Connect with us

E-Business

Dell Speeds Up Process to Address eDellroot Certificate Security Lapses

Published

on

Dell_Logo23.jpg
Kindly share this post

Dell Inc., has reacted to Nigeria CommunicationsWeek report (http://www.nigeriacommunicationsweek.com.ng/e-business/dell-acknowledges-new-laptops-contain-security-vulnerability#sthash.zudmO6JW.dpuf) on Wednesday, saying that it has taken critical steps in address the issue.

Dell Inc., a major U.S. Computer Company had acknowledged a security hole exists in some of its recently shipped laptops that could make it easy for hackers to access users’ private data.

A pre-installed program on some newly purchased Dell laptops that can only be removed manually by consumers makes them vulnerable to cyber intrusions that may allow hackers to read encrypted messages and redirect browser traffic to spoofs of real websites such as Google or those belonging to a bank, among other attacks.

But in a twitter message sent to our reporter, Laura Thomas, chief blogger for Direct2Dell.com disclosed that it came to Dell’s notice that a certificate (eDellRoot), installed by “Dell Foundation Services” application on the PCs, unintentionally introduced a security vulnerability. According to Thomas, “The certificate was implemented as part of a support tool and intended to make it faster and easier for our customers to service their system. Customer security and privacy is a top concern and priority for Dell; we deeply regret that this has happened and are taking steps to address it.

“The certificate is not malware or adware. Rather, it was intended to provide the system service tag to Dell online support allowing us to quickly identify the computer model, making it easier and faster to service our customers. This certificate is not being used to collect personal customer information. It’s also important to note that the certificate will not reinstall itself once it is properly removed using the recommended Dell process.

“We have posted instructions to permanently remove the certificate from your system here. We will also push a software update starting on November 24 that will check for the certificate, and if detected remove it. Commercial customers who reimaged their systems without Dell Foundation Services are not affected by this issue. Additionally, the certificate will be removed from all Dell systems moving forward.

“Your trust is important to us and we are actively working to address this issue. We thank customers such as Hanno Böck, Joe Nord and Kevin Hicks, aka rotorcowboy, who brought this to our attention. If you ever find a potential security vulnerability in any Dell product or software, we encourage you to visit this site to contact us immediately

*****Update 11/25/2015*****
“Since Monday, our teams have been working hard to address the security issue caused by the eDellRoot certificate. When we became aware of the issue, we immediately dug into all our applications that get pre-loaded on our PCs. We can confirm we have found no other root certificates on our factory installed PC images. What we did find was that the Dell System Detect application and its DSDTestProvider root certificate had similar characteristics to eDellRoot. Thank you again Hanno Böck for calling this to our attention, as well as topg who commented below”.

In the case of Dell System Detect, the Chief Blogger for Direct2Dell.com said that customer opts to download the software proactively to interact with our support website so they (Dell) can provide a better and more personalized experience.

“Like eDellRoot, the certificate in question was designed to make it faster and easier for our customers to get support. Unlike eDellRoot, this certificate is not related to software that was pre-installed on our systems.

“The impact from Dell System Detect is limited to customers who used the “detect product” functionality on our support site between October 20 and November 24, 2015. The application in question was removed from the support site on November 24 and a replacement application without the certificate is now available. We are proactively pushing a software update to address the issue for our consumer systems. Our commercial customers can either manually remove the certification or use their system management tools like SCCM to do so (we will be providing instructions on this shortly). If you choose the manual option, we have updated instructions on our site http://www.dell.com/support/edellroot to permanently remove this certificate.

“Note, these are updated instructions for removing both eDellRoot and DSDTestProvider from any folders where they may be stored. If you previously uninstalled eDellRoot, we recommend you go through the process again to ensure a thorough sweep.

“WIRED has noted that “security is far easier to promise than it is to achieve.” We know that your trust is harder to win than it is to lose. Once we know we have addressed these issues and our customers have what they need to ensure their systems are safe, we will provide an account of how the issues were introduced – not only for your information, but so we can improve our processes.

“In today’s world of ever-increasing cybersecurity threats, we all need to be vigilant. And that is the promise that we make – Dell will remain ever vigilant against security threats and we will respond with the utmost speed and accuracy when we become aware of issues that can impact our customers”.


