10 ms·
Dell shipping laptop with rogue self-signed root CA
- philh 11y ago[1] suggests that this can be used for code signing, but not to MITM network requests, which makes it bad in a different way to superfish. [1] https://np.reddit.com/r/technology/comments/3twmfv/dell_ships_laptops_with_rogue_root_ca_exactly/cxa00fo https://np.reddit.com/r/technology/comments/3twmfv/dell_ship...
- diafygi 11y agoRight, but the private key is also included(!), so anyone can now sign code that will be trusted by these computers. Edit: Confirmed can issue ssl certs. https://mobile.twitter.com/_xpn_/status/668745489823768576 https://mobile.twitter.com/_xpn_/status/668745489823768576
- Someone1234 11y agoThat person was mistaken. Keep reading the thread. Several people have already created website certificates that validate in browsers using the private key provided.
- nly 11y agoSo should it not have been tagged solely for code-signing? x509 has a field for intended usage.
- Laforet 11y agoThis particular certificate has no constraints, so if my understanding of x.509 is correct then it can be used for everything. Of course if they had known better they probably would not have shipped it with the private key protected by such a obvious and weak password.
- deleted 11y ago[deleted]
- jkot 11y agoSeems like a way to bypass signed drivers. Sending drivers to Microsoft for signing takes a few weeks and costs money. I bet this certificate was used on prototypes, but was not removed from final version for some reason. Source: I worked for hardware vendor and wrote windows drivers.
- rincebrain 11y agoI thought you could get a code signing cert from MS, but the WHQL qualification is what involves the latter phase?
- jkot 11y agoI am not sure about that, we were a small shop. Dell is bigger, but maybe has subcontractors.
- ryan-c 11y agoI have seen driver installers that just install their own CA. A particularly clever one generated a CA at install time, signed the driver, deleted the private key, then installed the driver, however this relied on internet access during install to timestamp the driver signature. I wonder if this works for kernel mode drivers?
- pjc50 11y agoThis is (a) hilarious and (b) a massive security hole in the whole concept of signed drivers.
- revelation 11y agoCan you actually do that? I was under the impression that the kernel driver root certs aren't under user control, and you basically have to boot your Windows in debug mode to run an unsigned driver. Surely people would just self-sign instead if that was possible.
- Dylan16807 11y agoThat doesn't explain why the private key was on the prototype itself.
- devnull42 11y agoRegardless of why this is here, negligence or cost cutting, this is pretty bad and leaves the systems pretty open.
- ctz 11y agoHere's a test website from Kenn White: https://bogus.lessonslearned.org/ https://bogus.lessonslearned.org/
- deleted 11y ago[deleted]
- cpach 11y agoWhat does the test site do?
- kiallmacinnes 11y agoIf you don't get a big + scary "Invalid Cert, unsafe!, unsafe!" warning - you have the dell CA installed and trusted...
- WatchDog 11y agoIt is signed by the eDellRoot certificate, if you visit the page and you don’t see any certificate warning, then your machine probably has the eDellRoot certificate installed.
- IceyEC 11y agoUses a cert signed by eDellRoot
- finnn 11y agoit's got a certificate signed by the bogus certificate authority that dell bundled. So if your browser accepts the certificate (eg shows a green https instead of preventing the page from loading and displaying a warning) then the CA is installed and trusted on your machine
- guelo 11y agoThis should be the NSA's job, keeping us safe from all the corporate and foreign government cyber espionage that is completely out of control. In reality they don't give a shit because they like to free ride on top of all the other backdoors as well as the ones they create.
- strictnein 11y agoThe NSA's job does entail keeping government communications secret and secure. So whole buildings of people do "give a shit" about stuff like this.
- flyryan 11y agoSince Dell holds a ton of government contracts and a good amount of government computers are Dell, you can guarantee they most DEFINITELY "give a shit" about this.
- 01Michael10 11y agoOne should always do a clean install of Windows with a OEM disc when buy a new PC. You can avoid a lot of issues that way...
- wlesieutre 11y agoOr buy "Signature Edition" from Microsoft http://www.microsoftstore.com/store/msusa/en_US/cat/Signature-Edition-Computers/categoryID.69916600 http://www.microsoftstore.com/store/msusa/en_US/cat/Signatur...
- astrodust 11y agoSo buy it twice to get a good copy? Microsoft really needs to reel in the bad behaviour on the part of the OEMs.
- wlesieutre 11y agoNo no, sorry. Signature edition is buying the computer itself, not rebuying the OS. They're computers from Dell/Toshiba/Acer/etc. sold directly by Microsoft without any garbageware. Saves you the hassle of having to do a clean install after you buy it.
- astrodust 11y agoDo you have a link that explains what this is? The previous one dumped me on some random Microsoft Store page.
