Dell now has two security issues

Dell is having a bad week after two security flaws were found this week. Brendan Fay, principal information security consultant, Ward Solutions commented on the first flaw stating:

“A Dell certificate known as eDellRoot, installed by Dell Foundation Services, on many PCs has unintentionally introduced a security vulnerability, which could have adverse effects on users.

“The vulnerability has the potential to manipulate the trust certificate on affected PCs. This certificate is a common feature on all computers and serves to verify that websites you’re visiting are legitimate. eDellRoot opens up the possibility that a third party could trick the cert and allow websites that contain malware – or that might steal sensitive information – to masquerade as the legitimate website you’re looking for.

“Users need to be vigilant – perpetrators can be highly skilled at making fake websites look legitimate. Any user who has Dell Foundation Services on their PC should uninstall the eDellRoot cert from their computer entirely – just deleting it won’t suffice.”

Ward solutions have published a guide on their blog which shows you how you can check to see if you are affected. You can read their blog here.

The second security flaw is very similar to the first one since it also involves Dell installing a self-signed certificate and a private key on its customer’s computers. Once the certificate and a private key is installed, a little bit of reverse engineering, can allow a cybercriminal to spy on users’ encrypted Internet traffic, or to steal their sensitive information.

Dell have warned that anyone who used the “detect product” function on the company’s support site for the month spanning between Oct. 20 and Nov. 24 is likely to be affected. Further information on the two flaws and how to patch your computer have been issued by Dell and can be found here.