Second Root Certificate with Private Key Found on Dell Laptops
Shortly after the discovery of a root certificate called eDellRoot, another private key certificate was found on Dell systems. This certificate is named DSDTestProvider. It is installed by Dell System Detect in the Windows Certificate Store.
The existence of the first eDellRoot vulnerability was disclosed by Joe Norden last Sunday. The presence and potential danger of the root certificate was quickly confirmed by many others, including Dell itself. The manufacturer came up with instructions to remove the certificate, but it turns out that a root certificate with private key still exists: DSDTestProvider. Similar to eDellRoot, it can be used to perform a man-in-the-middle attack by generating a certificate using the DSDTestProvider private key.
The Carnegie Mellon University security blog explains how it works: DSD stands for Dell System Detect and is an application that runs on a Windows PC to communicate with the Dell support website. DSD installs the trusted certificate DSDTestprovider along with the private key. DSD is preinstalled on some systems. Systems that do not use a Dell image or for other reasons do not have Dell System Detect installed are not vulnerable, the institute says.
Because any certificate signed by DSDTestProvider CA is trusted by the system, an attacker who creates and signs a certificate can impersonate a secure website or other service that requires a root certificate. The attacker can fabricate a certificate because the private key is also “included” with the certificate that resides on the computer.
To get rid of the certificate, users can remove it from the trusted certificate list in Windows Certifcate Manager. In the certificate manager, the certificate can be moved from the Trusted Root Certificate Store to the Untrusted Certificates. Labeling the certificate as unreliable prevents the certificate from being installed again as ‘trusted’ when using DSD. The certificate was discovered by the LaptopMag site on a recently purchased Dell XPS 13.