5 ms·

Dell is posting unsigned updates to their website which fail to install

154 points by luu 2y ago

panny 2y ago
>Bad news: Dell is posting unsigned update executables to their website labeled “critical” which then fail to install due to the good news If I were a hacker with no access to the signing keys, I'd probably label my updates as critical too, so you would try to find a way around the update signing.
- Retr0id 2y ago
  If I were a hacker in the same situation I'd keep looking for a more realistic strategy.
  - jagged-chisel 2y ago
    Does anyone seriously think that attackers won’t try every single potential avenue regardless of how “realistic” it seems?
    - Retr0id 2y ago
      Yes. I wouldn't be burning write access to Dell's update servers on something so unlikely to achieve an objective.
  - raincole 2y ago
    Unless it's some crazy 4D chess and the hackers are trying to distract Dell's security team while they are deploying another real attack.
- SoftTalker 2y ago
  But posting unsigned updates (if you somehow found a way to do that) would set off alarms in about 10 seconds, as we can see by this thread.
- 0xDEAFBEAD 2y ago
  So basically you're targeting a tiny fraction of power users who are capable and motivated to find and exploit a vulnerability on their own machine which bypasses update signing. I think you'll find more bang for your malicious buck elsewhere.
  - saghm 2y ago
    So wouldn't this logic also apply to updates that are signed with an invalid signature? And at that point, it sounds like you're saying that once something is signed and distributed, no one will ever try to compromise that and you're free and clear for the rest of time, which seems...dubious.
    - 0xDEAFBEAD 2y ago
      My mental model is that requiring updates to be signed delivers a lot of security bang for your buck. Do you disagree? An attacker can still steal the private key, or identify a flaw in the signature checking code. It looks like there are a variety of other, more constrained attacks: https://theupdateframework.io/docs/security/#attacks-and-weaknesses https://theupdateframework.io/docs/security/#attacks-and-wea... But overall, it seems to me that you can make an attacker's life considerably more difficult, for a comparatively small effort.
      - saghm 2y ago
        I don't disagree with everything you said, but I don't see how "therefore, you don't need to worry about a critical update without a signature" follows. The reason that it provides a lot of value is specifically because it helps you notice things like what's going on now so you can avoid installing unsigned updates.
- nephanth 2y ago
  If I were a security engineer/pentester, I might post unsigned "updates" that automatically alert us if they ever get installed
likeabatterycar 2y ago
Or the upload to their CDN was truncated or corrupted, and the signature check worked as designed. But let's not let an opportunity to paint Dell as some evil yet incompetent corporation slip through our fingers.
- zdragnar 2y ago
  Surely for something so important, they'd verify it rather than let it sit around for the public to point out. At a minimum this is definitely a process failure due to incompetence.
  - likeabatterycar 2y ago
    Maybe it was file system corruption, who knows? "Dell is posting unsigned update executables" is a loaded statement that implies this was intentional. Dell has been signing updates since before most infosec engineers were in middle school ogling cheerleaders. It's alarmist and highly unlikely this was intentional.
    - dumpsterdiver 2y ago
      That still wouldn’t excuse that someone clearly didn’t verify their work. No matter what the reason, ownership of this task was released before it should have been.
      - likeabatterycar 2y ago
        You have no evidence of that not happening. It could be corruption after the fact or failure during replication. The armchair wolves already smell blood and are assigning blame before a postmortem has even begun.
        muppetman 2y ago
        You're right. A headline of "Dell's website is serving up unsigned updates" would be correct. But to garner more clicks and hype that's not how they've worded their tweet, instead it's worded to make it sound like Dell are doing this on purpose.
santiagobasulto 2y ago
[flagged]
- declan_roberts 2y ago
  Apple definitely knows their audience, unfortunately they've been straying a little bit from the mission lately on software reliability.
  - hulitu 2y ago
    > software reliability is a general problem, not specific to Apple. Why test, when you are already working at the next release ? If there are issues, please upgrade to the latest version. Rinse and repeat. /s
- kube-system 2y ago
  Yeah, on Linux you get all of the same firmware issues, but with no vendor software support to update it! I dual boot windows so that I can download all of my PC's firmware updaters.
  - dorfsmay 2y ago
    What? I've been upgrading my laptops with fwupdmgr for years without any issue.
    - kube-system 2y ago
      I've tried gnome-firmware (same backend) on literally every linux system I've ever owned and have never seen an available update for any of my hardware.
      - talldayo 2y ago
        If you don't own supported hardware, that's not really super surprising: https://fwupd.org/lvfs/vendors/ https://fwupd.org/lvfs/vendors/
SilasX 2y ago
Wow that’s almost as bad as Firefox five years ago … except this probably doesn’t compromise privacy addons that will get someone killed. https://hacks.mozilla.org/2019/05/technical-details-on-the-recent-firefox-add-on-outage/ https://hacks.mozilla.org/2019/05/technical-details-on-the-r...
deleted 2y ago
[deleted]
ganzuul 2y ago
Dell must have calculated that Microsoft will take the blame for this.
klaas- 2y ago
yesterday they were also serving a update catalog index that did not match it's signature https://downloads.dell.com/catalog/CatalogIndex.gz https://downloads.dell.com/catalog/CatalogIndex.gz // https://downloads.dell.com/catalog/CatalogIndex.gz https://downloads.dell.com/catalog/CatalogIndex.gz -- but that was fixed after I complained and their idrac based firmware updater downloads http(s)://downloads.dell.com/Catalog/Catalog.xml.gz without checking the signature -- and by default without verifying https certificates when using https :D
bananapub 2y ago
I mean, someone is, who knows if it is Dell or not. probably Dell doesn't know either, based on their usual software quality.

