5 ms·

Superfish 2.0: Now Dell Is Breaking HTTPS

81 points by tdurden 11y ago

redbeard0x0a 11y ago
As I was walking by a pile of Dell laptops for sale today, I just had to wonder if the timing of this problem is just coincidence? Regardless, this kind of thing really helps out the FBI/CIA/NSA/etc get around encryption when targeting an individual. Malice intended or not.
- pmx 11y ago
  I miss the days when I thought "Wow if this keep happening the law will surely get involved and put a stop to it." - Now I just think "I bet the government LOVE this... they probably paid them to do it."
  - CamperBob2 11y ago
    True. After the Snowden relevations you don't even have to guess.
chipperyman573 11y ago
"Dell included that [private] key on all the affected laptops as well." Was there any reason other than plain negligence to include the private key on every laptop?
- jessaustin 11y ago
  Deniability? If the intention was to create a backdoor, and later it was found that e.g. NoSuchAdversary had used that backdoor, a really good "we didn't intend to create a backdoor and we especially didn't give the key to that backdoor to the Adversary" defense would be the fact that actually Dell gave the key to everyone.
  - jacquesm 11y ago
    That's exactly my take on this whole thing. The incompetence you'd have to defend for the alternative to be real would damage Dell even more than the malice would.
FussyZeus 11y ago
I really don't want to sound elitist, but my choice to go full Macbook and keep my custom built PC at home has never looked better. How long until we hear about other manufacturers also doing this?
- yrro 11y ago
  If I were looking at a Windows system I would now only consider buying those branded with Microsoft Signature.
  - FussyZeus 11y ago
    Except then you have the privacy concerns with Windows 10. That's why I'm still running 7.
    - throwawayaway 11y ago
      https://support.microsoft.com/en-us/kb/2952664 https://support.microsoft.com/en-us/kb/2952664 This KB sneaks in diagtrack.dll to windows 7, aka telemetry.
      - tux3 11y ago
        Which you can decline to install, on Windows 7.
        throwawayaway 11y ago
        Do you always get prompted or does it install automatically in certain circumstances? I have diagtrack on my work win8.1 without being prompted. I'll have to check win7 on monday. This is the first non win10 kb I've seen it mentioned in. I have no clue how it got onto my win8.1 box.
        FussyZeus 11y ago
        If you go into Control Panel, Programs and Features, you can retroactively uninstall updates. It's in the other section of that application. At least for 7, I never used 8 enough to give you useful info there.
itburnswheniit 11y ago
I share the opinion of a friend of mine which is this will eventually come to all major hardware manufacturers.
detaro 11y ago
https://news.ycombinator.com/item?id=10614837 https://news.ycombinator.com/item?id=10614837
- throwawayaway 11y ago
  I think an article from the eff is more notable than a reddit anecdote and should be treated as such. This is now gone off the main page, which is a shame.
  - dang 11y ago
    Perhaps the URL is better, but this cluster of stories has had so many major discussions that the current submission is clearly a dupe by HN's standard. https://hn.algolia.com/?query=dell%20points%3E10&sort=byDate&dateRange=all&type=story&storyText=false&prefix&page=0 https://hn.algolia.com/?query=dell%20points%3E10&sort=byDate... We try to get the most substantive URL into the most prominent thread (and in fact are working on a system for users to be able to drive that) but it doesn't always work out.
    - tdurden 11y ago
      Thanks for the info.
nnutter 11y ago
It annoys me that this is being so directly compared to Superfish. Yes the technical aspect is similar but the intent is very different. Intent matters.
- jacquesm 11y ago
  I haven't seen anything that really showed the intent of Dell, just a bunch of woolly corp-speak about improved customer service.
  - s_henry_paulson 11y ago
    The intent is in the certificate. Superfish could create and sign any certificate, meaning it could impersonate websites. This certificate cannot sign other certificates, meaning it can't be used in the same way as superfish. Thus the logical intent seems to be bloatware, backdoors, etc.. not snooping on HTTPS connections. This is the distinction the person you are replying to is trying to make, because although similar to superfish, it is not quite the same.
    - tedunangst 11y ago
      If the dell cert can't be used to impersonate websites, what's with all the test websites people set up to demonstrate it?
      - nnutter 11y ago
        I think the problem is the private key is accessible AND machines were already setup to trust it (because of the cert). So what s_henry_paulson said is technically correct but it's conceptually wrong.
- KirinDave 11y ago
  Intent isn't magic. Jeopardizing the integrity of every secure connection for a customer is outrageous. Comparisons to Superfish are entirely appropriate. There is no product, service, business or political cause that justifies destroying the security and integrity of the internet. This places people affected by this in an incredibly risky situation. And then rather that recall the laptops, Dell is issuing removal instructions and asking customers (many of who may be receiving the laptops second hand via personal or corporate means) to fix the problem for them. If our law were even remotely up to date, this would result in at least a crippling fine for the company that did it.
mschuster91 11y ago
I wonder how much similar (or worse) errors exist in the metric shitload of device drivers distributed by the ODMs, OEMs and the white-labelers. Everyone adds their crap onto the device and then wraps it up for sale, with no one having real responsibility on what actually ends up being on the device. Given common code quality I really wonder what nasties are hidden in stuff like Embedded Controller firmware, the drivers for stuff like "special keyboard hotkeys" and similar. All places to hide a nice kernel level exploit in (or in case of the EC, full HW backdoor).
- matt4077 11y ago
  I have no idea how the dysfunctional wasteland that is the windows consumer ecosystem can survive. Microsoft has actually cleaned up it's act quite well and seems to be producing quality software compared to, says, the Win 98 days. But OEMs and their crapware...? I recently used someones new Lenovo notebook and you couldn't get work done for ten minutes without some sort of popup breaking your concentration. Not even the same, possibly important one, repeated over and over. No, there were 15 third-party items in the system tray vying for my attention with updates, warnings, status informations etc. I seriously wonder how people can work for these companies. Not that they're terribly evil (b/c, after all, this rant is pretty much the definition of a First World Problem). But in that I couldn't spend the majority of my waking hours for an organization that has so little taste.
  - FussyZeus 11y ago
    Speaking as one in the trenches, it survives by the sheer will and determination of the enthusiasts, and the slavishly hard work of various IT departments, as well as the Linux community by and large being arrogant and rude, and the fact that Mac's are expensive.
adrianN 11y ago
More and more it looks like it's time to go full Stallman in your computing environment: https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html
INTPenis 11y ago
And yet again I have to point out how this is an obvious case of Hanlon's Razor, where stupidity is confused for malice. To install the root key is in no way an attempt at spoofing people since it would eventually be discovered and exploited by someone else. If Dell wanted to use this pre-installed cert they would not have installed the private key. And even then it would eventually be discovered much more easily than any number of backdoor methods they could have pre-installed in the BIOS or the OS when they control the entire deployment and shipping process.
- sbarre 11y ago
  So this was basically a process/QA failure then. Someone did this (again without malice but clearly misguided), and it wasn't caught by any process that should have noticed or prevented these kinds of dangerous errors.
- acdha 11y ago
  The only malice that I can see being assumed is in your reading of that report. The EFF page very clearly outlines the problem but said nothing about Dell trying to abuse it, only that Dell's negligence left their users exposed to attackers which is a simple statement of fact.
  - tedunangst 11y ago
    Read the other comments on this page?

