Dell laptops’ bloatware has preloaded vulnerablity

fat-willy-wonka-chocolate-factory-blueberries-1360368319Tin box shifter Dell has confirmed that its laptops’ bloatware  are coming preloaded with a self-signed root digital certificate that lets attackers spy on traffic on any secure website.

The root certificate is bundled with a corresponding private key, making the situation worse. Because you can certificate for any website that will be trusted by browsers such as Internet Explorer and Google Chrome that use the

Windows certificate store on affected laptops. Security experts have already generated proof-of-concept certificates for *.google.com and bankofamerica.com.

Dubbed eDellRoot, the certificate has been under the bonnet of Dell consumer and commercial devices since August. It was designed to create better customer support.

Dell said when a PC engages with Dell online support, the certificate provides the system service tag allowing Dell online support to immediately identify the PC model, drivers, OS, hard drive, etc. making it easier and faster to service.

However the certificate introduced an unintended vulnerability, so Dell is now providing customers with removal instructions and will not add it to new devices.

The company said. “No personal information has been collected or shared by Dell without the customer’s permission.”

Security experts have been calling on Dell or Microsoft should act soon, before malicious hackers start attacking users. Microsoft could update to Windows systems to remove the certificate.

To write an exploit, attackers must be in a position to intercept traffic from an affected Dell laptop and have an HTTPS-enabled website. They can then act as proxy between the laptop and the website by re-encrypting the traffic with a rogue certificate that’s signed with the eDellRoot private key.

The attack can be carried out over public Wi-Fi networks or by hacking into routers.

Attackers could also use the eDellRoot private key to sign malware. This could bypass certain application whitelisting products.