Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution on Most Dell Computers

d4stiny.github.io

Post reply on HN
Print view View original

241–250 of 323 posts

Re: Remote Code Execution on Most Dell Computers

#241

Post by BillDemirkapi »

tssva wrote: post #67
cryptonector wrote: post #50

OEM: Let's differentiate our otherwise commodity hw product! OEM: I know, let's add value with bundled software the customer can't uninstall! Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerabl…

The author chose to download the software from the OEM and the software can be uninstalled.

Dell SupportAssist comes pre-installed on most new Dell machines. The only reason it wasn't installed on my machine is because the drive I used was not prepared by Dell. Your average Dell user will have SupportAssist installed though you are right that it can be uninstalled.

Re: Remote Code Execution on Most Dell Computers

#242

Post by mises »

maxerickson wrote: post #225
mises wrote: post #166

Earlier quoted context omitted.

My S7 can still do it. The reason newer phones can't is because they lack an aux jack: the wire is used as an antenna. Another great reason to keep the headphone jack.

I don't know the current situation, but in the past most US carrier-sold phones have not had the antenna pin connected on the chip.

I'm not sure exactly what it is, though I know all the S7s do. I suppose it may be carrier-locked? I bought mine unlocked, not via a carrier. It's a handy feature, though. Free music and entertainment with zero data spent. I've got to wonder why people moved away from it. No signal issues either.

Re: Remote Code Execution on Most Dell Computers

#243

Post by rohit2412 »

dontbenebby wrote: post #150
rohit2412 wrote: post #141

Earlier quoted context omitted.

> often had hardware features locked out by software so that you could pay extra to unlock them. Funny, apple did this to iPod touch

>Funny, apple did this to iPod touch What feature did you pay to unlock on iPod touch? I'm struggling to remember...

https://www.intego.com/mac-security-blog/iphone-20-and-ipod-...

The first iPod touch had a broadcom chip that supported Bluetooth, but wasn't supported in the software stack. You needed to upgrade to use the Bluetooth hardware that you had already paid for.

Re: Remote Code Execution on Most Dell Computers

#244

Post by aosmith »

saulrh wrote: post #223
sfifs wrote: post #212

Earlier quoted context omitted.

Google branded hardware has a notorious reputation for problems about 1-1.5 year down the road. This has happened with every single Google device anyone in my family has ever owned and so we've basically stopped buying Google. Very few manufacturers apart from Samsung come close to Apple in terms of sheer hardware quality and service support and Apple OS's lack of customisability, pathetic camera and lack of 3.5mm ja…

? I used a Nexus 5 up until last year. Ended up upgrading last year, not because it had issues or because lineage stopped releasing for it, but because IT at my new job refused to let six-year-old devices on the network. Meanwhile, my parents complained continuously about their three-year-old iPhones getting slower and slower. Anecdotes, yeah, but...

My nexus 5 still works, I don't use it anymore but the thing was an absolute tank.

Re: Remote Code Execution on Most Dell Computers

#245

Post by tigershark »

saulrh wrote: post #223
sfifs wrote: post #212

Earlier quoted context omitted.

Google branded hardware has a notorious reputation for problems about 1-1.5 year down the road. This has happened with every single Google device anyone in my family has ever owned and so we've basically stopped buying Google. Very few manufacturers apart from Samsung come close to Apple in terms of sheer hardware quality and service support and Apple OS's lack of customisability, pathetic camera and lack of 3.5mm ja…

? I used a Nexus 5 up until last year. Ended up upgrading last year, not because it had issues or because lineage stopped releasing for it, but because IT at my new job refused to let six-year-old devices on the network. Meanwhile, my parents complained continuously about their three-year-old iPhones getting slower and slower. Anecdotes, yeah, but...

My iphone 4 was pretty much as fast as the nexus 5 and way less buggy. The nexus 5 is the only phone that I almost threw against a wall, I’ll never touch android anymore after that shit show. You must have a very high tolerance to bugs and poor performance. My friend was very happy when I sold him that piece of crap, so it must be subjective.

Re: Remote Code Execution on Most Dell Computers

#247

Post by bayareanative »

mro_master wrote: post #165
agumonkey wrote: post #56

Earlier quoted context omitted.

it's almost a psychology experiment where brands con you just enough and let you absorb the pain long enough that they forgot and start browsing for a new machine, repeating the cycle

But then the engineer in you says "I'll objectively choose the best hardware", and you end up with another lenovo. I really think it is the Windows Wizard Warriors that complain about bloatware, I always wipe it and start with a fresh install.

I don't use Windows, but Lenovos ship without any bloatware. Vanilla Windows plus their drivers. That's it.

Re: Remote Code Execution on Most Dell Computers

#248

Post by Iv »

tl;dr:

A software opens a port to allow a remote website trigger "download and execute" actions on a URL pointing to an .exe file.

The security check they have is that they check the domain is dell.com and that the string starts with "https://". If it starts with http:// it is replaced by the https version. In theory I could consider this risky but safe.

The mistake is that they do not force a URL that starts with something else to fail. The attacker could bypass the check by providing " http://fakedns.dell.com/haxorz.exe" (with a space at the beginning) and it passed the check.

This is not the first flaw of this style I am seeing. I don't think a teacher ever explicitly told it to me but I always assumed that relying on DNS for authentication was a dangerous thing to do and that URLs were doing too many things behind the scenes to be trustworthy without being extremely picky.

Maybe it all changed with https, but trusting the execution of an exe without at least checking the a crypto signature lights some red flags in my brain.

Re: Remote Code Execution on Most Dell Computers

#249

Post by robk »

ericfrederich wrote: post #234
elagost wrote: post #144

I don't think there will ever come a time when 1) savvy users will stop suggesting/recommending clean Windows installs on new computers and 2) OEM bloatware will stop being crap. I clean-installed Win10 recently. There was no driver installation I had to do - everything works great, and there are no unidentified devices in Device Manager. Say what you will about Windows 10, but that part is really cool. Save for vide…

I have a Lenovo Thinkpad Yoga x1. I'm afraid to reinstall fresh Windows because of stylus

Works fine w one exe from Lenovo

Re: Remote Code Execution on Most Dell Computers

#250

Post by neilv »

aosmith wrote: post #244
saulrh wrote: post #223

Earlier quoted context omitted.

? I used a Nexus 5 up until last year. Ended up upgrading last year, not because it had issues or because lineage stopped releasing for it, but because IT at my new job refused to let six-year-old devices on the network. Meanwhile, my parents complained continuously about their three-year-old iPhones getting slower and slower. Anecdotes, yeah, but...

My nexus 5 still works, I don't use it anymore but the thing was an absolute tank.

The Nexus 5 is one of my favorite devices for PostmarketOS (project to get sustainable mainline Linux on smartphones and tablets): https://wiki.postmarketos.org/wiki/Google_Nexus_5_(lg-hammer...
Post reply on HN