Remote Code Execution on Most Dell Computers • Hacker News Board

Re: Remote Code Execution on Most Dell Computers

#231

Post by cryptonector » Thu, May 02, 2019, 2:38 AM UTC

baby wrote: post #194

cryptonector wrote: post #50

OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…

Can someone repost this with normal quotes? On my phone

I wrapped it short so it would work on mobile. I guess it didn't.

Re: Remote Code Execution on Most Dell Computers

#232

Post by carleton » Thu, May 02, 2019, 2:39 AM UTC

MagicPropmaker wrote: post #168

tssva wrote: post #92

Earlier quoted context omitted.

Apple bundles plenty of software on their computers which I don't want, have never used, which increase the potential attack surface and which I can't uninstall. For example Apple Maps, Apple News, Home, and Books. In fact you can't uninstall any of the apps shipped with macOS. Not even the chess program.

Exactly! With Windows you do have choices. I bought a desktop PC from ThinkMate configured exactly as I wanted it with a plain vanilla Windows 10.

As another user said- "It's barely 5 megabytes.. and it's probably not connecting to anything.

The protections for pre-installed apps help to make sure nothing else tampers with them, e.g. injecting some malware, but I'm sure you can remove those protections and reclaim the 5 MB if you really wanted to."

[1] https://news.ycombinator.com/item?id=19803067

Re: Remote Code Execution on Most Dell Computers

#233

Post by fletchowns » Thu, May 02, 2019, 2:39 AM UTC

weq wrote: post #221

fletchowns wrote: post #185

Earlier quoted context omitted.

It was bad enough with the fucking Bixby button that can't be disabled on my Samsung S8 Active. Hearing about the S10 solidifies that my next phone will absolutely not be a Samsung. Which is a shame since the hardware is otherwise great.

Bixby remapper has worked of me since i bought my S8

I'm not interested in giving some random app a bunch of permissions.

Re: Remote Code Execution on Most Dell Computers

#234

Post by ericfrederich » Thu, May 02, 2019, 2:43 AM UTC

elagost wrote: post #144

I don't think there will ever come a time when 1) savvy users will stop suggesting/recommending clean Windows installs on new computers and 2) OEM bloatware will stop being crap. I clean-installed Win10 recently. There was no driver installation I had to do - everything works great, and there are no unidentified devices in Device Manager. Say what you will about Windows 10, but that part is really cool. Save for vide…

I have a Lenovo Thinkpad Yoga x1. I'm afraid to reinstall fresh Windows because of stylus

Re: Remote Code Execution on Most Dell Computers

#235

Post by saagarjha » Thu, May 02, 2019, 2:46 AM UTC

cryptonector wrote: post #182

mroche wrote: post #171

Earlier quoted context omitted.

Microsoft themselves would have to practice that before they can preach it. All the start menu apps they try and force on users...

Microsoft is changing lately.

The Candy Crush in my fresh Windows install (using media downloaded straight from microsoft.com) suggests otherwise.

Re: Remote Code Execution on Most Dell Computers

#236

Post by saagarjha » Thu, May 02, 2019, 2:46 AM UTC

jrochkind1 wrote: post #218

LeoPanthera wrote: post #126

Earlier quoted context omitted.

It works, too. This is partly why the iPhone was so popular, at first. It's been so long now that probably everyone has forgotten, but before the iPhone, essentially every smartphone on the market was fully loaded with trialware, crapware, and often had hardware features locked out by software so that you could pay extra to unlock them. I remember one particular phone that had four user-configurable hardware buttons,…

There were smartphones before the iPhone?

Blackberry?

Re: Remote Code Execution on Most Dell Computers

#237

Post by sara1232364 » Thu, May 02, 2019, 2:47 AM UTC

World's biggest cat Even you can't believe it's size See her video https://howto105.blogspot.com/2019/04/worlds-biggest-cat.htm...

They found world's biggest fish Even you can't believe how big fish is this That's unbelievable http://bit.ly/2FHl4pM

Even some goats are better than humans See that she did and they made her as mayor of city http://bit.ly/2UjTcS5

Re: Remote Code Execution on Most Dell Computers

#238

Post by [deleted] » Thu, May 02, 2019, 2:48 AM UTC

c- wrote: post #186

nanahgafvsva wrote: post #181

Nice writeup! Only feedback is it seems like you dont need to dna hijack anything. Seems like you can just register localhost-lollolanything.com and pull the attack off, no?

There's code that checks for the domain ending in .dell.com (etc) so it wouldn't work.

[deleted]

Re: Remote Code Execution on Most Dell Computers

#239

Post by stordoff » Thu, May 02, 2019, 2:49 AM UTC

driverdan wrote: post #198

GordonS wrote: post #118

Earlier quoted context omitted.

A naive regex would just as easily have exactly the same issue, e.g. "^http:"

That wouldn't have the same issue since the space at the beginning would fail that regex.

I believe that's parent's point. "https:" would be OK, "http: would be rejected, but " http:" would also be _accepted_ it. They looked for "http://" at the start of the string, instead of requiring "https://".

Replacing:

    bool flag2 = file.Location.ToLower().StartsWith("http://");

with:

    bool flag2 = Regex.IsMatch(file.Location.ToLower(), "^http:");

doesn't help. You have to make sure to actually replace http, not just check the start of the line.

Re: Remote Code Execution on Most Dell Computers

#240

Post by p_b_r » Thu, May 02, 2019, 2:49 AM UTC

cryptonector wrote: post #50

OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…

Gates killed that idea dead, back in the 80's.

EDS - Remember that big huge company H.Ross Perot Ran? - We TRIED to buy PCs from hardware vendors without Windows. They refused due to how Bill locked them into contracts. If it was to run Windows, then Windows was shipped with every single hardware sale. On the bill of lading.

Government doesn't pay for stuff they don't use. Didn't want Windows if they were to run UNIX (Santa Cruz Operations XENIX System 5, to be precise). Wonder why some people at SCO went crazy and snorted their futures? Blame Bill.