Slashdot Mirror
Exploit Found to Brick Most HP and Compaq Laptops
Ian Lamont writes "A security researcher calling himself porkythepig has published attack code that can supposedly brick most HP and Compaq laptops. The exploit uses an ActiveX control in HP's Software Update. It would 'let an attacker corrupt Windows' kernel files, making the laptop unbootable, or with a little more effort, allow hacks that would result in a PC hijack or malware infection.' The same researcher last week outlined a batch of additional vulnerabilities in HP and Compaq laptops, for which HP later issued patches."
Two points about the article's headline:
1) The linked article does not describe a successful bricking. You can pop in your recovery CD & away you go.
2) This is a software problem, not a hardware problem. I doubt this exploit is going to work on my (old & crappy) HP sempron laptop, seeing as its dual booting Debian & OS X.
A better headline would be "Exploit found in HP update software" - but I guess that's just not that ad-revenue generating.
There are shills on slashdot. Apparently, I'm one of them.
there's a patch available, but it involves penguins ;-)
This is NOT bricking. The OS is simply disabled and can be reinstalled/system repaired whatever.
Bricking means rendering the device completely inert and beyond normal repair methods.
I am government man, come from the government. The government has sent me. -- G.I.R.
We should revisit what "Brick" *actually* means: "When used in reference to electronics, "brick" describes a device that cannot function in any capacity (such as a machine with damaged firmware)." (Wikipedia)
Lately several submissions have used this term incorrectly. Come on, we're supposed to be nerds, not Cringely.
Corrupting a Windows install does NOT BRICK A GOD DAMNED LAPTOP. You can reinstall Windows and it will work. Therefore it is not a brick, it is not bricked, it has no aspect of brickishness, not even a hint of brickening.
What the HELL is wrong with you morons??? Do you even read Slashdot discussions? This has been pointed out over and over and over again.
Bricking involves killing something dead in such a way that it becomes, in effect, an expensive paperweight or 'brick' if you will. As you are clearly retarded, let me explain that a 'brick' is typically a rectangular piece of clay or similar material hardened in a furnace and used to construct buildings and other structures, and usually has no functionality beyond this. Unlike the device in this story, reinstalling Windows on an actual brick will not lead to increased capabilities.
Read Pynchon.
Bricking refers to rendering a device inoperable in a more significant way than corrupting data on a hard drive. These machines can still be booted from external media and restored. A truly bricked device would have its firmware corrupted or suffer some sort of damage not easily repaired without specialist tools.
I am becoming gerund, destroyer of verbs.
Bricking means to render unbootable with no means of recovery other than sending back to the manufactures. This is usually done through the corruption of the firmware.
Corrupt the BIOS = bricked. Corrupting Windows = not bricked.
Did anybody mention that they used "bricked" incorrectly?
It will l-l-l-let an attacker corrupt W-w-w-windows! T-t-t-that's all folks!
It sounds like the user needs to be using Internet Explorer in order to be vulnerable. I doubt anything happens on Firefox or other browser since there is purposely no ActiveX support there.
Also I note that the exploit description itself never uses the inaccurate word "brick".
The story is yet another illustration of how dangerous ActiveX is. This is not the first example and it probably won't be the last. So many other things depend on or otherwise utilize activex... some are highly security sensitive like in the case of ADP. I cannot understand why, after all these years of examples why Microsoft hasn't recalled the use of the technology as inherently dangerous. But really, it's worse than that. It breaks the premise of the web. The use of the web is not supposed to be limited to a certain hardware specification under a certain software configuration... this is irrelevant, of course, to the dangers pushed upon the users who are often required to use it.
For the cost of a thousand copies of Vista Business, you could pay Wine programmers to support every app your company uses.
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
If you removed the crapware that HP sent out with it.. You'll be fine.. Just takes like 3 or 4 hours to do it all though... Extremely annoying...
It's a fairly recent phenomenon.. like the iphone 'brick' that wasn't a brick at all but the press seemed to pick up on the word even though they have no idea what it means (if anyone really thinks their iphone is bricked I'm quite happy to dispose of it for them, for a fee of course).
Most people still use the term correctly.. but the press through their damned stupid ignorance is determined to change that. Slashdot should not be one of the sites doing it.. they're supposed to know better.
1) Bricked is the wrong word.
2) This hilights the dangers of any holes in a sandbox. The only secure way to design a sandbox is for there to be no mechanism from inside the sandbox to request access outside it... whether by installing a plugin, executing an external application, or otherwise elevating privileges. Even if the request is normally denied, the existince of that mechanism itself creates a new class of attacks.
The corollary to point two is that ActiveX is not just a security hole, it's a different *kind* of security hole.
On the other hand, all three of the most common browsers have a mechanism to request access outside the sandbox. None of them are as bad as ActiveX, but they're all unnecessary.
