Dell Hell and the re-installing cert
Dell has done a efficient job of trying to sort out the self-signed certification vulnerability discovered in all its new PCs late last week: if only it were that simple. Researchers claim to have found another couple of certification issues, albeit of a less serious nature; but more importantly, that the instructions Dell is publishing for PC owners to rid themselves of the vulnerability are incomplete: you delete the eDellroot cert however, unless you also delete the DLL, the cert will simply re-install itself.

Dell has been shipping an SSL certificate on a number of its laptops, generating security concerns that hackers could misuse the certificate to spy on web traffic. After being made aware of the problem yesterday, Dell says "we deeply regret that this has happened and are taking steps to address it." Unlike Lenovo's Superfish scare, Dell claims its certificate isn't used for adware.

Software update arriving today to remove the certificate

"It was intended to provide the system service tag to Dell online support allowing us to quickly identify the computer model," says a Dell spokesperson. "This certificate is not being used to collect personal customer information." Dell has posted instructions to permanently remove the certificate from affected systems here, and the company will also publish a software update today that will automatically check for the certificate and remove it. The company has not confirmed how many machines are affected, but the Inspiron 5000, XPS 15, and XPS 13 are known to ship with the certificate preinstalled.