154 points by luu 2y ago

>Bad news: Dell is posting unsigned update executables to their website labeled “critical” which then fail to install due to the good news If I were a hacker with no access to the signing keys, I'd probably label my updates as critical too, so you would try to find a way around the update signing.

Retr0id 2y ago
If I were a hacker in the same situation I'd keep looking for a more realistic strategy.
- jagged-chisel 2y ago
  Does anyone seriously think that attackers won’t try every single potential avenue regardless of how “realistic” it seems?
  - Retr0id 2y ago
    Yes. I wouldn't be burning write access to Dell's update servers on something so unlikely to achieve an objective.
- raincole 2y ago
  Unless it's some crazy 4D chess and the hackers are trying to distract Dell's security team while they are deploying another real attack.
SoftTalker 2y ago
But posting unsigned updates (if you somehow found a way to do that) would set off alarms in about 10 seconds, as we can see by this thread.
0xDEAFBEAD 2y ago
So basically you're targeting a tiny fraction of power users who are capable and motivated to find and exploit a vulnerability on their own machine which bypasses update signing. I think you'll find more bang for your malicious buck elsewhere.
- saghm 2y ago
  So wouldn't this logic also apply to updates that are signed with an invalid signature? And at that point, it sounds like you're saying that once something is signed and distributed, no one will ever try to compromise that and you're free and clear for the rest of time, which seems...dubious.
  - 0xDEAFBEAD 2y ago
    My mental model is that requiring updates to be signed delivers a lot of security bang for your buck. Do you disagree? An attacker can still steal the private key, or identify a flaw in the signature checking code. It looks like there are a variety of other, more constrained attacks: https://theupdateframework.io/docs/security/#attacks-and-weaknesses https://theupdateframework.io/docs/security/#attacks-and-wea... But overall, it seems to me that you can make an attacker's life considerably more difficult, for a comparatively small effort.
    - saghm 2y ago
      I don't disagree with everything you said, but I don't see how "therefore, you don't need to worry about a critical update without a signature" follows. The reason that it provides a lot of value is specifically because it helps you notice things like what's going on now so you can avoid installing unsigned updates.
nephanth 2y ago
If I were a security engineer/pentester, I might post unsigned "updates" that automatically alert us if they ever get installed

likeabatterycar 2y ago

Or the upload to their CDN was truncated or corrupted, and the signature check worked as designed. But let's not let an opportunity to paint Dell as some evil yet incompetent corporation slip through our fingers.

zdragnar 2y ago
Surely for something so important, they'd verify it rather than let it sit around for the public to point out. At a minimum this is definitely a process failure due to incompetence.
- likeabatterycar 2y ago
  Maybe it was file system corruption, who knows? "Dell is posting unsigned update executables" is a loaded statement that implies this was intentional. Dell has been signing updates since before most infosec engineers were in middle school ogling cheerleaders. It's alarmist and highly unlikely this was intentional.
  - dumpsterdiver 2y ago
    That still wouldn’t excuse that someone clearly didn’t verify their work. No matter what the reason, ownership of this task was released before it should have been.
    - likeabatterycar 2y ago
      You have no evidence of that not happening. It could be corruption after the fact or failure during replication. The armchair wolves already smell blood and are assigning blame before a postmortem has even begun.
      - muppetman 2y ago
        You're right. A headline of "Dell's website is serving up unsigned updates" would be correct. But to garner more clicks and hype that's not how they've worded their tweet, instead it's worded to make it sound like Dell are doing this on purpose.

santiagobasulto 2y ago

[flagged]

declan_roberts 2y ago
Apple definitely knows their audience, unfortunately they've been straying a little bit from the mission lately on software reliability.
- hulitu 2y ago
  > software reliability is a general problem, not specific to Apple. Why test, when you are already working at the next release ? If there are issues, please upgrade to the latest version. Rinse and repeat. /s
kube-system 2y ago
Yeah, on Linux you get all of the same firmware issues, but with no vendor software support to update it! I dual boot windows so that I can download all of my PC's firmware updaters.
- dorfsmay 2y ago
  What? I've been upgrading my laptops with fwupdmgr for years without any issue.
  - kube-system 2y ago
    I've tried gnome-firmware (same backend) on literally every linux system I've ever owned and have never seen an available update for any of my hardware.
    - talldayo 2y ago
      If you don't own supported hardware, that's not really super surprising: https://fwupd.org/lvfs/vendors/ https://fwupd.org/lvfs/vendors/

SilasX 2y ago

Wow that’s almost as bad as Firefox five years ago … except this probably doesn’t compromise privacy addons that will get someone killed. https://hacks.mozilla.org/2019/05/technical-details-on-the-recent-firefox-add-on-outage/ https://hacks.mozilla.org/2019/05/technical-details-on-the-r...

deleted 2y ago

[deleted]

ganzuul 2y ago

Dell must have calculated that Microsoft will take the blame for this.

klaas- 2y ago

yesterday they were also serving a update catalog index that did not match it's signature https://downloads.dell.com/catalog/CatalogIndex.gz https://downloads.dell.com/catalog/CatalogIndex.gz // https://downloads.dell.com/catalog/CatalogIndex.gz https://downloads.dell.com/catalog/CatalogIndex.gz -- but that was fixed after I complained and their idrac based firmware updater downloads http(s)://downloads.dell.com/Catalog/Catalog.xml.gz without checking the signature -- and by default without verifying https certificates when using https :D

bananapub 2y ago

I mean, someone is, who knows if it is Dell or not. probably Dell doesn't know either, based on their usual software quality.