Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution on Most Dell Computers

d4stiny.github.io

Post reply on HN
Print view View original

31–40 of 323 posts

Re: Remote Code Execution on Most Dell Computers

#31

Post by stcredzero »

deogeo wrote: post #25
josteink wrote: post #11

Earlier quoted context omitted.

That caused so much of a backlash that they released a new BIOS version without that stuff. As was absolutely fair. Abusing Windows' ability to obtain HW-drivers though UEFI (something which can be used for good) to bundle shit-ware is just absolutely rotten.

Fair would be sending executives to jail for hacking. Releasing a non-backdoored BIOS was the absolute minimum. Edit: As pointed out by josteink, the BIOS wasn't backdoored - it was used to install a backdoor. But calling what it installed "insecure Windows-software" is also inaccurate. According to https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci... , its purpose was man-in-the-middle attacks against the…

Fair would be sending executives to jail for hacking.

That would be up to a prosecutor. A civil suit would take the form of a class action.

Re: Remote Code Execution on Most Dell Computers

#36

Post by cced »

jniedrauer wrote: post #15

General sanity aside, the whole exploit hinges on the fact that they used string parsing to check for the prefix "http". This wouldn't have been exploitable if they used a proper URL library.

Do you think that a proper Url library would have protected against a MITM’d DNS attack?

Re: Remote Code Execution on Most Dell Computers

#37

Post by ilikehurdles »

ru999gol wrote: post #29
twblalock wrote: post #17

Earlier quoted context omitted.

Microsoft should prevent this. It's not in their interest to allow OEMs to circumvent the normal software installation methods for Windows. It should be prohibited in whatever agreement OEMs make with Microsoft, and maybe Windows should prevent execution of such code if it's possible to tell it apart from drivers.

that's something Apple would do, but unfortunately Microsoft doesn't give a shit

I'm inclined to agree. Microsoft's philosophy has been "give vendors all the rope they could think of asking for" for a really long time.

Re: Remote Code Execution on Most Dell Computers

#38

Post by jseliger »

sneak wrote: post #13
NullPrefix wrote: post #4

Earlier quoted context omitted.

Lenovo pulled a stunt before where they loaded their "extra software" inside UEFI to be installed by Windows after a fresh install.

That’s astounding. Suddenly my “zero the entire storage, including partition table” methodology which I always somewhat regarded as overkill appears to be reasonable and/or necessary.

Such are the problems Purism is said to be attacking: https://puri.sm/products/librem-13/

Re: Remote Code Execution on Most Dell Computers

#39

Post by josteink »

deogeo wrote: post #25
josteink wrote: post #11

Earlier quoted context omitted.

That caused so much of a backlash that they released a new BIOS version without that stuff. As was absolutely fair. Abusing Windows' ability to obtain HW-drivers though UEFI (something which can be used for good) to bundle shit-ware is just absolutely rotten.

Fair would be sending executives to jail for hacking. Releasing a non-backdoored BIOS was the absolute minimum. Edit: As pointed out by josteink, the BIOS wasn't backdoored - it was used to install a backdoor. But calling what it installed "insecure Windows-software" is also inaccurate. According to https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci... , its purpose was man-in-the-middle attacks against the…

To be fair and technically correct, the BIOS itself was not backdoored.

The BIOS itself was fine, but it contained insecure Windows-software which it requested/instructed Windows to install.

Install any other OS (like Linux) and there would be no backdoor at all.

To be clear I’m not trying to defend Lenovo’s actions here, I’m just trying to be clear about what this incident was actually about. The simplistic description is IMO a bit too simplistic in this case.

Post reply on HN