tl;dr: A software opens a port to allow a remote website trigger "download and execute" actions on a URL pointing to an .exe file. The security check they hav

tl;dr: A software opens a port to allow a remote website trigger "download and execute" actions on a URL pointing to an .exe file. The security check they have is that they check the domain is dell.com and that the string starts with "https://" https://". If it starts with http:// http:// it is replaced by the https version. In theory I could consider this risky but safe. The mistake is that they do not force a URL that starts with something else to fail. The attacker could bypass the check by providing " http://fakedns.dell.com/haxorz.exe" http://fakedns.dell.com/haxorz.exe" (with a space at the beginning) and it passed the check. This is not the first flaw of this style I am seeing. I don't think a teacher ever explicitly told it to me but I always assumed that relying on DNS for authentication was a dangerous thing to do and that URLs were doing too many things behind the scenes to be trustworthy without being extremely picky. Maybe it all changed with https, but trusting the execution of an exe without at least checking the a crypto signature lights some red flags in my brain.