Hacker News Reader

Comment by orf | Hacker News Reader

Once upon a time I spent a couple of hours looking at the Dell update utility and found that it pretty much allowed remote code execution to any web page your browser visits[1][2]. The quality of their code, the clear lack of anyone with any security knowledge looking at it and the 'fix' they deployed[3] made me never ever trust Dell again.

Seriously, their entire security relied on 'if url.endswith('dell.com')', plus a bunch of home grown 'encryption' that was utterly ridiculous. I'm sure if anyone spent a good hour or so looking at some of the oodles of software they pre-install on laptops you can dig up some other juicy exploits.

1. http://webcache.googleusercontent.com/search?q=cache:http://... (sites down at the moment :/)

2. http://www.theregister.co.uk/2015/04/08/dell_update_security...

3. They literally just updated their home grown encryption/authentication code and made it clear that they didn't understand the issue at all.

View on HN

Is this a hardware or a software boycott? Because I have trouble finding anything remotely decent when it comes to macbookpro alternatives. Then again, I just sorta assumed most people always did clean installs and wiped the pre-installed shit that every PC vendor bundles.

Honest question: could you even do that without buying an extra copy of Windows? Back in the old days you got a CD key with your PC, so you can install a fresh copy of Windows easily from your own media.

But nowadays it seems like not all keys are equal, and I'm under the impression that short of buying your own copy you can only reinstall the OEM, hacked-up version.

The key is in the bios now so you should be able to load any OS that's the same version i.e. pro or home.

I've never tried though. I don't know if there is still a different version for OEM or VL windows like XP had different key types.

I just went through this with a new Dell XPS for my dad.

I performed a wipe/reinstall (with media created directly from a Microsoft download) and Windows 10 never asked me for a key after reinstalling it, and it reports as being activated.

Seems like they've moved away from requiring an OEM key in addition to the SLIC BIOS signature.

They went a step further. Once a Windows 10 machine is activated, a "hash" of its hardware is taken and associated with the product key. When you reinstall Windows 10, the activation service matches your hardware information with the product key. You need to enter a product key only the first time you install Windows 10 on a particular machine.

When I was building machines and asked about the OEM licence, this hardware hash is related to the motherboard. MS consider a new motherboard a new PC, everything else you should get away with changing.

The problem is if you only do a software boycott they can just reinstall their crap

https://www.techdirt.com/articles/20150812/11395231925/lenov...

The problem is that the vendor OS disk is just a "factory reset" and not a clean windows copy.

Brilliant! Now third-party vendors can provide support by sending people to dell.com.shadysite.com! /s

Oops, it was actually checking if the URL ends with 'dell.com', not startswith, but yeah. Any script on 'scriptkiddydell.com' gets full SYSTEM RCE, on a program that shows no signs of running and starts automatically. It's pretty much malware...

Wait what? It doesn't even at least parse the URI to ensure that it's a dell subdomain? Damnit Dell.

Well, to be fair they do parse it, extract the hostname, then do the ridiculous "if hostname.endswith('dell.com')". The simple fix is to replace it with '.dell.com', but they didn't do that. No, they 'upgraded' their 'authentication' mechanism (just a sha256 hash of a hard-coded GUID + the current time) and called it a day.

Oh, and they obfuscated the binary for iron-clad maximum security.

> The simple fix is to replace it with '.dell.com', but they didn't do that.

That doesn't suffice either, unless they also enforce HTTPS. Otherwise, any network you connect to can spoof DNS and load a fake dell.com page over http to break your security.

(Of course, even if they did require HTTPS, the attacker could serve up a fake dell.com HTTPS site signed with eDellRoot...)

And either way, they have no business even allowing an authentic dell.com page to execute arbitrary code on your system, either.

> The simple fix is to replace it with '.dell.com', but they didn't do that.

That would be, if it were not for...

$ dig localhost.dell.com

; <<>> DiG 9.9.5-3ubuntu0.5-Ubuntu <<>> localhost.dell.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56836 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;localhost.dell.com. IN A

;; ANSWER SECTION: localhost.dell.com. 462 IN A 127.0.0.1

any explanation on that?

Essentially, there's a public DNS A record that maps a Dell subdomain to your local machine's IP, namely localhost.dell.com to 127.0.0.1

An attacker who can either abuse an already running local webserver (like Apache configured to listen to *:80) or start up a locally running webserver (using something like python's SimpleHTTPServer) can serve their content under a Dell subdomain.

This requires some sort of local filesystem privileges or potentially RCE, but if the original commenter is correct, this can be pivoted to SYSTEM RCE.

Reply on news.ycombinator.com