Remote Code Execution on Most Dell Computers • Hacker News Board

Re: Remote Code Execution on Most Dell Computers

#111

Post by cryptonector » Wed, May 01, 2019, 9:17 PM UTC

tssva wrote: post #87

mwexler wrote: post #78

Earlier quoted context omitted.

Dell SupportAssistant was preinstalled on my machine. It was the easiest way to find Dell's customized driver updates since they are difficult to find (which of the many network drivers does my machine need?). It's sad that it has problems, but it's supposed to make maintenance easier. HP has something similar.

It may come preinstalled but in this case the author wiped the computer, reinstalled Windows and then voluntarily installed the software while visiting the Dell support site checking for updated drivers. It is also able to be uninstalled which the original comment suggested it could not be.

Because the author was doing research? Come on.

Re: Remote Code Execution on Most Dell Computers

#112

Post by cjbprime » Wed, May 01, 2019, 9:23 PM UTC

bredren wrote: post #70

What is the bounty on a report like this, and does Dell operate an official bug bounty program? How much do you think a report like this should be worth? "Dell bug bounty program" and the like don't turn up obvious results to me.

Dell probably doesn't run one. If it did, I'd guess somewhere on the order of $20k? If the exploit was being bought by a company who traffics in zero-day exploits, some multiples larger of that.

Re: Remote Code Execution on Most Dell Computers

#113

Post by m463 » Wed, May 01, 2019, 9:24 PM UTC

NullPrefix wrote: post #4

albertgoeswoof wrote: post #2

This is exactly why you should remove any bundled software from vendors and try to start afresh when picking up a new machine.

Lenovo pulled a stunt before where they loaded their "extra software" inside UEFI to be installed by Windows after a fresh install.

oh come on, it uninstalls itself after it has collected enough data.

(sarcasm)

[i thought it uninstalled itself after a few months]

Re: Remote Code Execution on Most Dell Computers

#114

Post by swsieber » Wed, May 01, 2019, 9:28 PM UTC

cryptonector wrote: post #50

OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…

Really, I thought it was

  OEM: Let's make more money.
  OEM: We can sell out our users while claiming we aren't.

Re: Remote Code Execution on Most Dell Computers

#115

Post by sonnyblarney » Wed, May 01, 2019, 9:28 PM UTC

cryptonector wrote: post #50

OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…

It's odd how powerful MS is in this equation, and how the don't step in and add some sanity.

It's possible to have pre-loaded software without ruining everything.

Re: Remote Code Execution on Most Dell Computers

#116

Post by jondubois » Wed, May 01, 2019, 9:28 PM UTC

ilaksh wrote: post #107

peter_d_sherman wrote: post #86

First off, great article. But, like so many other articles about security vulnerabilities, there seems to be a general attitude among most people (including many IT shops) that "it's an isolated incident", and "the experts will fix it...". "It's an isolated incident", and "The experts will fix it...". They said the same thing about Spectre, Meltdown, Rowhammer attacks, what have you. "It's an isolated incident", and…

Well I think it's very possible that backdoors are set up by governments like you say. But I also think that even if they don't, it also seems very possible that vulnerabilities are quite common as mistakes. Just due to the realities of security. In my opinion security is much more difficult than people realize. For example in this case there seems to be a majority opinion something along the lines of "What an idiot!…

Yes I don't think that the government needs to plant vulnerabilities to get backdoors into people's machines. Finding vulnerabilities is not that difficult. The more moving parts you have and the more complex the code is, the more likely it is that there are vulnerabilities in the software.

Re: Remote Code Execution on Most Dell Computers

#117

Post by GordonS » Wed, May 01, 2019, 9:30 PM UTC

Given this is an RCE, and affects so many machines, does anyone else think it's unreasonable that it took Dell 5 months to fix this?

Aside from anything else, it would have been terrible publicity for Dell if an exploit for this vulnerability was used in a large malware campaign - I just don't get why they would wait so long to fix it.

Re: Remote Code Execution on Most Dell Computers

#118

Post by GordonS » Wed, May 01, 2019, 9:31 PM UTC

driverdan wrote: post #94

jniedrauer wrote: post #15

General sanity aside, the whole exploit hinges on the fact that they used string parsing to check for the prefix "http". This wouldn't have been exploitable if they used a proper URL library.

It doesn't even need a library. A simple regex would have prevented this.

A naive regex would just as easily have exactly the same issue, e.g. "^http:"

Re: Remote Code Execution on Most Dell Computers

#119

Post by flattone » Wed, May 01, 2019, 9:32 PM UTC

zanny wrote: post #109

cryptonector wrote: post #50

OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…

In both the phone and PC space I do not understand the need to do this at all. There is commoditization of the market on the low end, but high end products that compete with iphones and macbooks are definitely not commodity and there is ample differentiation to be had on quality where mindshare can reap substantial margins on a smart investment of good design.

do not understand the not understanding that businesses seem to exist to monetize every possible aspect of their existence.

Re: Remote Code Execution on Most Dell Computers

#120

Post by sneak » Wed, May 01, 2019, 9:34 PM UTC

snazz wrote: post #103

Wowfunhappy wrote: post #99

Earlier quoted context omitted.

Short of flashing the chip, which is impractical, are there any other "imperfect but probably sufficient" workarounds? For example, would loading Grub first, and then loading Windows from Grub, prevent the issue?

Basically none. You’ve got the ME (or AMD’s equivalent) on the CPU anyway so you really can’t avoid having some kind of root kit. Older Intel hardware that doesn’t have the ME or can be neutered is the best bet, and these machines don’t use UEFI anyway. Otherwise you could go for a non-Intel/AMD architecture, but there aren’t that many of those around anymore.

Disabling all of the parts of the ME except the part that lets the computer stay powered on is fortunately now well-documented (NSA-requested HAP support).