Dell Software Installs Dangerous Root Certificate

Users of Dell computers have been warned again for a dangerous certificate that is installed by a program of the computer manufacturer on laptops, desktops and tablets and that cyber criminals can use it to launch attacks on the system.

Therefore it warns CERT Coordination Center (CERT / CC) at Carnegie Mellon University. Initially, it was warned for Dell Foundation Services a root certificate called eDellRoot installs with private key. Now it appears Dell System Detects install such a root certificate with corresponding private key. This certificate is DSDTestProvider.

Dell System Detect (DSD) is a program that users should start and communicates with the Dell Support Page. On some systems, DSD is installed by default. The program installs a root certificate private key. An attacker can use it is to generate certificates that are signed by the certificate authority DSDTestProvider.

Systems that rely DSDTestProvider the certificate authority will also certificates from the trust authority. An attacker can thus mimic websites and other services, software and e-mail sign and decrypt network traffic and other data. It is, among other things, man-in-the-middle attacks on HTTPS traffic and installing malware. The CERT / CC recommends to withdraw the root certificate, which can be done via the Windows Certificate Manager.

More Dangerous Certificates On Dell Computers Discovered

On Dell computers appear to present certificates are more dangerous than just eDellRoot root certificate which since yesterday is to warn and allowing users to be attacked. Reported that the security firm Duo Security on the basis of its own research.

Dell turns since August computers to install the same root certificate called eDellRoot, including associated private key.Something that, according to researchers at Duo Security is a pretty big mistake. " Using the certificate can be man-in-the-middle attacks against users are executed and it is for example possible to install malware or encrypted connections to eavesdrop. In addition, there appears to be a second eDellRoot certificate. The second license was found on 24 IP addresses. Which models are exactly is unknown.

"It suggests that Dell is deliberately identical keys in other models. This is a blatant disregard for basic cryptographic security," said the researchers. One of the systems used was accessible via the internet and certificate to offer Web services over HTTPS was a SCADA system. Such systems are used, among other vital infrastructure.

Finally an Atheros Authenticode certificate was also detected for the signing software. The password of the certificate was cracked within six hours. However, the certificate was found to have expired already, which restricts the possibility for abuse. However, it seems that the certificate was in use at the time that it was still valid.

Manufacturers Do Not Learn

According to the researchers, the discovery reveals a disturbing trend among manufacturers. Adding Trusted Certificates to a system, and especially root certificates can expose users to unnecessary risks. "Unfortunately it appears that manufacturers do not learn from past mistakes and keep them to keep repeating," the conclusion of the research (pdf). Dell has now indicated that it eDellRoot certificate via an update will be removed.

Fuss About Self-Signed Certificate On Dell Laptops

On the Internet fuss about a self-signed certificate which all Dell laptops would be delivered. On social news site Reddit reports reader Kevin Hicks how his new XPS Dell laptop a self-signed root certificate discovered called eDellRoot. Allows users could be attacked, for example via malware that uses the certificate.

The certificate on the Dell laptops is its own private key features that can not be exported. The key however, been found to be able to be copied. Dell user Joe Nord discovered on his laptop the same root certificate using the same private key.According to Nord Hicks and this is exactly the same situation as with Lenovo and Superfish debacle. The laptops from Lenovo came with adware that could intercept the encrypted traffic using a self-signed certificate to inject in here then ads.

In the case of Dell, however, the situation looks very different. The certificate can not be used namely to issue other certificates to perform eg man-in-the-middle attacks on HTTPS sites, says another reader on Reddit. Yet there is also criticism that Dell does not use a certificate from a valid certificate authority. Dell leaves in front of Hicks that eDellRoot is a trusted certificate and not a threat. Hicks's remark that the certificate or a security risk is the Dell Webcare team announced that the company will come with an explanation of the presence of the certificate. A spokesman confirmed to Security.NL Dell later today comes with an explanation.