Earlier quoted context omitted.
Yeah, 99% of dell computers
I have a Dell XPS 13 with Ubuntu.
Are you contesting that 99% of Dell laptops are running Windows? Your comment seems like a nonsequiter.
Remote Code Execution on Most Dell Computers
81–90 of 323 posts
Re: Remote Code Execution on Most Dell Computers
#82Earlier quoted context omitted.
I was thinking in enterprise contexts, but, yes, that's fair. Still, anybody doing anything important on public WiFi should be using a VPN.
How will a vpn protect the user if the target laptop is listening on a public wifi connection?
Actually maybe it wouldn't... I guess underneath the VPN it still has to be listening.
Re: Remote Code Execution on Most Dell Computers
#83jesus fucking christ. gotta block that port ASAP
Re: Remote Code Execution on Most Dell Computers
#84Earlier quoted context omitted.
The author chose to download the software from the OEM and the software can be uninstalled.
Dell SupportAssistant was preinstalled on my machine. It was the easiest way to find Dell's customized driver updates since they are difficult to find (which of the many network drivers does my machine need?). It's sad that it has problems, but it's supposed to make maintenance easier. HP has something similar.
You only have that issue if you search by the model of your PC. For Dell, search by the service tag (short string of letters and numbers) and you will get the drivers for only the hardware that PC shipped with. For HP enter the serial number.
Re: Remote Code Execution on Most Dell Computers
#85I'm not going to buy Dell again...
This is an exploit in the shitty software that OEMs put on their Windows images. Stuff like this is practically universal (minus Apple), and the fact that Dell hasn't (AFAIK) actively bundled very evil malware with their computers makes them far from the worst offender.
[deleted]
Re: Remote Code Execution on Most Dell Computers
#86First off, great article.
But, like so many other articles about security vulnerabilities, there seems to be a general attitude among most people (including many IT shops) that "it's an isolated incident", and "the experts will fix it...".
"It's an isolated incident", and "The experts will fix it...".
They said the same thing about Spectre, Meltdown, Rowhammer attacks, what have you.
"It's an isolated incident", and "The experts will fix it...".
Well, if you read HN long enough, you'd know that there's too much of this on too regular a basis to continue to espouse those views.
I'm going to go for broke here.
I'm going to put on my conspiracy "what if" tin-foil hat, and ask two questions.
The first is related to Virus-Checking and Security Software -- like Norton, McAfee, etc. how do we know that any of it doesn't contain remote code execution (aka major security) vulnerabilities?
You see, if I were the bad guys, that's where I'd put it.
Also, let's say you have Nation States. Could you see one of these guys "persuading, for the good of their country" one or more of their same-nationality corporations to put such vulnerabilities into their "Security" software?
In other words, maybe you have a Chinese producer of anti-virus/security software, and maybe it has little "surprises" for non-Chinese Citizens.
Maybe you have an American producer of anti-virus/security software, and it too has little "surprises" for non-American Citizens.
You see? Nation A thinks that it's permissible and OK for it to compromise Nation B's "Security" software. And Nation B thinks the same thing, but in reverse.
Even if Nation States are removed from the equation, you still have the Virus Checker/Security software company themselves. How do you know that random employees at that company haven't tainted that software in some way?
In other words, "Who guards the guardians?"
Which is my second question.
It's an ancient philosophical question.
"Who guards the guardians?"
We The People - do not seem to be doing such a good job these days...
All I know is that you might be seeing a whole lot more "isolated incidents" that "the experts will have to fix" in the future, unless We The People - step up to the plate...
Re: Remote Code Execution on Most Dell Computers
#87Earlier quoted context omitted.
The author chose to download the software from the OEM and the software can be uninstalled.
Dell SupportAssistant was preinstalled on my machine. It was the easiest way to find Dell's customized driver updates since they are difficult to find (which of the many network drivers does my machine need?). It's sad that it has problems, but it's supposed to make maintenance easier. HP has something similar.
It may come preinstalled but in this case the author wiped the computer, reinstalled Windows and then voluntarily installed the software while visiting the Dell support site checking for updated drivers. It is also able to be uninstalled which the original comment suggested it could not be.
Re: Remote Code Execution on Most Dell Computers
#88This is exactly why you should remove any bundled software from vendors and try to start afresh when picking up a new machine.
Unfortunately I have a MacBook and Apple won't even let me uninstall the chess program bundled with macOS.
Re: Remote Code Execution on Most Dell Computers
#89Dell Computers running Windows, it looks like?
Yeah, 99% of dell computers
Sadly. It disappoints me so much that linux hasn't been able to crack Windows dominance on desktop/laptop. I was sure that as more people became computer "literate", they'd shift to linux or bsd in droves. Boy was I wrong.
Re: Remote Code Execution on Most Dell Computers
#90There is also the neat tool "Dell Display Manager". The only way to avoid the moody touch buttons on some Dell monitors to change their brightness: - updates served via HTTP through the browser only - as a binary (exe) - from a domain other than dell.com (delldisplaymanager.com) - signed by a 3rd party (En Tech Taiwan) - and nagging about updates every reboot (you can get an outdated version via dell.com, but it will…
Not the only way. I used to use ddctool [0] to change brightness on monitors and it worked even with some cheap old Benq displays. Unfortunately Linux doesn't support DDC over DisplayPort Multi-Stream Transport, but you won't need to worry about that. All you need is some Windows alternative to ddctool. This was the first search hit: https://www.clickmonitorddc.bplaced.net/