- wlesieutre 11y agoHm, link works for me. Maybe MS is doing a location based redirect or something? Try google cache: http://webcache.googleusercontent.com/search?q=cache%3Ahttp%3A%2F%2Fwww.microsoftstore.com%2Fstore%2Fmsusa%2Fen_US%2Fcat%2FSignature-Edition-Computers%2FcategoryID.69916600&ie=utf-8&oe=utf-8 http://webcache.googleusercontent.com/search?q=cache%3Ahttp%...
- Spooky23 11y agoI love the Dell response: "We have top men working on it."
- pm24601 11y ago"Who are they?" "Top. Men."
- dantillberg 11y agoCan you link to where you see this? I don't see that quote in TFA.
- criddell 11y agoTwitter.com/dell They are being asked about this over-and-over again, and they just spit back the same nothing response every time that is essentially what the person you replied to said.
- Spooky23 11y agoI think the mods changed the link. The original was a blog post, and one of the comments was from Dell and essentially said "We are Dell and we like security. Our experts are furiously working on security. We'll let you know what they come up with."
- rasz_pl 11y agoJust like Xerox response to news that their copiers randomly swap numbers.
- PhantomGremlin 11y agoWhenever I see an announcement to that effect, I'm reminded of this classic The Far Side cartoon: https://www.pinterest.com/pin/509399407824121060/ https://www.pinterest.com/pin/509399407824121060/ Alas, no new ones for over 20 years.
- nathan_long 11y agoThe response I see is better: http://en.community.dell.com/dell-blogs/direct2dell/b/direct2dell/archive/2015/11/23/response-to-concerns-regarding-edellroot-certificate http://en.community.dell.com/dell-blogs/direct2dell/b/direct... > We have posted instructions to permanently remove the certificate from your system here. We will also push a software update starting on November 24 that will check for the certificate, and if detected remove it. Commercial customers who reimaged their systems without Dell Foundation Services are not affected by this issue. Additionally, the certificate will be removed from all Dell systems moving forward. > Your trust is important to us and we are actively working to address this issue. We thank customers such as Hanno Böck, Joe Nord and Kevin Hicks, aka rotorcowboy, who brought this to our attention. If you ever find a potential security vulnerability in any Dell product or software, we encourage you to visit this site to contact us immediately.
- Avitas 11y agoIt's hard for me to imagine a company as big as Dell making such a bone-headed blunder.
- gnoway 11y agoIt shouldn't be. If anything, being as big as Dell makes me wonder why it hasn't happened already. I work at an Enterprise software company a few orders of magnitude smaller than Dell. The number of people we have who don't even begin to understand how SSL works beyond 'its encrypted now' is frustrating. Dell can probably recruit better people than we can, but I don't know if they can recruit better people at volume, top to bottom. It only takes a couple of people to not understand what they are doing and 'just get it done' for this to happen.
- astrodust 11y agoVolkswagen made a much bigger blunder, as you might have heard. Sometimes companies fail to comprehend the consequences of their actions.
- lazaroclapp 11y agoIn that particular case, it's likely less "fail to comprehend the consequences of their actions" and more "underestimate the chances of being caught"...
- projct 11y agoThe bigger a company is, the more places there are for bone-headed blunders to go unnoticed.
- nailer 11y agoRelated: how to control the SSL CAs your browser trusts, on nearly every device (except iOS 9). https://news.ycombinator.com/item?id=10615829 https://news.ycombinator.com/item?id=10615829
- tedunangst 11y agoKarmic. Straight from Dell's website: Dell is serious about your privacy Worried about Superfish? Dell limits its pre-loaded software to a small number of high-value applications on all of our computers. Each application we pre-load undergoes security, privacy and usability testing to ensure that our customers experience the best possible computing performance, faster set-up and reduced privacy and security concerns.
- tetrep 11y agoIn case they think it wise to remove that blurb (it's on various product pages): https://web.archive.org/web/20151123183352/http://www.dell.com/ae/business/p/xps-27-2720-aio/pd https://web.archive.org/web/20151123183352/http://www.dell.c...
- endgame 11y agoAnd in case they twiddle robots.txt to force the wayback machine to clear out: https://archive.is/IaIcl https://archive.is/IaIcl
- atm0sphere 11y agoTotal horse shit. Family member bought a Dell not too long ago and it was filled to the brim with spyware.
- theli0nheart 11y agoDo you actually mean spyware, as in low-grade virus, or just preinstalled software? I'd be highly surprised if they bundled actual spyware with their machines.
- eric-hu 11y agoThis raises an interesting paradox to me. How would the people writing the marketing copy for any product that was supposedly Superfish-resilient actually know that it was? Is the solution to simply not have marketing around such technical details? Is there a solution?
- guelo 11y agoOn Android I only buy and recommend Nexus devices because of crapware, privacy and security concerns. It might be a good time for Microsoft users to switch to that same strategy and only buy Microsoft devices, since the introduction of Microsoft's own laptop makes it possible. It's also pretty much the Apple model.
