CERT / CC is based on the blog of Hanno Böck in https://blog.hboeck.de/archives/876-Superfish-2.0-Dangerous-Certificate-on-Dell-Laptops-breaks-encrypted-HTTPS-Connections.html.
Hanno has been test-page updated: https://edell.tlsfun.de/ now checks both the presence of the certificates’ eDellRoot “as of” DSDTestProvider “in the Windows Certificate Store (if you have both, this is reported correctly).
Testing can in each case with Internet Explorer, Chrome, Chromium, and Opera (these browsers all use the Windows Certificate store). Testing with Firefox is pointless because it has its own certificate store.
If you want to use any browser (or do not want to leak to the site that you are vulnerable), you can use certmgr.msc, or search in the registry to:
98a04e4163357790c4a79e6d713ff0af51fe6927 and 02c2d931062d7b1dc2a5c7f5f0685064081fb221
That key first name is the certificate of eDellRoot, the second of DSDTestProvider
If such a key is found in one of the subkeys of:.
HKEY_LOCAL_MACHINE SOFTWARE Microsoft SystemCertificates
different
HKEY_LOCAL_MACHINE SOFTWARE Microsoft SystemCertificates disallowed
the certificate is installed and Your PC is probably vulnerable
But even if the key is found in one of the subkeys of:.
HKEY_CURRENT_USER Software Microsoft SystemCertificates
different
HKEY_CURRENT_USER SOFTWARE Microsoft SystemCertificates disallowed
is your account probably vulnerable .
One problem is that you are so not simply discovered or other accounts may be vulnerable. However, as far as I know, this Dell root certificates by Dell are always installed at system level
Additional details for those interested:.
(A) Information on the (rather confusing) registry key names for storing certificates (the Windows certificate store) in relation to certmgr.msc can be found at http://blogs.msdn.com/b/muaddib/archive/2013/10/18/understanding-certificate-stores-and-publishing-certificates-for-smart-card-logon.aspx.
(B) Microsoft uses the SHA1 hash of the binary representation (with ASN.1 coding) of the certificate to store unique in the repository. That’s the same hash that you see when you are in Internet Explorer inspects the details of a certificate; at the very bottom of the list you see (in English Windows) resp .:
Thumbprint algorithm sha1 Thumbprint 02 d9 c2 31 06 2d 7b 1d c2 a5 c7 f5 f 0 68 50 64 08 1f b2 21
confusing that it seems like that hash part included in the certificate, but that is absolutely not the case.
(C) Nb. that hash you can calculate yourself the certificate as “DER encode binary X.509″ store, and about that file to calculate the SHA1 hash.
(D) Instead of a certificate remove you can do that certificate (or a copy) to the list Untrusted Certificates . Regardless of whether (Dell) software reinstalling such certificate as “trusted”: as long as the also untrusted remains will assume Windows that it should not be trusted and treat it as revoked (withdrawn). This is also a must if you can not exclude that such a certificate error possible Account-level is trusted.
It is important that you have the certificate to system-level (ie for all accounts , including “invisible” system accounts), allows untrusted. This can be as follows:
(E) In certmgr.msc you can transfer certificates by dragging and releasing it in another place. If you hold down the Ctrl key is copied during the process
(F) If, for safety reasons, the Dell root certificates as untrusted want to include in the register, but they have not already, you can find them here:.
https://raw.githubusercontent.com/hannob/superfishy/master/certificates/eDellRoot.crt https://raw.githubusercontent.com/hannob/superfishy/master/certificates/DSDTestProvider.crt
Right-click one of these URLs, choose “save as” and put them in a folder such as C: Temp (which you can create if it does not exist). Make sure the extension is .cer or .crt. from that directory you can then import them into certmgr.msc as described in (D).
(G) My impression is that on 64 bit machines in the registry the following keys (and everything underneath) automatically synchronized (perhaps with a kind of symbolic link works similar):
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSystemCertificates
en
HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftSystemCertificates
Weet someone the lowdown on here?