81 points by tdurden 11y ago

As I was walking by a pile of Dell laptops for sale today, I just had to wonder if the timing of this problem is just coincidence? Regardless, this kind of thing really helps out the FBI/CIA/NSA/etc get around encryption when targeting an individual. Malice intended or not.

pmx 11y ago
I miss the days when I thought "Wow if this keep happening the law will surely get involved and put a stop to it." - Now I just think "I bet the government LOVE this... they probably paid them to do it."
- CamperBob2 11y ago
  True. After the Snowden relevations you don't even have to guess.

chipperyman573 11y ago

"Dell included that [private] key on all the affected laptops as well." Was there any reason other than plain negligence to include the private key on every laptop?

jessaustin 11y ago
Deniability? If the intention was to create a backdoor, and later it was found that e.g. NoSuchAdversary had used that backdoor, a really good "we didn't intend to create a backdoor and we especially didn't give the key to that backdoor to the Adversary" defense would be the fact that actually Dell gave the key to everyone.
- jacquesm 11y ago
  That's exactly my take on this whole thing. The incompetence you'd have to defend for the alternative to be real would damage Dell even more than the malice would.

FussyZeus 11y ago

I really don't want to sound elitist, but my choice to go full Macbook and keep my custom built PC at home has never looked better. How long until we hear about other manufacturers also doing this?

yrro 11y ago
If I were looking at a Windows system I would now only consider buying those branded with Microsoft Signature.
- FussyZeus 11y ago
  Except then you have the privacy concerns with Windows 10. That's why I'm still running 7.
  - throwawayaway 11y ago
    https://support.microsoft.com/en-us/kb/2952664 https://support.microsoft.com/en-us/kb/2952664 This KB sneaks in diagtrack.dll to windows 7, aka telemetry.
    - tux3 11y ago
      Which you can decline to install, on Windows 7.
      - throwawayaway 11y ago
        Do you always get prompted or does it install automatically in certain circumstances? I have diagtrack on my work win8.1 without being prompted. I'll have to check win7 on monday. This is the first non win10 kb I've seen it mentioned in. I have no clue how it got onto my win8.1 box.
        FussyZeus 11y ago
        If you go into Control Panel, Programs and Features, you can retroactively uninstall updates. It's in the other section of that application. At least for 7, I never used 8 enough to give you useful info there.

