Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution on Most Dell Computers

d4stiny.github.io

Post reply on HN
Print view View original

41–50 of 323 posts

Re: Remote Code Execution on Most Dell Computers

#41

Post by ru999gol »

Tehnix wrote: post #16
_bxg1 wrote: post #14

Sounds like the attacker has to be on the local network (or presumably VPN) to use the exploit? If so that's a nontrivial hurdle in many cases.

Like a WiFi at a café or airport?

it should be mentioned that even with WPA2-PSK wifi you are vulnerable to arp spoofing

Re: Remote Code Execution on Most Dell Computers

#42

Post by walshemj »

deogeo wrote: post #25
josteink wrote: post #11

Earlier quoted context omitted.

That caused so much of a backlash that they released a new BIOS version without that stuff. As was absolutely fair. Abusing Windows' ability to obtain HW-drivers though UEFI (something which can be used for good) to bundle shit-ware is just absolutely rotten.

Fair would be sending executives to jail for hacking. Releasing a non-backdoored BIOS was the absolute minimum. Edit: As pointed out by josteink, the BIOS wasn't backdoored - it was used to install a backdoor. But calling what it installed "insecure Windows-software" is also inaccurate. According to https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci... , its purpose was man-in-the-middle attacks against the…

Or banning for a period of years the company from any government work as happened to Arthur Anderson in the UK.

Re: Remote Code Execution on Most Dell Computers

#43

Post by bahmboo »

twblalock wrote: post #17
josteink wrote: post #11

Earlier quoted context omitted.

That caused so much of a backlash that they released a new BIOS version without that stuff. As was absolutely fair. Abusing Windows' ability to obtain HW-drivers though UEFI (something which can be used for good) to bundle shit-ware is just absolutely rotten.

Microsoft should prevent this. It's not in their interest to allow OEMs to circumvent the normal software installation methods for Windows. It should be prohibited in whatever agreement OEMs make with Microsoft, and maybe Windows should prevent execution of such code if it's possible to tell it apart from drivers.

Pretty sure there was a USG lawsuit about what MSFT could require from OEMs.

Re: Remote Code Execution on Most Dell Computers

#46

Post by bennofs »

jniedrauer wrote: post #15

General sanity aside, the whole exploit hinges on the fact that they used string parsing to check for the prefix "http". This wouldn't have been exploitable if they used a proper URL library.

URL parsers also have bugs (or at least don't all agree on one parsing if you rely on more than one parser). Just take a look at https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-... for some fun examples.

Re: Remote Code Execution on Most Dell Computers

#49

Post by mosdl »

ergothus wrote: post #48

I've not yet seen anyone comment on the fact that Dell was informed in late Oct, confirmed by late Nov...and the public was advised in mid April. That's a lot of time for a known and confirmed vulnerability to be undisclosed, isn't it?

Could be that it took a while to distribute the fix to all the affected PCs?

Re: Remote Code Execution on Most Dell Computers

#50

Post by cryptonector » 

  OEM: Let's differentiate our otherwise
       commodity hw product!
  OEM: I know, let's add value with bundled
       software the customer can't uninstall!
Then the bundled software turns out to (inevitably) be useless vulnerable garbage. Inevitably because a) the customer doesn't need it, b) it's engineered with all the effort that normally goes into adware for captive audiences (i.e., _minimal_), which means it will be vulnerable.

Here's an idea:

  OEM: Let's differentiate our otherwise
       commodity hw product!
  OEM: Let's add NO bundled software.
That would be fantastic.
Post reply on HN