As some people suspected, the self-signed credentials that came pre-installed as root certificates on computers throughout Dell's product line were associated with the Dell Foundation Services, Dell officials wrote in a blog post published late Monday night. The certificates, which were issued by an entity calling itself eDellRoot, were part of a support tool that was intended to make it easier for customers to maintain their systems, the post explained. Attempting to draw a distinction between the Foundation Services app and the SuperFish man-in-the-middle adware that injected ads into the HTTPS-protected Web content displayed on Lenovo computers, Dell officials wrote:
The certificate is not malware or adware. Rather, it was intended to provide the system service tag to Dell online support allowing us to quickly identify the computer model, making it easier and faster to service our customers. This certificate is not being used to collect personal customer information. It’s also important to note that the certificate will not reinstall itself once it is properly removed using the recommended Dell process.
The post went on to thank customers Hanno Böck, Joe Nord, and Kevin Hicks for bringing the threat to Dell's attention.
Customers with computers that have an eDellRoot certificate installed can download an uninstaller app here. Dell has also provided instructions for manually removing the root certificate. To find out if a computer is infected with such a certificate, visit this test site using the Chrome, Edge, or Internet Explorer browsers. If the browser establishes an HTTPS connection without displaying a warning, the computer is affected.
Dell customers can also manually check for the threat by doing the following:
- go to the start menu, type "mmc" and press Enter
- Go to File -> Add/Remove Snap in
- Pick certificates and press Add
- Choose Computer account and press Next
- Choose Local computer & press Finish
- Press Ok
- Expand Certificates and Trusted Root Certification Authorities
- Pick the Certificates folder and look to see if the eDellRoot is present
People who find the root certificate should remove it at once.
At least one SCADA system affected
Dell's apology and removal resources came as researchers from two-factor authentication service Duo Security published a blog post Monday afternoon that reported Dell's root certificate problems went deeper than was previously known. For instance, one of the systems Duo Security researchers found using the certificates for providing web services over HTTPS was a supervisory control and data acquisition system. Such SCADA systems typically are used to manage dams, electrical grids, factory production lines, and other types of industrial equipment. Monday afternoon's blog post didn't elaborate, but the detail nonetheless raises concerns about the potential reach of the dangerous Dell certificates.
Duo also reported a second Dell certificate mishap involving a credential used to sign Bluetooth management software. It was secured with the password "t-span," a passcode so weak it took only a little effort or resources to guess. The certificate expired in March 2013, making it less of a threat than it might have been had it remained valid.
Let the sunshine in
Dell's response is a good start insofar as it offers customers an immediate remedy, apologizes, and thanks the people who brought the major security blunder to light. Now, it's time for Dell to do much more. For months now, Dell marketers have assured the public that each pre-installed app "undergoes security, privacy and usability testing." The presence of a root certificate that included the same easily extracted private key on multiple computers is proof that the process in this case failed in spectacular fashion. If Dell is serious about regaining customers' trust, company officials should explain how this failure happened and what steps are being taken to ensure similar lapses don't happen again.
Any breached company can gush about how seriously it takes security. The ones that really mean it are willing to be transparent about their failures, even if it means taking a brief hit to the company's public image. It will be worth watching Dell carefully in the coming days to see which path company officials choose.
reader comments
141