This is exactly why you should remove any bundled software from vendors and try to start afresh when picking up a new machine.
Remote Code Execution on Most Dell Computers
121–130 of 323 posts
Re: Remote Code Execution on Most Dell Computers
#122Earlier quoted context omitted.
That’s astounding. Suddenly my “zero the entire storage, including partition table” methodology which I always somewhat regarded as overkill appears to be reasonable and/or necessary.
Your approach won’t solve that, you’d need to also flash the chip with patched / clean firmware
Re: Remote Code Execution on Most Dell Computers
#123Earlier quoted context omitted.
Short of flashing the chip, which is impractical, are there any other "imperfect but probably sufficient" workarounds? For example, would loading Grub first, and then loading Windows from Grub, prevent the issue?
Basically none. You’ve got the ME (or AMD’s equivalent) on the CPU anyway so you really can’t avoid having some kind of root kit. Older Intel hardware that doesn’t have the ME or can be neutered is the best bet, and these machines don’t use UEFI anyway. Otherwise you could go for a non-Intel/AMD architecture, but there aren’t that many of those around anymore.
Re: Remote Code Execution on Most Dell Computers
#124 bool flag2 = file.Location.ToLower().StartsWith("http://");
if (flag2)
{
file.Location = file.Location.Replace("http://", "https://");
}
I trust the new version isn’t vulnerable to this...Re: Remote Code Execution on Most Dell Computers
#125OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…
Re: Remote Code Execution on Most Dell Computers
#126OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…
I remember one particular phone that had four user-configurable hardware buttons, but Verizon had locked them down so that they all opened the Verizon ringtone store.
The iPhone was a breath of fresh air if only for its software.
Re: Remote Code Execution on Most Dell Computers
#127OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…
Dell sells to Enterprise A LOT. This sounds like a tool intended for behind-corporate-firewall deployment that got promoted to the public.
Re: Remote Code Execution on Most Dell Computers
#128Slightly tongue in cheek to counter the anti-(Chinese/Russians) tone in recent times: Seeing how close Dell (both the company and the man) are to the US government, surely this is a backdoor by the Americans?
Dell fucked up and should be held accountable. Being in America they will more than likely face legal action of some sort over this. I would hope so anyway.
Re: Remote Code Execution on Most Dell Computers
#129OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…
Dell sells to Enterprise A LOT. This sounds like a tool intended for behind-corporate-firewall deployment that got promoted to the public.
Re: Remote Code Execution on Most Dell Computers
#130Earlier quoted context omitted.
Dell sells to Enterprise A LOT. This sounds like a tool intended for behind-corporate-firewall deployment that got promoted to the public.
No, this is a tool for consumers too, has been for a LONG LONG time