want to know the details about that.
Basically the server sends back a long series of numbers. Your computer can sign messages with these and encrypt messages with these.
And they can only be unlocked by that server because maths.
I'm not going to try to explain more than that.
You can lock messages, only they can unlock them.
Which is great because your attacker, who is sitting in the middle here, and reading everything will just see noise.
Except all we've really done is just moved the problem back a stage
because that first bit, that "Hello, I would like to talk securely." "Yeah okay. Here's my private (sic. meant "public") key." That has to go in plain text.
And someone in the middle can change that.
They can take that public key that was sent by the server and just go,
"Um, no. I'm going to have that! Here's my public key instead." You're actually going here, and then here.
Your computer here doesn't know the difference.
It then encrypts the message with the attacker's public key. Sends it back here.
Attacker opens it. Decrypts it. Reads it.
Goes "okay." and then sends the message that should have been sent from your computer all properly encrypted.
Server goes, "All right, we've got an encrypted connection going on here." Sends the encrypted packet.
The attacker, who can do this now, unlocks it, goes "yeah, all right,"
and then re-encrypts it with their key, sends it on to you and now every single communication is going through the attacker.
No one knows anything is wrong. That is your classic Man In The Middle attack.
The solution to this is something called signed certificates.
This is why setting up a secure server on the web costs a little bit of money right now.
I mean it may not in the future.
The Electronic Frontier Foundation and Mozilla and trying to set up a thing to make this free.
Hopefully by the end of the year it will be.
But the idea is that there's a third party vouching for the set of the public keys you're exchanging.
I've had to do this.
I set up a secure server about a year ago now.
What I had to do when I was setting it up I had to write "It's going to run this website, it's going to be on this address, it's going to use these protocols"
and they would generate this set of public and private keys.
And then over an existing secure connection, one that I knew to be good, I send that private key off to something that is called a certifi-
How do I draw a certificate authority?
[Sean] I think it's going to be a faceless office. Or why don't we do a factory then we know that's kind of indus...
Haha, we're going to the Internet factory, there we go.
Factory of the Internet, all right, there we go, we got a padlock factory there.
No no, it's not a padlock. I've drawn a padlock here, it's not.
It's a set of keys. It's what we call public and private keys.
I generate my keys. I make them. And I send them over a connection I know to be secure to this company.
There's like half a dozen big ones in the world. Maybe 50 or 100 or so small regional ones.
And what they do is they check, all right these keys we've got. Are they definitely from this server? Yes.
And if you want one of the green padlocks with your company name on it they ask you to,
I don't know, fax something on headed paper, something like that. It's probably still a fax machine actually,
which is why it's so expensive, know you, to keep the fax machine running.
They get this. They check it's coming from the right server.
They check it's the right keys.
And then they do maths to them.
And now those keys are now signed by that company with their own private key, which no one else has.
So now, when I do that initial back and worth, so person comes along, they talk to my server, and they say "Hello. I would like to talk securely."
And my server says, "All right. Here is my public key. It's been signed by those folks over there."
And the company says, "Ah! Oh yeah, okay! That's great."
And if the attacker changes one bit of those keys, - in the computer sense -, one 1 or 0 in there, the maths doesn't add up any more.
And more than that, not only does the maths not add up, they can't generate any new keys and sign them because they don't have the private key for any of these big companies.
So the attacker's completely out of luck.
If they change it, it'd be like when you try logging into a public wi-fi network, it pops up "Hey! You need to log in. We need your details."
Sometimes that's a man in the middle attack
and they are taking stuff you are trying to send to the server. And they're getting in the way and sending, "no we're going to send back our page instead."
This warning will pop up and say "we're meant to be on a secure connection to Gmail but we're not! YWAA! . Panic everyone run. Big red screen."
Which of course now most people have now trained themselves to click through, but you know, you try.
Okay, the attacker can't intercept the keys any more. Not without sending up all sorts of red flags, which is fine.
But again all we've done is we've moved the problem back a stage because how do you know which certificate authorities to trust?
And that's when for end users, for people like you and me web browsing, when you do have to take it on trust.
Because when you bought your smart phone- when I bought this I trusted Apple.
They installed a list of maybe probably about 100 certificate authorities, those factories on there.
They installed their public keys on there.
So they don't really go over the air to start with. They're pre-installed with your device.
If you install a web browser, that would be over a connection you know to be secure or hopefully. And you install that and say "Right, I'm trusting these companies because my browser manufacturer trusts them."
