4 ms·

Once upon a time I spent a couple of hours looking at the Dell update utility and found that it pretty much allowed remote code execution to any web page your b

by orf 11y ago

Once upon a time I spent a couple of hours looking at the Dell update utility and found that it pretty much allowed remote code execution to any web page your browser visits[1][2]. The quality of their code, the clear lack of anyone with any security knowledge looking at it and the 'fix' they deployed[3] made me never ever trust Dell again. Seriously, their entire security relied on 'if url.endswith('dell.com')', plus a bunch of home grown 'encryption' that was utterly ridiculous. I'm sure if anyone spent a good hour or so looking at some of the oodles of software they pre-install on laptops you can dig up some other juicy exploits. 1. http://webcache.googleusercontent.com/search?q=cache:http://tomforb.es/dell-system-detect-rce-vulnerability http://webcache.googleusercontent.com/search?q=cache:http://... (sites down at the moment :/) 2. http://www.theregister.co.uk/2015/04/08/dell_update_security_concerns/ http://www.theregister.co.uk/2015/04/08/dell_update_security... 3. They literally just updated their home grown encryption/authentication code and made it clear that they didn't understand the issue at all.

skykooler 11y ago
Brilliant! Now third-party vendors can provide support by sending people to dell.com.shadysite.com! /s
- orf 11y ago
  Oops, it was actually checking if the URL ends with 'dell.com', not startswith, but yeah. Any script on 'scriptkiddydell.com' gets full SYSTEM RCE, on a program that shows no signs of running and starts automatically. It's pretty much malware...
  - dcherman 11y ago
    Wait what? It doesn't even at least parse the URI to ensure that it's a dell subdomain? Damnit Dell.
    - orf 11y ago
      Well, to be fair they do parse it, extract the hostname, then do the ridiculous "if hostname.endswith('dell.com')". The simple fix is to replace it with '.dell.com', but they didn't do that. No, they 'upgraded' their 'authentication' mechanism (just a sha256 hash of a hard-coded GUID + the current time) and called it a day. Oh, and they obfuscated the binary for iron-clad maximum security.
      - mwh12 11y ago
        > The simple fix is to replace it with '.dell.com', but they didn't do that. That would be, if it were not for... $ dig localhost.dell.com ; <<>> DiG 9.9.5-3ubuntu0.5-Ubuntu <<>> localhost.dell.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56836 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;localhost.dell.com. IN A ;; ANSWER SECTION: localhost.dell.com. 462 IN A 127.0.0.1
        baby 11y ago
        any explanation on that?
        mwh12 11y ago
        Essentially, there's a public DNS A record that maps a Dell subdomain to your local machine's IP, namely localhost.dell.com to 127.0.0.1 An attacker who can either abuse an already running local webserver (like Apache configured to listen to *:80) or start up a locally running webserver (using something like python's SimpleHTTPServer) can serve their content under a Dell subdomain. This requires some sort of local filesystem privileges or potentially RCE, but if the original commenter is correct, this can be pivoted to SYSTEM RCE.
      - JoshTriplett 11y ago
        > The simple fix is to replace it with '.dell.com', but they didn't do that. That doesn't suffice either, unless they also enforce HTTPS. Otherwise, any network you connect to can spoof DNS and load a fake dell.com page over http to break your security. (Of course, even if they did require HTTPS, the attacker could serve up a fake dell.com HTTPS site signed with eDellRoot...) And either way, they have no business even allowing an authentic dell.com page to execute arbitrary code on your system, either.
meritt 11y ago
Is this a hardware or a software boycott? Because I have trouble finding anything remotely decent when it comes to macbookpro alternatives. Then again, I just sorta assumed most people always did clean installs and wiped the pre-installed shit that every PC vendor bundles.
- potatolicious 11y ago
  Honest question: could you even do that without buying an extra copy of Windows? Back in the old days you got a CD key with your PC, so you can install a fresh copy of Windows easily from your own media. But nowadays it seems like not all keys are equal, and I'm under the impression that short of buying your own copy you can only reinstall the OEM, hacked-up version.
  - Already__Taken 11y ago
    The key is in the bios now so you should be able to load any OS that's the same version i.e. pro or home. I've never tried though. I don't know if there is still a different version for OEM or VL windows like XP had different key types.
    - lashkari 11y ago
      I just went through this with a new Dell XPS for my dad. I performed a wipe/reinstall (with media created directly from a Microsoft download) and Windows 10 never asked me for a key after reinstalling it, and it reports as being activated. Seems like they've moved away from requiring an OEM key in addition to the SLIC BIOS signature.
      - sfilipov 11y ago
        They went a step further. Once a Windows 10 machine is activated, a "hash" of its hardware is taken and associated with the product key. When you reinstall Windows 10, the activation service matches your hardware information with the product key. You need to enter a product key only the first time you install Windows 10 on a particular machine.