Kindly share this post

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Advertisement
Comments

E-Business

Nigeria @ Risks Losing Digital Control- NiRA

Published

on

Kindly share this post

Nigeria is at risks losing digital control of its cyberspace following the alarming surge in cyberattacks in the country.

Nigeria @ Risks Losing Digital Control- NiRA

The surge show a dangerous shift from opportunistic cybercrime, facing approximately 4,710 threats weekly and ranking as a top target for cybercriminals in Africa.

Nigeria Internet Registration Association (NiRA) recently warned that the trend weakens the country’s control over its digital identity and limits economic gains from its expanding online ecosystem.

Speaking at the .ng Media Advocacy and Capacity Building Initiative for the Nigerian Information Technology Reporters Association (NITRA), organised by NiRA in Lagos, Adesola Akinsanya, president, NiRA, questioned who truly owns Nigeria’s digital presence, stressing that the answer lies in deliberate choices regarding domain name adoption and the narratives shaping the country’s digital ecosystem.

He likened the widespread adoption of foreign domains to building assets on land owned by others, where control, legal authority, and economic benefits ultimately reside outside the country.

According to him, many Nigerian businesses operating on domains such as .com are effectively anchoring their digital operations on infrastructure beyond national control.

Industry stakeholders at the event noted that while Nigeria’s digital economy continues to expand driven by increasing internet penetration and a vibrant tech ecosystem a significant portion of the value generated is lost through payments tied to foreign domain registration and hosting services.

Seyi Onasanya, chief operating officer, NiRA,  described domain names as “digital real estate,” emphasizing their role as a foundational layer of the modern economy.

She stated that countries that prioritise local domain systems are better positioned to retain value, strengthen trust, and enhance digital competitiveness.

Onasanya added that although country-code domains account for nearly 40 percent of global domain registrations, Nigeria still records relatively low adoption of its .ng domain despite its large population and millions of small and medium enterprises.

Experts at the forum warned that dependence on foreign domains contributes to capital flight, weakens national branding, and exposes businesses to external regulatory risks.

They stressed that every domain name represents a potential economic asset linked to transactions, jobs, and overall GDP growth.

Beyond economic implications, speakers highlighted trust and security as critical issues.

Ridwan Badmus, legal and cybersecurity expert, noted that Nigeria’s regulatory framework is evolving to support a more secure digital environment, including policies encouraging government institutions to adopt local domains and hosting services.

He explained that the .ng domain benefits from enhanced security features such as DNS Security Extensions (DNSSEC) and improved monitoring systems, which strengthen resilience against cyber threats.

 


Kindly share this post
Continue Reading

E-Business

CIBN Allegedly Hit by 250GB Data Breach

Published

on

Data Breach
Kindly share this post

Chartered Institute of Bankers of Nigeria (CIBN), the country’s apex professional body for bankers, is reportedly at the centre of a major cybersecurity incident following claims that its internal database estimated at about 250GB has been compromised and leaked online by an unidentified threat actor, according to the Guardian.

CIBN Allegedly Hit by 250GB Data Breach

The alleged breach, which surfaced recently on underground cybercrime forums, is said to involve a wide range of sensitive institutional and personal data belonging to members of the banking profession.

According to preliminary assessments of sample files circulating online, the exposed information reportedly includes full names, email addresses, phone numbers, residential and business addresses, membership records, scanned identification documents, certificates, and even internal source codes linked to digital systems.

While the authenticity of the full dataset has not been independently verified, cybersecurity observers note that the scale of the alleged leak is consistent with a growing pattern of attacks targeting financial institutions and professional bodies across Nigeria’s banking ecosystem.

Chartered Institute of Bankers of Nigeria, established in the early 1960s and chartered to regulate banking professionalism in the country, plays a central role in setting ethical and educational standards for bankers nationwide.

It counts major financial institutions, including the Central Bank of Nigeria and commercial banks, among its corporate members.

In recent years, the institute has itself acknowledged rising cyber risks affecting the financial sector, warning that banks and related institutions face increasing exposure to digital attacks, including website hijacking, ransomware threats, and data breaches targeting sensitive financial information.

This latest allegation adds to a series of reported cyber incidents involving Nigerian financial institutions, where attackers have increasingly focused on exploiting personal data for identity theft and phishing schemes.

Cybersecurity analysts say Nigeria has witnessed a broader surge in data breaches across banking, telecoms, and government systems, with millions of records reportedly circulating on the dark web in recent years.

