| ▲ | panny a day ago |
| >Bad news: Dell is posting unsigned update executables to their website labeled “critical” which then fail to install due to the good news If I were a hacker with no access to the signing keys, I'd probably label my updates as critical too, so you would try to find a way around the update signing. |
|
| ▲ | 0xDEAFBEAD 20 hours ago | parent | next [-] |
| So basically you're targeting a tiny fraction of power users who are capable and motivated to find and exploit a vulnerability on their own machine which bypasses update signing. I think you'll find more bang for your malicious buck elsewhere. |
| |
| ▲ | saghm 20 hours ago | parent [-] | | So wouldn't this logic also apply to updates that are signed with an invalid signature? And at that point, it sounds like you're saying that once something is signed and distributed, no one will ever try to compromise that and you're free and clear for the rest of time, which seems...dubious. | | |
| ▲ | 0xDEAFBEAD 19 hours ago | parent [-] | | My mental model is that requiring updates to be signed delivers a lot of security bang for your buck. Do you disagree? An attacker can still steal the private key, or identify a flaw in the signature checking code. It looks like there are a variety of other, more constrained attacks: https://theupdateframework.io/docs/security/#attacks-and-wea... But overall, it seems to me that you can make an attacker's life considerably more difficult, for a comparatively small effort. | | |
| ▲ | saghm 15 hours ago | parent [-] | | I don't disagree with everything you said, but I don't see how "therefore, you don't need to worry about a critical update without a signature" follows. The reason that it provides a lot of value is specifically because it helps you notice things like what's going on now so you can avoid installing unsigned updates. |
|
|
|
|
| ▲ | SoftTalker 21 hours ago | parent | prev | next [-] |
| But posting unsigned updates (if you somehow found a way to do that) would set off alarms in about 10 seconds, as we can see by this thread. |
|
| ▲ | Retr0id 21 hours ago | parent | prev [-] |
| If I were a hacker in the same situation I'd keep looking for a more realistic strategy. |
| |
| ▲ | raincole 19 hours ago | parent | next [-] | | Unless it's some crazy 4D chess and the hackers are trying to distract Dell's security team while they are deploying another real attack. | |
| ▲ | jagged-chisel 20 hours ago | parent | prev [-] | | Does anyone seriously think that attackers won’t try every single potential avenue regardless of how “realistic” it seems? | | |
| ▲ | Retr0id 19 hours ago | parent [-] | | Yes. I wouldn't be burning write access to Dell's update servers on something so unlikely to achieve an objective. |
|
|
