Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution on Most Dell Computers

d4stiny.github.io

Post reply on HN
Print view View original

131–140 of 323 posts

Re: Remote Code Execution on Most Dell Computers

#131

Post by Skunkleton »

snazz wrote: post #104
mcbits wrote: post #101

Earlier quoted context omitted.

> If you leave Bluetooth ... enabled, then it is being tracked. Wait, can you expand on this? Are you saying (current, existing) Bluetooth radios can be used for location tracking without additional hardware/OS support?

Maybe the MAC address or other broadcasted information could be used to fingerprint your device. That’s why WiFi MAC addresses are randomized on iOS, but I’m not sure that Bluetooth has gotten the same treatment.

Apple sells this as a product (iBeacon). There are others.

Re: Remote Code Execution on Most Dell Computers

#132

Post by anfilt »

bennofs wrote: post #46
jniedrauer wrote: post #15

General sanity aside, the whole exploit hinges on the fact that they used string parsing to check for the prefix "http". This wouldn't have been exploitable if they used a proper URL library.

URL parsers also have bugs (or at least don't all agree on one parsing if you rely on more than one parser). Just take a look at https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-... for some fun examples.

I watched that talk a while ago. It convinced of one thing you should only have one URL parser in a project, and don't pass a url to any thing that may parse it differently.

It also made it clear that trying to use a URL to restrict stuff is a bad idea. Like the dell updater could only load signed requests which means an attacker would have to get dell's private key for signing.

Re: Remote Code Execution on Most Dell Computers

#133

Post by snazz »

shawnz wrote: post #108
josteink wrote: post #105

Earlier quoted context omitted.

You got it completely backwards. UEFI doesn't install anything. It provides a machine-specific binary for Windows to install (intended to ensure that Windows has proper drivers for all the machine’s hardware). Windows then decides to install this, based on the assumption that OEMs won’t bundle non-critical shit-ware using this method. Which has turned out to be the faulty assumption here. Either way: Use any other OS…

I think the parent is getting confused because previously Lojack did work as they describe, by injecting its binaries into the filesystem like that. But I guess they have now switched to using this WPBT feature instead.

Oh. That makes much more sense! Thanks for the clarification.

Re: Remote Code Execution on Most Dell Computers

#134

Post by codedokode »

Cannot this vulnerability be exploited by creating a free wi-fi access point, opening a captive portal on user's device and attacking them from there? Another option is to wait until the victim requests something with HTTP (some ad networks still use it) and inject the payload into the traffic.

Re: Remote Code Execution on Most Dell Computers

#135

Post by gmueckl »

jniedrauer wrote: post #15

General sanity aside, the whole exploit hinges on the fact that they used string parsing to check for the prefix "http". This wouldn't have been exploitable if they used a proper URL library.

The sane thing would have been to not use a HTTP server at all. This part is pure laziness. It is trivial to communicate with a Windows service locally through named pipes.

Re: Remote Code Execution on Most Dell Computers

#137

Post by cryptonector »

sonnyblarney wrote: post #115
cryptonector wrote: post #50

OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…

It's odd how powerful MS is in this equation, and how the don't step in and add some sanity. It's possible to have pre-loaded software without ruining everything.

Right? MSFT could easily put an end to this nonsense.

Re: Remote Code Execution on Most Dell Computers

#138

Post by throw_away »

cryptonector wrote: post #50

OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…

Second product for this mythical OEM should just be a TV with an instant-on button and as many hdmi ports that will fit given a small-as-possible bezel. One model per year per common size->one price. Big sale on thanksgiving and then the slightly better ones come out.

Re: Remote Code Execution on Most Dell Computers

#139

Post by cryptonector »

LeoPanthera wrote: post #126
cryptonector wrote: post #50

OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…

It works, too. This is partly why the iPhone was so popular, at first. It's been so long now that probably everyone has forgotten, but before the iPhone, essentially every smartphone on the market was fully loaded with trialware, crapware, and often had hardware features locked out by software so that you could pay extra to unlock them. I remember one particular phone that had four user-configurable hardware buttons,…

Exactly. Doing better by your customers is a differentiator. It's worked very well for Apple. Microsoft could easily take a consumer-friendly stance on OEMs preinstalling software. Microsoft please!

Re: Remote Code Execution on Most Dell Computers

#140

Post by codedokode »

euroclydon wrote: post #35
Tharkun wrote: post #18

Earlier quoted context omitted.

Public WiFi networks really should use client isolation. Sadly, many don't.

You can just go to a public place and run your own hotspot.

And use a name and SSID of some well-known public WiFi network. Then make a captive portal to force the user open an attacker-controlled page in a browser.
Post reply on HN