by orf 11y ago

skykooler 11y ago

Brilliant! Now third-party vendors can provide support by sending people to dell.com.shadysite.com! /s

orf 11y ago
Oops, it was actually checking if the URL ends with 'dell.com', not startswith, but yeah. Any script on 'scriptkiddydell.com' gets full SYSTEM RCE, on a program that shows no signs of running and starts automatically. It's pretty much malware...
- dcherman 11y ago
  Wait what? It doesn't even at least parse the URI to ensure that it's a dell subdomain? Damnit Dell.
  - orf 11y ago
    Well, to be fair they do parse it, extract the hostname, then do the ridiculous "if hostname.endswith('dell.com')". The simple fix is to replace it with '.dell.com', but they didn't do that. No, they 'upgraded' their 'authentication' mechanism (just a sha256 hash of a hard-coded GUID + the current time) and called it a day. Oh, and they obfuscated the binary for iron-clad maximum security.
    - mwh12 11y ago
      > The simple fix is to replace it with '.dell.com', but they didn't do that. That would be, if it were not for... $ dig localhost.dell.com ; <<>> DiG 9.9.5-3ubuntu0.5-Ubuntu <<>> localhost.dell.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56836 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;localhost.dell.com. IN A ;; ANSWER SECTION: localhost.dell.com. 462 IN A 127.0.0.1
      - baby 11y ago
        any explanation on that?
        mwh12 11y ago
        Essentially, there's a public DNS A record that maps a Dell subdomain to your local machine's IP, namely localhost.dell.com to 127.0.0.1 An attacker who can either abuse an already running local webserver (like Apache configured to listen to *:80) or start up a locally running webserver (using something like python's SimpleHTTPServer) can serve their content under a Dell subdomain. This requires some sort of local filesystem privileges or potentially RCE, but if the original commenter is correct, this can be pivoted to SYSTEM RCE.
    - JoshTriplett 11y ago
      > The simple fix is to replace it with '.dell.com', but they didn't do that. That doesn't suffice either, unless they also enforce HTTPS. Otherwise, any network you connect to can spoof DNS and load a fake dell.com page over http to break your security. (Of course, even if they did require HTTPS, the attacker could serve up a fake dell.com HTTPS site signed with eDellRoot...) And either way, they have no business even allowing an authentic dell.com page to execute arbitrary code on your system, either.

meritt 11y ago

Is this a hardware or a software boycott? Because I have trouble finding anything remotely decent when it comes to macbookpro alternatives. Then again, I just sorta assumed most people always did clean installs and wiped the pre-installed shit that every PC vendor bundles.

potatolicious 11y ago
Honest question: could you even do that without buying an extra copy of Windows? Back in the old days you got a CD key with your PC, so you can install a fresh copy of Windows easily from your own media. But nowadays it seems like not all keys are equal, and I'm under the impression that short of buying your own copy you can only reinstall the OEM, hacked-up version.
- Already__Taken 11y ago
  The key is in the bios now so you should be able to load any OS that's the same version i.e. pro or home. I've never tried though. I don't know if there is still a different version for OEM or VL windows like XP had different key types.
  - lashkari 11y ago
    I just went through this with a new Dell XPS for my dad. I performed a wipe/reinstall (with media created directly from a Microsoft download) and Windows 10 never asked me for a key after reinstalling it, and it reports as being activated. Seems like they've moved away from requiring an OEM key in addition to the SLIC BIOS signature.
    - sfilipov 11y ago
      They went a step further. Once a Windows 10 machine is activated, a "hash" of its hardware is taken and associated with the product key. When you reinstall Windows 10, the activation service matches your hardware information with the product key. You need to enter a product key only the first time you install Windows 10 on a particular machine.