The alleged CIBN breach, if confirmed, would further highlight vulnerabilities in institutional data protection frameworks and the growing sophistication of cybercriminal operations targeting financial ecosystems.

However, CIBN has not issued an official confirmation or denial regarding the alleged breach.

But, the need for immediate forensic investigation, member notification protocols, and a comprehensive audit of the institute’s digital infrastructure cannot be overlooked.

Authorities and data protection regulators are also expected to assess the claims as part of broader efforts to curb escalating cyber threats within Nigeria’s financial services sector.


Kindly share this post
Continue Reading

E-Business

Kaspersky MDR Introduces Major Updates, Strengthening Detection and Investigation Capabilities

Published

on

Kindly share this post

Kaspersky Managed Detection and Response now offers enhanced automation and incident management features, introduces a new offering for industrial and embedded systems, and delivers an improved customer experience. These advancements bolster security and enable a faster, more efficient response to threats.

Kaspersky MDR is adopted by organisations across a vast range of industries worldwide. In 2025, the solution detected up to three high-severity incidents driven by human activity daily, reducing response time by approximately 22% compared to the previous year.

This result, highlighted in a Global Report by Kaspersky Security Services, reflects enhanced efficiency driven by advanced automation, increased detection rules and the continuously perfected and dedicated expertise of Kaspersky’s specialists.

Keeping in mind that threats are becoming increasingly sophisticated and challenging to detect, Kaspersky recognises that solutions must be continuously refined. This principle is also applied to Kaspersky MDR, which is now being enhanced through a series of important updates designed to improve its value and deliver a better experience for customers.

New MDR offering for embedded and industrial systems

Kaspersky Embedded Systems Security 4.0 (KESS) and KICS for Nodes 4.5 now features a unified MDR agent. For embedded environments, this integrated approach simplifies onboarding and enhances manageability, enabling faster and more dependable MDR deployment. In industrial settings, it decreases operational complexity, strengthens resilience, and streamlines ongoing maintenance.

Enhanced detection and investigation capabilities

Kaspersky MDR now benefits from enhanced container telemetry provided by Kaspersky Endpoint Security for Linux 12.4. This advancement significantly improves visibility into containerised environments, boosts threat detection accuracy, and accelerates the identification of risks within container infrastructures.

Kaspersky MDR now also supports automated file transfers upon analyst request through Kaspersky Anti Targeted Attack 8.0 and Kaspersky Next EDR Expert 8.0. With advanced MDR integration enabled, relevant files are shared automatically, eliminating manual end-user actions. This streamlines collaboration, accelerates incident investigations, and enables faster responses to targeted attacks.

MDR incidents can now be escalated directly from the MDR portal to the Kaspersky Global Emergency Response Team for comprehensive investigation and response. This capability ensures end-to-end management of complex cyberattacks, from the initial response and evidence collection to identifying the primary attack vector and developing an effective mitigation plan.

MDR incidents can now be automatically exported to Kaspersky SIEM 4.0 for advanced analysis and correlation with other security events. This enhancement expands investigative capabilities while maintaining MDR as the central hub for incident management and response.

Enhanced accessibility and customer experience

A one-click incident escalation from Kaspersky Next EDR Expert to MDR is now available, empowering customers with greater control over incident management and ensuring rapid access to expert analysis and response guidance.

Kaspersky MDR now also provides enriched incident notifications via Telegram that allow real-time updates with priority levels, affected assets, tailored recommendations, and direct links to incidents, enabling customers to access vital information instantly without the need to log into the portal.

Furthermore, the MDR portal has been fully optimised for mobile devices and tablets, offering comprehensive access to all core functionalities. These improvements collectively allow customers to monitor incidents and manage their MDR services anytime and anywhere, thereby significantly increasing responsiveness and operational agility.

“At Kaspersky, we are committed to continuously enhancing our MDR to stay ahead of evolving cyber threats and protect organisations worldwide from all industries, 24/7. These latest updates bring extended integrations with the Kaspersky product portfolio, smarter automation and new features that enable quicker and even more precise responses – all to improve user experience because in today’s threat landscape, agility and precision are more critical than ever,” comments Renat Turianov, Kaspersky MDR Product Owner at Kaspersky.


Kindly share this post
Continue Reading

Trending