Live data from Hacker News

Remote Code Execution on Most Dell Computers

d4stiny.github.io

151–160 of 323 posts

Re: Remote Code Execution on Most Dell Computers

#151

Earlier quoted context omitted.

It works, too. This is partly why the iPhone was so popular, at first. It's been so long now that probably everyone has forgotten, but before the iPhone, essentially every smartphone on the market was fully loaded with trialware, crapware, and often had hardware features locked out by software so that you could pay extra to unlock them. I remember one particular phone that had four user-configurable hardware buttons,…

> often had hardware features locked out by software so that you could pay extra to unlock them. Funny, apple did this to iPod touch

Yes, I can remember the update to iPhone OS 2.0 was a paid update for the iPod Touch 1Gen.

Re: Remote Code Execution on Most Dell Computers

#152
post #106

Slightly tongue in cheek to counter the anti-(Chinese/Russians) tone in recent times: Seeing how close Dell (both the company and the man) are to the US government, surely this is a backdoor by the Americans?

I don’t think this should be tongue in cheek. This is understood and considered to be acceptable when you’re in the US.

What the US takes issue with is foreign governments having that kind of power.

Re: Remote Code Execution on Most Dell Computers

#153

OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…

Second product for this mythical OEM should just be a TV with an instant-on button and as many hdmi ports that will fit given a small-as-possible bezel. One model per year per common size->one price. Big sale on thanksgiving and then the slightly better ones come out.

> a TV with an instant-on button

Please. I use a 4k TV as my computer monitor. It's works fairly well for that because I researched it and found a good fit, but I use a remote to start it every time, and it takes 15-20 seconds before it's ready to receive input. That's a long time to be sitting in front of your computer waiting, especially when it happens 3-10 times a day.

Re: Remote Code Execution on Most Dell Computers

#155
I bought an Alienware that cost 4300$ last year, and that's after 900$ in savings.

The computer arrived in a box that had 2 handle sized holes in it and I could see the computer directly exposed from the outside without the box being open. It had shipment dust and debris INSIDE THE BOX. It's the saddest, cheapest, most sorry ass excuse for a shipment I've ever seen. I took pictures, I couldn't believe it.

Then I booted it up and was inundated with Dell pre-installed software. Wiped the thing clean, got a Win10 ISO directly from MS and called it a day. This will be the last Dell I ever buy. Lesson learned.

Re: Remote Code Execution on Most Dell Computers

#156

The author exploited this by adding a space to the URL so it no longer started with http:// rather (space) http:// but it looks like the call to Replace would be ineffective if the URL started with HTTP:// as well. bool flag2 = file.Location.ToLower().StartsWith("http://"); if (flag2) { file.Location = file.Location.Replace("http://", "https://"); } I trust the new version isn’t vulnerable to this...

There were a bunch of ways to bypass the check. For example another way would be to use "http:\\" which wouldn't get detected either. The new version isn't vulnerable.

Re: Remote Code Execution on Most Dell Computers

#157

Cannot this vulnerability be exploited by creating a free wi-fi access point, opening a captive portal on user's device and attacking them from there? Another option is to wait until the victim requests something with HTTP (some ad networks still use it) and inject the payload into the traffic.

Yep.

Re: Remote Code Execution on Most Dell Computers

#158
post #70

What is the bounty on a report like this, and does Dell operate an official bug bounty program? How much do you think a report like this should be worth? "Dell bug bounty program" and the like don't turn up obvious results to me.

Unfortunately Dell doesn't pay bounties no matter how serious the bug is.

Re: Remote Code Execution on Most Dell Computers

#159

Earlier quoted context omitted.

Second product for this mythical OEM should just be a TV with an instant-on button and as many hdmi ports that will fit given a small-as-possible bezel. One model per year per common size->one price. Big sale on thanksgiving and then the slightly better ones come out.

> a TV with an instant-on button Please . I use a 4k TV as my computer monitor. It's works fairly well for that because I researched it and found a good fit, but I use a remote to start it every time, and it takes 15-20 seconds before it's ready to receive input. That's a long time to be sitting in front of your computer waiting, especially when it happens 3-10 times a day.

I avoid those problems by never turning my TV or monitor off. It does mean they light up the room at night so it wouldn't work if you had it in a bedroom.

Re: Remote Code Execution on Most Dell Computers

#160

Earlier quoted context omitted.

> often had hardware features locked out by software so that you could pay extra to unlock them. Funny, apple did this to iPod touch

>Funny, apple did this to iPod touch What feature did you pay to unlock on iPod touch? I'm struggling to remember...

Apps, initial few software updates were paid. Version 1 didn't have the app store, they pushed web apps initially
Post reply on HN