3 ms·
>Bad news: Dell is posting unsigned update executables to their website labeled “critical” which then fail to install due to the good news If I were a hacker w
by panny 2y ago
>Bad news: Dell is posting unsigned update executables to their website labeled “critical” which then fail to install due to the good news
If I were a hacker with no access to the signing keys, I'd probably label my updates as critical too, so you would try to find a way around the update signing.
- Retr0id 2y agoIf I were a hacker in the same situation I'd keep looking for a more realistic strategy.
- jagged-chisel 2y agoDoes anyone seriously think that attackers won’t try every single potential avenue regardless of how “realistic” it seems?
- Retr0id 2y agoYes. I wouldn't be burning write access to Dell's update servers on something so unlikely to achieve an objective.
- raincole 2y agoUnless it's some crazy 4D chess and the hackers are trying to distract Dell's security team while they are deploying another real attack.
- SoftTalker 2y agoBut posting unsigned updates (if you somehow found a way to do that) would set off alarms in about 10 seconds, as we can see by this thread.
- 0xDEAFBEAD 2y agoSo basically you're targeting a tiny fraction of power users who are capable and motivated to find and exploit a vulnerability on their own machine which bypasses update signing. I think you'll find more bang for your malicious buck elsewhere.
- saghm 2y agoSo wouldn't this logic also apply to updates that are signed with an invalid signature? And at that point, it sounds like you're saying that once something is signed and distributed, no one will ever try to compromise that and you're free and clear for the rest of time, which seems...dubious.
- 0xDEAFBEAD 2y agoMy mental model is that requiring updates to be signed delivers a lot of security bang for your buck. Do you disagree? An attacker can still steal the private key, or identify a flaw in the signature checking code. It looks like there are a variety of other, more constrained attacks: https://theupdateframework.io/docs/security/#attacks-and-weaknesses https://theupdateframework.io/docs/security/#attacks-and-wea... But overall, it seems to me that you can make an attacker's life considerably more difficult, for a comparatively small effort.
- saghm 2y agoI don't disagree with everything you said, but I don't see how "therefore, you don't need to worry about a critical update without a signature" follows. The reason that it provides a lot of value is specifically because it helps you notice things like what's going on now so you can avoid installing unsigned updates.
- nephanth 2y agoIf I were a security engineer/pentester, I might post unsigned "updates" that automatically alert us if they ever get installed