Slashdot Mirror

← Back to Stories (view on slashdot.org)

Dell Accused of Installing 'Superfish-Like' Rogue Certificates On Laptops (theregister.co.uk)

Posted by samzenpus on from the was-that-wrong? dept.

Mickeycaskill writes: Dell has been accused of pre-installing rogue self-signing root certificate authentications on its laptops. A number of users discovered the 'eDellRoot' certificate on their machines and say it leaves their machines, and any others with the certificate, open to attack. "Anyone possessing the private key which is on my computer is capable of minting certificates for any site, for any purpose and the computer will programmatically and falsely conclude the issued certificate to be valid," said Joe Nord, a Citrix product manager who found the certificate on his laptop. It is unclear whether it is Dell or a third party installing the certificate, but the episode is similar to the 'Superfish' incident in which Lenovo was found to have installed malware to inject ads onto users' computers.

6 of 92 comments (clear)

  1. Let me Guess by Anonymous Coward · · Score: 5, Insightful

    He is running a pre-installed Windows?

    First thing I do is wipe any new computer clean. The OEMs can't be trusted anymore.

    1. Re:Let me Guess by Lead+Butthead · · Score: 5, Informative

      He is running a pre-installed Windows?

      First thing I do is wipe any new computer clean. The OEMs can't be trusted anymore.

      Except if you bought a Lenovo, it'll helpfully replaces OS components through Lenovo Service Engine entirely on its own. So a clean install won't save you. Nice eh?

      --
      ELOI, ELOI, LAMA SABACHTHANI!?
  2. Test your system. by khasim · · Score: 5, Informative

    https://edell.tlsfun.de/

    I don't think it is "accused" any more. It's pretty much proven.

  3. Re:Coming soon in Windows 11 by Dr_Barnowl · · Score: 5, Interesting

    No chance.

    This "install your own root CA" trick is being used widely in corporate environments to allow proxies to snoop your HTTPS connections ; caused no end of trouble with clients using independent Firefox installs (Chrome uses the system certificate store, Firefox has it's own) navigating to our pages (with properly signed certificates) and being told they were a security risk.

    We also had something that directed traffic while we were out of the corporate network through a third-party proxy that used the same trick (Websense).

  4. Re:Its only SuperFish-like by thoromyr · · Score: 5, Informative

    Not only is the private key supplied with the certificate, unlike with SuperFish the certificate can also be used to sign executables. Which means that the bad guys can now sign their malware with eDellRoot and gain unwarranted trust. It figures that slashdot doesn't provide a good link. Try http://arstechnica.com/securit...

  5. Re:Coming soon in Windows 11 by sexconker · · Score: 5, Interesting

    No chance.

    This "install your own root CA" trick is being used widely in corporate environments to allow proxies to snoop your HTTPS connections ; caused no end of trouble with clients using independent Firefox installs (Chrome uses the system certificate store, Firefox has it's own) navigating to our pages (with properly signed certificates) and being told they were a security risk.

    Firefox told them it's an untrusted cert and a security risk because it's an untrusted cert and a security risk.
    What you are doing is bad, evil, and wrong. And it's technically illegal under the DMCA as well, because you're breaking encryption. No, an employee agreement that says you can monitor their computer use doesn't get you past the DMCA.

    Fuck you and all the places that do this. If I were asked to implement such a thing at my job I'd raise all hell and strike.