- sikto 11y agoBuying devices only from Google or Microsoft is a little better as it might remove one layer of involuntary data sharing but it would still be better wiping off Android and replacing it with something else that is more privacy oriented...
- Phlarp 11y agoAre there any "somethings" that are more privacy oriented and can be flashed onto existing android hardware without destroying all functionality due to missing / poor drivers?
- okuli 11y agoMicrosoft sells laptops from different manufacturers with Signature Edition. Those laptops don't have any junk.
- tetraodonpuffer 11y agodo they remain junk-free when you install manufacturer software updates? Was wondering if manufacturers are mandated to keep the signature laptops clean or if the first time you install your "control center / driver center" update it will automatically pull in things you'd rather not
- criddell 11y ago> Those laptops don't have any junk I bought a Signature Edition Thinkpad Yoga S1 from Microsoft and it didn't have any junk on it, except in the registry. I think all they do is open the machine, uninstall all the non-Microsoft stuff, then ship the machine. A clean install wouldn't have registry keys for Evernote (for example). I think I would only buy a Microsoft Surface machine at this point. The hardware is very good and they aren't junked up.
- giancarlostoro 11y agoOne thing to note is, if you have your own Windows disks (some organizations might have) or if you use Linux this might not really matter to you. I wish laptops and desktops were sold without Operating Systems by the major companies, outside of server space.
- eager_noob 11y agoThere are quite a few low end laptops available in India without any pre-installed OS. Most people who buy these end up using some pirated copy of windows which is either left unpatched and vulnerable or it comes with some form of malware already installed. It hasn't been great for security or privacy sadly. No one I know uses linux on them or forks out any money for a Windows license which they deem to be too costly.
- Animats 11y agoTake a look at the screenshot of the certificate store. Why are expired certs from 1999 in there? What's that "NO LIABILITY ACCEPTED" cert? Do you really have the private key for the self-signed cert? This is worth a vulnerability report to US-CERT, and more publicity.
- clwg 11y agoThose weird trusted root CA's are preloaded by Microsoft https://support.microsoft.com/en-us/kb/293781 https://support.microsoft.com/en-us/kb/293781
- rasz_pl 11y agoOff topic: I dont reddit that much, so this is a first time I see this banner (specifically crafted to not be copyable!) > You have been linked to a read-only version of this subreddit. Please respect the community by not voting. Please do not vote or comment when you come from external subreddits. wtf?
- WatchDog 11y agoWhen you add the np subdomain prefix to a reddit domain, it links to a non-participation version of the page. The idea is that it helps to reduce "brigading", as in if a thread is linked to by an external party or another subreddit, the thread is not so easily derailed from its original context and audience. Of course if you actually want to participate in the thread, its not difficult to simply remove the prefix. But it might make some people think twice. NP links are mainly used by inter-subreddit references, as "brigading" is against the reddit rules, and can result in a subreddit being banned. I can see why it all seems a bit ridiculous.
- rasz_pl 11y agoThank you for the explanation. It does look very tinfoil hat for the outsider with no knowledge of what it is.
- daxelrod 11y agoIt's non-copyable because it's added with CSS and not an element on the page. It's done this way because CSS is the only way for a subreddit's moderators to add a message like this. (Reddit allows moderators to customize CSS, but not otherwise alter pages.)
- stronglikedan 11y agoI have a Dell M3800 that was purchased in March and has this cert. I am not well versed in this area. What do I do? Can I just delete it from the "Certificates" snap-in in MMC? (And should I?)
- stronglikedan 11y agoI'm replying to my own comment, because I can no longer edit it. This is a response that I received from reddit [0]. I haven't attempted it yet, but I wanted to include it here for completeness (and opinions): > You can safely delete it from both the root and personal certificate stores. You will also need to remove the eDell plugin entirely otherwise the certificate will simply be reinstalled. If you have "Dell Foundation Services" listed in your programs you can uninstall it, otherwise you'll need to look for "Dell.Foundation.Agent.Plugins.eDell.dll" and delete it. [0] https://www.reddit.com/r/tech/comments/3tzwuv/dell_does_a_superfish_ships_pcs_with_easily/cxauqf5 https://www.reddit.com/r/tech/comments/3tzwuv/dell_does_a_su...
- stronglikedan 11y agoHere's the removal process from dell (PDF): https://dellupdater.dell.com/Downloads/APP009/eDellRootCertificateRemovalInstructions.pdf https://dellupdater.dell.com/Downloads/APP009/eDellRootCerti...
- NickHaflinger 11y agoTest for eDellRoot certificate .. https://edell.tlsfun.de/ https://edell.tlsfun.de/
- doggydogs94 11y agoThe self-signed certificate is probably something a developer at Dell was using for testing and forgot to delete.