itburnswheniit 11y ago

I share the opinion of a friend of mine which is this will eventually come to all major hardware manufacturers.

detaro 11y ago

https://news.ycombinator.com/item?id=10614837 https://news.ycombinator.com/item?id=10614837

throwawayaway 11y ago
I think an article from the eff is more notable than a reddit anecdote and should be treated as such. This is now gone off the main page, which is a shame.
- dang 11y ago
  Perhaps the URL is better, but this cluster of stories has had so many major discussions that the current submission is clearly a dupe by HN's standard. https://hn.algolia.com/?query=dell%20points%3E10&sort=byDate&dateRange=all&type=story&storyText=false&prefix&page=0 https://hn.algolia.com/?query=dell%20points%3E10&sort=byDate... We try to get the most substantive URL into the most prominent thread (and in fact are working on a system for users to be able to drive that) but it doesn't always work out.
  - tdurden 11y ago
    Thanks for the info.

nnutter 11y ago

It annoys me that this is being so directly compared to Superfish. Yes the technical aspect is similar but the intent is very different. Intent matters.

jacquesm 11y ago
I haven't seen anything that really showed the intent of Dell, just a bunch of woolly corp-speak about improved customer service.
- s_henry_paulson 11y ago
  The intent is in the certificate. Superfish could create and sign any certificate, meaning it could impersonate websites. This certificate cannot sign other certificates, meaning it can't be used in the same way as superfish. Thus the logical intent seems to be bloatware, backdoors, etc.. not snooping on HTTPS connections. This is the distinction the person you are replying to is trying to make, because although similar to superfish, it is not quite the same.
  - tedunangst 11y ago
    If the dell cert can't be used to impersonate websites, what's with all the test websites people set up to demonstrate it?
    - nnutter 11y ago
      I think the problem is the private key is accessible AND machines were already setup to trust it (because of the cert). So what s_henry_paulson said is technically correct but it's conceptually wrong.
KirinDave 11y ago
Intent isn't magic. Jeopardizing the integrity of every secure connection for a customer is outrageous. Comparisons to Superfish are entirely appropriate. There is no product, service, business or political cause that justifies destroying the security and integrity of the internet. This places people affected by this in an incredibly risky situation. And then rather that recall the laptops, Dell is issuing removal instructions and asking customers (many of who may be receiving the laptops second hand via personal or corporate means) to fix the problem for them. If our law were even remotely up to date, this would result in at least a crippling fine for the company that did it.

mschuster91 11y ago

I wonder how much similar (or worse) errors exist in the metric shitload of device drivers distributed by the ODMs, OEMs and the white-labelers. Everyone adds their crap onto the device and then wraps it up for sale, with no one having real responsibility on what actually ends up being on the device. Given common code quality I really wonder what nasties are hidden in stuff like Embedded Controller firmware, the drivers for stuff like "special keyboard hotkeys" and similar. All places to hide a nice kernel level exploit in (or in case of the EC, full HW backdoor).

matt4077 11y ago
I have no idea how the dysfunctional wasteland that is the windows consumer ecosystem can survive. Microsoft has actually cleaned up it's act quite well and seems to be producing quality software compared to, says, the Win 98 days. But OEMs and their crapware...? I recently used someones new Lenovo notebook and you couldn't get work done for ten minutes without some sort of popup breaking your concentration. Not even the same, possibly important one, repeated over and over. No, there were 15 third-party items in the system tray vying for my attention with updates, warnings, status informations etc. I seriously wonder how people can work for these companies. Not that they're terribly evil (b/c, after all, this rant is pretty much the definition of a First World Problem). But in that I couldn't spend the majority of my waking hours for an organization that has so little taste.
- FussyZeus 11y ago
  Speaking as one in the trenches, it survives by the sheer will and determination of the enthusiasts, and the slavishly hard work of various IT departments, as well as the Linux community by and large being arrogant and rude, and the fact that Mac's are expensive.

adrianN 11y ago

More and more it looks like it's time to go full Stallman in your computing environment: https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html

INTPenis 11y ago

And yet again I have to point out how this is an obvious case of Hanlon's Razor, where stupidity is confused for malice. To install the root key is in no way an attempt at spoofing people since it would eventually be discovered and exploited by someone else. If Dell wanted to use this pre-installed cert they would not have installed the private key. And even then it would eventually be discovered much more easily than any number of backdoor methods they could have pre-installed in the BIOS or the OS when they control the entire deployment and shipping process.

sbarre 11y ago
So this was basically a process/QA failure then. Someone did this (again without malice but clearly misguided), and it wasn't caught by any process that should have noticed or prevented these kinds of dangerous errors.
acdha 11y ago
The only malice that I can see being assumed is in your reading of that report. The EFF page very clearly outlines the problem but said nothing about Dell trying to abuse it, only that Dell's negligence left their users exposed to attackers which is a simple statement of fact.
- tedunangst 11y ago
  Read the other comments on this page?