2

On an OEM Windows install on a Dell XPS 13, when I navigate to the Dell support website, it offers to download and install updates (even firmware updates!) on the spot, in the browser, flaunting all the usual sandboxing. This is Firefox which, to my knowledge, doesn't support any mechanism like ActiveX to make this possible.

How does it work? Is Dell injecting a backdoor into Firefox? Could a malicious website use this "feature" to cause damage?

6
  • The way this might work is by registering a custom schema handler. Steam, for instance, does this. You can start a game by clicking a button on the website, which just is an URI steam://..., which is then handled by Steam. Likewise, they could register DellSupport://... to always open with the SupportAssist application. Keep in mind I did not test this, it's just a guess.
    – user163495
    Commented Apr 16, 2019 at 14:20
  • AFAIK, schemas that want to open in an external program will show a confirmation prompt in Firefox, and the external program wouldn't (normally) tamper with the browser.
    – mm201
    Commented Apr 16, 2019 at 14:22
  • Can you provide us with a direct link? Most people will not want to search through the whole dell.com website to find the application you might be referring to (including me).
    – Philipp
    Commented Apr 16, 2019 at 14:32
  • 1
    Digging through the inspector, I get the sense it's running a local web server that the webpage talks to over xhr. The link begins with dell.com/support/home . The full link may contain sensitive information.
    – mm201
    Commented Apr 16, 2019 at 14:41
  • Yes, schemas require confirmation at first. However, since you said it was pre-installed on your OS, it could be that that schema was already pre-confirmed.
    – user163495
    Commented Apr 17, 2019 at 7:22

1 Answer 1

3
+500

It very well might be.

The way it works, SupportAssist runs its own local HTTP server on your computer, at http://127.0.0.1:8084/ . The Javascript application on the Dell support website calls pages on that server to control SupportAssist and install applications.

Though Dell uses some kind of authentication on that server (you can read about the details here), it was found to be vulnerable before, on multiple occasions, and it won't be any surprise if a new vulnerability would be discovered.

1
  • 2
    Nice, very good explanation. Will award the rep tomorrow
    – user163495
    Commented Dec 1, 2021 at 15:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .