Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution on Most Dell Computers

d4stiny.github.io

Post reply on HN
Print view View original

11–20 of 323 posts

Re: Remote Code Execution on Most Dell Computers

#11

Post by josteink »

NullPrefix wrote: post #4
albertgoeswoof wrote: post #2

This is exactly why you should remove any bundled software from vendors and try to start afresh when picking up a new machine.

Lenovo pulled a stunt before where they loaded their "extra software" inside UEFI to be installed by Windows after a fresh install.

That caused so much of a backlash that they released a new BIOS version without that stuff. As was absolutely fair.

Abusing Windows' ability to obtain HW-drivers though UEFI (something which can be used for good) to bundle shit-ware is just absolutely rotten.

Re: Remote Code Execution on Most Dell Computers

#12

Post by the_pwner224 »

m00dy wrote: post #6

I'm not going to buy Dell again...

This is an exploit in the shitty software that OEMs put on their Windows images. Stuff like this is practically universal (minus Apple), and the fact that Dell hasn't (AFAIK) actively bundled very evil malware with their computers makes them far from the worst offender.

Re: Remote Code Execution on Most Dell Computers

#13

Post by sneak »

NullPrefix wrote: post #4
albertgoeswoof wrote: post #2

This is exactly why you should remove any bundled software from vendors and try to start afresh when picking up a new machine.

Lenovo pulled a stunt before where they loaded their "extra software" inside UEFI to be installed by Windows after a fresh install.

That’s astounding. Suddenly my “zero the entire storage, including partition table” methodology which I always somewhat regarded as overkill appears to be reasonable and/or necessary.

Re: Remote Code Execution on Most Dell Computers

#17

Post by twblalock »

josteink wrote: post #11
NullPrefix wrote: post #4

Earlier quoted context omitted.

Lenovo pulled a stunt before where they loaded their "extra software" inside UEFI to be installed by Windows after a fresh install.

That caused so much of a backlash that they released a new BIOS version without that stuff. As was absolutely fair. Abusing Windows' ability to obtain HW-drivers though UEFI (something which can be used for good) to bundle shit-ware is just absolutely rotten.

Microsoft should prevent this. It's not in their interest to allow OEMs to circumvent the normal software installation methods for Windows. It should be prohibited in whatever agreement OEMs make with Microsoft, and maybe Windows should prevent execution of such code if it's possible to tell it apart from drivers.

Re: Remote Code Execution on Most Dell Computers

#18

Post by Tharkun »

Tehnix wrote: post #16
_bxg1 wrote: post #14

Sounds like the attacker has to be on the local network (or presumably VPN) to use the exploit? If so that's a nontrivial hurdle in many cases.

Like a WiFi at a café or airport?

Public WiFi networks really should use client isolation. Sadly, many don't.

Re: Remote Code Execution on Most Dell Computers

#19

Post by throwaway5752 »

Dell service advisory (DSA): https://www.dell.com/support/article/us/en/19/sln316857/dsa-... (from this submission)

first CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-3718 (from DSA)

second CVE: https://nvd.nist.gov/vuln/detail/CVE-2019-3719 (also from DSA, this is the exploit described in this submission)

Post reply on HN