Dell Laptops have root CA Cert with known private key

Joe Exotic · 24-11-2015 01:34PM #1

Dell seem to have release laptops and works stations (Not confirmed yet) with a root Ca cert install for which the private key is known

This could lead to man in the middle attacks as your browser (Not firefox i think it has its own cert store ) will accept the cert as real

http://www.ghacks.net/2015/11/23/dell-does-a-lenovo-ships-laptops-with-rogue-root-ca/

To check are you vulnerable https://edell.tlsfun.de/

Looks like deleting the cert wont work as a dell .DLL file will reinstall on boot

Dell tool to fix issue

https://dellupdater.dell.com/Downloads/APP009/eDellRootCertFix.exe

seamus · 24-11-2015 01:35PM

murphk wrote: »

To check are you vulnerable https://edell.tlsfun.de/

If your laptop is affected you should remove the certificate with the Windows Certificate Manager.Alternatively you can install Linux and delete Windows.

:rolleyes: Hilarious. The 1990s called and want their joke back.

Joe Exotic · 24-11-2015 01:36PM

seamus wrote: »

:rolleyes: Hilarious. The 1990s called and want their joke back.

I know classic

:D

Hotblack Desiato · 24-11-2015 09:08PM

I didn't think any vendor was going to out-stupid Lenovo any time soon, but I was wrong!

Using UEFI to reinstall it after deletion though, that's not stupidity that's malice.

anvilfour · 01-12-2015 09:41AM

seamus wrote: »

:rolleyes: Hilarious. The 1990s called and want their joke back.

Who's joking? I've done this with every Windows laptop I've ever owned!

Dell Laptops have root CA Cert with known private key

Comments