* Any browser on Windows is subject to URI quoting attacks on helper applications, due to the lack of a guaranteed quote-safe command line and the use of a single set of helper bindings for trusted and untrusted sources.
* LaunchServices on OS X duplicates the second problem as well.
* Firefox and Safari both allow web pages to request plugins be installed: XPI in Firefox and Dashboard plugins in Safari on OSX. They both wrap these interfaces in multiple levels of "approval dialogs", but my experience is that there are too many people who can be relied upon to eventually hit "go ahead and infect me" by reflex.
* Safari and Internet Explorer can both be made to, with various amounts of approval dialogs, open downloaded documents automatically. Safari used to do this by default but thankfully it's now an option... but really that capability should not be there at all.
None of these holes in the sandbox actually make things more convenient for users. They look like they might, but it's actually easier to download a document or a plugin and than (as a separate step) request that it be opened or installed from a file browser or from a download manager, because making the operation asynchronous and deliberate like that means you don't have to go crazy with approval dialogs, because you're not running the risk of an unexpected dialog coming up for a user with an itchy mouse button...
For a fraction of the investment, support the development of POSIX portable apps, and dump the platforms which don't have POSIX calls and portable libraries.
"Flyin' in just a sweet place,
Never been known to fail..."
...I must propose that Slashdot editors are involved in a conspiracy. To wit: In the past few months or so, we have had at least three submissions that have incorrectly used the term "brick" to describe a problem with typically simple solutions- distinctly not problems without solution. Anyone interested enough to submit an article to Slashdot would know the meaning of the term. Therefore, the only explanation is that the editors are cultivating the submissions in a way calculated to stimulate numerous off topic posts highlighting the improper use of the term, in turn increasing the traffic in order to generate add revenue. What's the definition of troll?
Have you ever noticed that anybody driving slower than you is an idiot, and anyone going faster than you is a maniac?
You forgot your tag~
Don't trust anyone under thirty.
Why...
YES, it is 'bricked.' Totally and utterly useless, yes. You'll need to buy a brand new one. Seeing as I'm a nice guy, I'll buy this completely bricked, utterly useless laptop from you. Just for the case and spare parts, you see. Does $100 sound reasonable for a bricked, totally useless laptop that you can never use again? Hmmm?
How about because they posted a full analysis including a demonstration with source code? Given a lot of stupid laws going into effect all over, I'd expect a lot more security researchers to remain anonymous, and as long as you're being anonymous who cares what your handle is?
a) it's amusing to see people clamor for the "good old days" when "brick" meant a very specific form of computer disablement. Yes, those were the days, long ago, perhaps even before the television writers' strike began, why way back in ... aw, heck, you can't expect me to believe quite *that* far back, can you? I imagine a cadre of formerly peaceful hippies in a battle to the death on the proper etymology of "roach," and whether a joint which can still be successfully smoked while held between the fingers is or is not technically a roach.
:)), but there's some evidence that not everyone agrees that a bricking is forever.
b) Brick clearly means more than "a small glitch in a basically working device," but "renders useless until a complete system re-install" doesn't seem too crazy; I've seen this use many times, esp. wrt gadgets whose firmware can be replaced with firmware. It's certainly used sometimes to refer to the kind of situation where (as here) the device becomes a doorstop until a complete new system image is installed.
You can choose to fixate on the word (hey, it's a free world!
And if anyone would like to argue some sort of Ur-grammar definition into "brick" in the hyper-recent use to refer to borked electronics, complain about how today's kids aren't true enough to their l447sp3@k roots, may I introduce the brick (older meaning).
jrnl: http://tinyurl.com/c2l8yr / foes: http://tinyurl.com/ckjno5
I'm with ya, I call it the diluting the english language. People are always screwing up words and adding new meanings to them in such away as to destroy the original meaning.
:p
You mean like misusing the verb brick to mean "disable" instead of "build a masonry structure"?
The World's Worst Webcomic!
Come on people. I know it's all sensational and stuff to talk about bricking, but this ain't bricking. Bricking is when the device is now as "useful as a brick" or could literally be used only as a paper weight or a door stop. When it cannot be recovered or fixed, that's a brick. This is just a fouled up machine. Which viruses have been giving us since the early 90s when hard drives became standard in PCs.
It's like there's a bunch of kiddies out there who heard all the sensation about iPhones getting bricked (now that seemed like a genuine brick for quite a while) and now think that the cool term for screwed up is now "brick". Use some precision, for crying out loud.
"Doubt your doubts and believe your beliefs." -- Switchfoot, Ode to Chin
No. Desktop machines are too big become bricks. They are only potential cinder blocks.
Also, Tablet PCs with corrupt Windows installations will henceforth be referred to as "paving stones".
Do daemons dream of electric sleep()?