1. Welcome Guest! In order to create a new topic or reply to an existing one, you must register first. It is easy and free. Click here to sign up now!.
    Dismiss Notice

Two Dell laptop models are shipping with a Superfish-style certificate hack

Discussion in 'News & Current Events' started by allheart55 (Cindy E), Nov 23, 2015.

  1. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,620
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    dell-xps-0229_0_0.jpg


    Dell users may have a serious security problem on their hands, thanks to an unorthodox SSL certificate that comes pre-installed on a number of the company's laptops. The certificate is called eDellRoot, first discovered by a programmer named Joe Nord, and because of Dell's pre-installed permissions, affected computers are set to trust any SSL certificate it signs.

    The problem is, because the key is stored locally, it's likely that an attacker could create a forged version of the signing key, exposing users to all manner of SSL attacks. Users have found the certificate key on both the Inspiron 5000 and XPS 15 and The Verge was able to detect it on an XPS 13, suggesting it may be present on a significant portion of the Dell laptops currently on the market.


    Reminiscent of Lenovo's Superfish scandal

    It's reminiscent of a similar scandal that hit Lenovo in February, when the company was caught pre-installing an adware program called Superfish with a similar self-signed certificate. Dell's case is different, since there's no indication that the certificate is being used to plant ads on the laptops, but the resulting security problem is the same. To fix the issue, users will need to manually revoke the certificate permissions, a complex and technically demanding task.

    Because the private key for the certificate is hosted on each computer, it would be simple for a technically adept criminal to reverse-engineer that signing key, using it to certify unsafe traffic as if it were legitimate. That power could be used attack to target Dell users logged onto a public Wi-Fi hotspot or target traffic from deeper in the network through a more sophisticated attack, harvesting credit card numbers, passwords, or other sensitive information.

    In fact, some security researchers have already been able to exploit the bad certificates. Darren Kemp, a researcher at DuoSecurity, says the problem may be more even complex than Nord's first post suggests. "It appears that there is definitely more than one eDellRoot thumbprint as well as at least one other defunct private certificate on the system that we were able to crack the password on without substantial effort," Kemp said in a statement.

    In the meantime, it's still unclear how many Dell computers are affected by the certificate problem, and why the self-signed certificate was included in the first place. In a statement to The Verge, a Dell representative said the company was still looking into the certificate, but emphasized Dell's policy of minimizing pre-loaded software for security reasons. "Customer security and privacy is a top concern for Dell," a representative said. "We have a team investigating the current situation and will update you as soon as we have more information."

    Source: theverge
     
  2. Amd_Man

    Amd_Man Registered Members

    Joined:
    Sep 5, 2015
    Messages:
    598
    Location:
    Toronto, Ontario, Canada
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    Asus M5A97
    CPU:
    Phenon II X4 955
    Memory:
    8 Gigs G. Skill Rip Jaws
    Hard Drive:
    120 Gig Kingston SSD, 640 Gig Western Digital Black Edition
    Graphics Card:
    Power Color HD5770
    Power Supply:
    Corsair TX750
    That wasn't too intelligent of Dell.
     
  3. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,620
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    It's very disappointing to me.
     
  4. Amd_Man

    Amd_Man Registered Members

    Joined:
    Sep 5, 2015
    Messages:
    598
    Location:
    Toronto, Ontario, Canada
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    Asus M5A97
    CPU:
    Phenon II X4 955
    Memory:
    8 Gigs G. Skill Rip Jaws
    Hard Drive:
    120 Gig Kingston SSD, 640 Gig Western Digital Black Edition
    Graphics Card:
    Power Color HD5770
    Power Supply:
    Corsair TX750
    I would never buy a Dell so it doesn't bother me. When I worked at Kraft Canada I found out how crap they really are.
     
  5. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,620
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    I still sub-contract for Dell so that's why it's disappointing to me.
    I like the Dell business machine a lot.
     
  6. Amd_Man

    Amd_Man Registered Members

    Joined:
    Sep 5, 2015
    Messages:
    598
    Location:
    Toronto, Ontario, Canada
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    Asus M5A97
    CPU:
    Phenon II X4 955
    Memory:
    8 Gigs G. Skill Rip Jaws
    Hard Drive:
    120 Gig Kingston SSD, 640 Gig Western Digital Black Edition
    Graphics Card:
    Power Color HD5770
    Power Supply:
    Corsair TX750
    We ordered 1500 Laptops and 1200 Desktops and it didn't take them but 1 month to start developing problems. Many right out of the box where DOA. When I was setting them up I the keys on the laptop just pop off. Dell like all OEM manufactures only care about one thing, MASSIVE PROFITS and as such they knowingly use inferior hardware but charge you top dollars though.
     
: dell, security, ssl, forged

Share This Page