It's okay, we now have keys on this server signed by the factory here.
And that factory is trusted by whoever made your browser or your device.
So we have this complete network of trust that's set up.
That means the attacker can't change the keys. And there are two obvious weak points there.
One is the certificate authority.
If you can get them to fraudulently sign keys then all the people who trust them are completely out of luck.
And that happened, that happened to a Dutch certificate authority that is now bankrupt because no one trusts them.
Somehow they got conned, coerced, bribed, no one knows, but they generated a completely valid, signed certificate for Google.
They had no right to do that, no permission to do that but they generated a certificate for the whole of Google with their signature on it saying, "We trust this."
And that somehow made it to Iran where someone manage a massive man in the middle attack on enormous numbers of Iranian web users.
So they were all seeing a big green padlock with "Google" written in it.
If they looked at the details, which a couple of people - if you're paranoid, you check the details on this.
And someone is asking "Why is this certificate for Google signed by someone in the Netherlands? That doesn't make sense." And that was how it was found out.
That wasn't a genuine Google certificate.
But most people wouldn't know that.
They're talking to Gmail. They're seeing a big green Google certificate in there. They think all's well.
- So they're basically looking at their Gmail emails, but it's all going through somewhere else.
It's all going through an attacker. The keys that are being replace, they couldn't do it for every website, but they've done it for this one, they've done it for Google.
So every bit of Google traffic that went through them, they were swapping out the keys.
They were opening everything, looking at it, all this is all happening in milliseconds obviously. Open it. Store it. Put the new keys on it that you've got. Send it onwards.
And it's terrible. It's a devastating attack if you can pull it off.
And there is a genuine concern that governments can do this.
That governments can go to certificate authorities and say, "Right. This is the government here. We need you to generate some fake certificates."
Or they can just steal the private keys.
If they can steal the certificate authority's private keys, they can generate their own keys without even the authority knowing.
I mean, it's a devastating attack if they can pull it off.
Can they?
I'd be surprised if the NSA couldn't do that somehow.
Whether they actually choose to do it is another matter.
Because if they do, and it gets found out, not only have they bankrupted a fairly major company, that no one trusts any more, but they've blown their cover.
So I suspect that yeah they can do it, but they use it in very very rare situations where they haven't got another option.
Whether they should, I'm not getting into that debate.
That's one weak spot. The other is the list of trusted authorities on your phone or on your computer.
Because if an attacker can get an extra entry in there, if they can get themselves in there, then they can just generate new keys on the fly and every single connection would be intercepted.
So that's what Superfish did.
They wanted to insert advertising.
Superfish was a program that took your Google searches and added a little bit more advertising in it for them, which is a terrible idea!
But Google switched to secure searching for everyone.
So Superfish, which is such a bad idea, they installed themselves as a trusted certificate provider.
And it wasn't even sitting out in the networks, it was this little program sitting on your own computer looking at all your traffic and doing a man in the middle attack on it and inserting their own adverts.
That authority is sitting on your computer signing keys on the fly.
Which means that the private key, the numbers that should never ever be seen,
is sitting on your computer and can be extracted.
It was the same on every single computer so as soon as one attacker pulled it off one computer, every single installation is vulnerable, because every single computer that has superfish trusts superfish.
So if someone in the middle pretends to be superfish, which they can do because they have that private key,
then that attacker can man in the middle every single secure website out there.
And they know you've got it because they can see Lenovo on the back of your computer in the coffee shop.
There's ways, there's uninstallers out there now. Lenovo promised not to do it again. Superfish, as far as I know, does not exist as a bit of software any more.
But it's one short-sighted company that used every ignorant shortcut in the book to try to make a few adverts appear.
Just because of that, tens of thousands maybe hundreds of thousands of computers, I don't know, perhaps a million, I don't know how many they make in a year.
But all those were made vulnerable to a really really terrible attack
just because one company wanted to sell a few ads.
And it's very very difficult for people who go into a bad place and use a card because if you complain to your bank then the strip club owner will just say,
"He was with four girls all night, and four thousand pounds is what that costs at our place."
How long have we not been recording?
That's a really good question.
This is because I'm an idiot.
I love it. We're three quarters of the way through and he says, "Why are we not recording?"
We did that for the drone footage in Chernobyl. We had a monitor on the drone footage with a remote link.
And we're getting our shots. And I look in and go
"Our GoPro is not rolling. Oh!"
Bring the drone back down. Change the battery in the drone. Oh man!