Dell Laptops have root CA Cert with known private key

Joe Exotic

Dell seem to have release laptops and works stations (Not confirmed yet) with a root Ca cert install for which the private key is known


This could lead to man in the middle attacks as your browser (Not firefox i think it has its own cert store ) will accept the cert as real

http://www.ghacks.net/2015/11/23/dell-does-a-lenovo-ships-laptops-with-rogue-root-ca/

To check are you vulnerable https://edell.tlsfun.de/

Looks like deleting the cert wont work as a dell .DLL file will reinstall on boot

Dell tool to fix issue

https://dellupdater.dell.com/Downloads/APP009/eDellRootCertFix.exe

seamus

murphk wrote: »

To check are you vulnerable https://edell.tlsfun.de/

If your laptop is affected you should remove the certificate with the Windows Certificate Manager.Alternatively you can install Linux and delete Windows.

:rolleyes: Hilarious. The 1990s called and want their joke back.

Joe Exotic

seamus wrote: »

:rolleyes: Hilarious. The 1990s called and want their joke back.

I know classic :D

Hotblack Desiato

I didn't think any vendor was going to out-stupid Lenovo any time soon, but I was wrong!

Using UEFI to reinstall it after deletion though, that's not stupidity that's malice.

anvilfour

seamus wrote: »

:rolleyes: Hilarious. The 1990s called and want their joke back.

Who's joking? I've done this with every Windows laptop I've ever owned!