Dell does a Superfish, ships PCs with easily cloneable root certificates

Jason

@StrongBad said:

This really just highlights that bloatware is a bad idea. If they weren't including unnecessary garbage this could not have happened. They are setting themselves up for failure by intentionally having a process by which they need to scrutinize all this stuff that they are installing for no reason. Simple don't install it and you don't even need to verify it!

nailed it.

OEM's need to cease with the garbage software

That's were the money's at espcially in consumer PCs. Many times the bloatware pays for the computer, and selling it is all profit.

Dashrender

Sadly they can't if they want to compete. The average consumer only cares about one thing.. price. they will sell they sole for price - this has been proven time and time again.

nadnerB

There is a fix available:
https://dellupdater.dell.com/Downloads/APP009/eDellRootCertFix.exe

(Same topic also here: http://mangolassi.it/topic/7017/dell-root-ca-shenanigans/4 ... didn't see this one before posting the other one)

nadnerB

Well, they aren't out of the woods yet...

Second Dell backdoor root cert found
A second root certificate has been found in new Dell laptops days after the first backdoor was revealed.

The DSDTestProvider certificate was first discovered by Laptopmag. It is installed through Dell System Detect into the Trusted Root Certificate Store on new Windows laptops along with the private key.
http://www.theregister.co.uk/2015/11/25/dsdtestprovider/

MattSpeller

@nadnerB This is starting to piss me off.

MattSpeller

Today we became aware that a certificate (eDellRoot), installed by our Dell Foundation Services application on our PCs, unintentionally introduced a security vulnerability. The certificate was implemented as part of a support tool and intended to make it faster and easier for our customers to service their system. Customer security and privacy is a top concern and priority for Dell; we deeply regret that this has happened and are taking steps to address it.

The certificate is not malware or adware. Rather, it was intended to provide the system service tag to Dell online support allowing us to quickly identify the computer model, making it easier and faster to service our customers. This certificate is not being used to collect personal customer information. It’s also important to note that the certificate will not reinstall itself once it is properly removed using the recommended Dell process.

We have posted instructions to permanently remove the certificate from your system here. We will also push a software update starting on November 24 that will check for the certificate, and if detected remove it. Commercial customers who reimaged their systems without Dell Foundation Services are not affected by this issue. Additionally, the certificate will be removed from all Dell systems moving forward.

Dashrender

Geez... can we trust anyone these days?

I'm guessing that dev created the selfsigned cert in the lab, then rushed it out to production without removing it. Why they would need a self signed when Dell can easily afford a wildcard cert for any domain they want.

But now there's another cert in their software? WTF?

Does this mean we have to put Dell on the ban list?
Probably not, because it does not appear that either a) they did it on purpose to weaken our security b ) because they didn't care about customers and were just installing third party junk to get paid.

MattSpeller

@Dashrender We emailed several nasty-grams to our rep. They seem suitably ashamed. We'll continue using them. What's important to note here is that there's no reports of the latitudes being part of it.

Dashrender

@MattSpeller Hmmm.. wonder if that's true?
trax.x10.mx/apps.html

This tool will scan your local certificate repository and tell if you there is anything odd or unexpected in the repository.

Also, do the Latitudes come with this Dell support software like the consumer models?

But then we could ask the same issue of Lenovo. Scott declares that you can't buy anything with Lenovo's name on it since they have been shown to be untrust worthy, even though the ThinkPad versions have never been shown to have any of the SuperFish crap or driver shim problems that the consumer versions did. Sure there was that auto reinstall Lenovo manager software, but at least Lenovo's manager software wasn't installing a self signed cert with the private key installed so anyone could spoof them, etc.

Basically, I'm asking, why would Dell get a pass assuming their business line wasn't effected, if Leveno doesn't get one for the same reason?

MattSpeller

@Dashrender said:

@MattSpeller Hmmm.. wonder if that's true?
trax.x10.mx/apps.html

This tool will scan your local certificate repository and tell if you there is anything odd or unexpected in the repository.

Also, do the Latitudes come with this Dell support software like the consumer models?

I think it's available through "Dell digital software delivery" as an option. We just got in 3 new 6440s so I'll check.

Basically, I'm asking, why would Dell get a pass assuming their business line wasn't effected, if Leveno doesn't get one for the same reason?

FWIW I would begin to look at HP (and have, but not seriously), except for the fact that we're tied to Dell for the next 3 years no matter what.