Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dell shipping laptop with rogue self-signed root CA

np.reddit.com

Post reply on HN
Print view View original

21–30 of 109 posts

Re: Dell shipping laptop with rogue self-signed root CA

#21

Post by gnoway »

Avitas wrote: post #17

It's hard for me to imagine a company as big as Dell making such a bone-headed blunder.

It shouldn't be. If anything, being as big as Dell makes me wonder why it hasn't happened already.

I work at an Enterprise software company a few orders of magnitude smaller than Dell. The number of people we have who don't even begin to understand how SSL works beyond 'its encrypted now' is frustrating.

Dell can probably recruit better people than we can, but I don't know if they can recruit better people at volume, top to bottom. It only takes a couple of people to not understand what they are doing and 'just get it done' for this to happen.

Re: Dell shipping laptop with rogue self-signed root CA

#25

Post by tedunangst »

Karmic. Straight from Dell's website:

Dell is serious about your privacy

Worried about Superfish? Dell limits its pre-loaded software to a small number of high-value applications on all of our computers. Each application we pre-load undergoes security, privacy and usability testing to ensure that our customers experience the best possible computing performance, faster set-up and reduced privacy and security concerns.

Re: Dell shipping laptop with rogue self-signed root CA

#26

Post by _lce0 »

gootdude wrote: post #19
01Michael10 wrote: post #13

One should always do a clean install of Windows with a OEM disc when buy a new PC. You can avoid a lot of issues that way...

Lenovo uses Microsoft Windows Platform Binary Table to install bloatware, which gets around any kind of clean install/reset. Clean install for Windows means nothing when you have shady vendors utilizing this mechanism.

What about installing an intermediate linux system?

Like

  1. start with window pre-installed
  2. install any linux distro, fully overwriting the OEM
  3. re-install windows, from microsoft
I'd say just stop at step 2 ;) but I can understand that not everybody can do this (eg: work computer) but want a clean OS.

will this method work to remove such bloatware?

Re: Dell shipping laptop with rogue self-signed root CA

#27

Post by mikeash »

gootdude wrote: post #19
01Michael10 wrote: post #13

One should always do a clean install of Windows with a OEM disc when buy a new PC. You can avoid a lot of issues that way...

Lenovo uses Microsoft Windows Platform Binary Table to install bloatware, which gets around any kind of clean install/reset. Clean install for Windows means nothing when you have shady vendors utilizing this mechanism.

I would change that last part to say "means nothing when you have shady OS makers building this mechanism."

I mean, come on, Microsoft, what were you thinking? Vendors gonna vend, so you had to know how this "feature" was going to be used.

Re: Dell shipping laptop with rogue self-signed root CA

#28

Post by mikeash »

_lce0 wrote: post #26
gootdude wrote: post #19

Earlier quoted context omitted.

Lenovo uses Microsoft Windows Platform Binary Table to install bloatware, which gets around any kind of clean install/reset. Clean install for Windows means nothing when you have shady vendors utilizing this mechanism.

What about installing an intermediate linux system? Like 1. start with window pre-installed 2. install any linux distro, fully overwriting the OEM 3. re-install windows, from microsoft I'd say just stop at step 2 ;) but I can understand that not everybody can do this (eg: work computer) but want a clean OS. will this method work to remove such bloatware?

It won't work unless you manage to flash the UEFI firmware.

Re: Dell shipping laptop with rogue self-signed root CA

#29

Post by ryan-c »

jkot wrote: post #5

Seems like a way to bypass signed drivers. Sending drivers to Microsoft for signing takes a few weeks and costs money. I bet this certificate was used on prototypes, but was not removed from final version for some reason. Source: I worked for hardware vendor and wrote windows drivers.

I have seen driver installers that just install their own CA. A particularly clever one generated a CA at install time, signed the driver, deleted the private key, then installed the driver, however this relied on internet access during install to timestamp the driver signature.

I wonder if this works for kernel mode drivers?

Re: Dell shipping laptop with rogue self-signed root CA

#30

Post by morcheeba »

_lce0 wrote: post #26
gootdude wrote: post #19

Earlier quoted context omitted.

Lenovo uses Microsoft Windows Platform Binary Table to install bloatware, which gets around any kind of clean install/reset. Clean install for Windows means nothing when you have shady vendors utilizing this mechanism.

What about installing an intermediate linux system? Like 1. start with window pre-installed 2. install any linux distro, fully overwriting the OEM 3. re-install windows, from microsoft I'd say just stop at step 2 ;) but I can understand that not everybody can do this (eg: work computer) but want a clean OS. will this method work to remove such bloatware?

This won't work because the firmware will write a file to your hard drive with the bloatware. It's scary that firmware will modify my filesystem - lots of damage could happen here.

Also, instead of step 2, it would make more sense to boot linux on a usb stick and use dd to erase the hard drive -- this is more complete than installing another OS... but still useless if the firmware is working against you.

Post reply on HN