Exploit Found to Brick Most HP and Compaq Laptops

Ian Lamont writes "A security researcher calling himself porkythepig has published attack code that can supposedly brick most HP and Compaq laptops. The exploit uses an ActiveX control in HP's Software Update. It would 'let an attacker corrupt Windows' kernel files, making the laptop unbootable, or with a little more effort, allow hacks that would result in a PC hijack or malware infection.' The same researcher last week outlined a batch of additional vulnerabilities in HP and Compaq laptops, for which HP later issued patches."

Two points about the article's headline.

Two points about the article's headline:

1) The linked article does not describe a successful bricking. You can pop in your recovery CD & away you go.

2) This is a software problem, not a hardware problem. I doubt this exploit is going to work on my (old & crappy) HP sempron laptop, seeing as its dual booting Debian & OS X.

A better headline would be "Exploit found in HP update software" - but I guess that's just not that ad-revenue generating.

Re:Two points about the article's headline.

It's annoying how the word brick has lost all meaning recently. If this exploit actually allowed bricking that would be huge news. But it doesn't. A computer that merely needs its OS repaired/reinstalled is not bricked. Slashdot editors, please figure that out already.

Re:Two points about the article's headline.

All in all, it was just a brick in the wall.

Re:Two points about the article's headline.

fe1 ~ # echo Brick! | wall

Broadcast message from root (Fri Dec 21 02:16:49 2007):

Brick!
fe1 ~ #

Wonder what any users on there will think?

Re:Two points about the article's headline.

users on there will think

Optimist.

Re:Two points about the article's headline.

We don't need no exploitation,
Block all Active-X controls,
No Javashitting in my browser,
Lame-ass spammers, lick my hole,

HEY! CRACKERS!, face the fire-wall!
> All in all, it was just a brick in the wall. (Guitar solo singing Fixed-it-for-you)
All in all, a pack-et, blocked by my fire-wall.

Re:Two points about the article's headline.

There used to be a virus that slipped past the OS and triggered a BIOS flash on certain boards, and flashed the virus into the BIOS. The only ways to get it out were to buy a new MB, buy a new BIOS chip from the MB or BIOS manufacturer, flash the chip in a dedicated chip data loader, or replace it temporarily with a friend's BIOS chip, boot, swap out the chips on the live board, reflash, and hope you didn't fry the board or the chip. The board generally wasn't dual-BIOS, and worst of all IIRC was that the BIOS chip for many of the affected boards was soldered instead of socketed. The virus was called CIH or Chernobyl.

There was back in the days of DOS and ESDI, MFM, and early IDE drives, when it was the user's responsibility to run a drive head parking utility (properly configured for the right cylinder count for parking out past the edge of the drive) before physically moving the machine because auto-parking wasn't built into drives yet, a virus that did something really nasty. It'd take the cylinder count for your drive, cut that in half, set your park cylinder to that number, and tell the drive to park and shut down. The heads would move to the center of the platters, the spindle would slow down on its way to stopping, the air cushion between head and platter went away, and the heads plowed into the platters either then or when the drive would spin back up. I don't recall the name of this one.

Either of these could be considered bricking actual hardware, but you probably won't ever have to worry about Chernobyl and the other is obsolete.

Re:Two points about the article's headline.

Don't forget about the trojan that would blow up your IBM CGA monitor by resetting the display frequency to an unsupported value. It definately let the smoke out, as you could smell the result.

Re:Two points about the article's headline.

Damn straight, I'm glad you got the comment in early. Bricking is one of the last pure computing terms around. Memory, CPU, Operating System, code, hack, have all come to mean a lot of things, but bricking still has specific meaning. If you can do anything at all to the device without touching the hardware to make it run again it is not bricked. Even if it voids the warranty. Please please please don't confuse the meaning, bricking is game over, everything else is everything else.

Re:Two points about the article's headline.

"If you can do anything at all to the device without touching the hardware to make it run again it is not bricked. Even if it voids the warranty. Please please please don't confuse the meaning, bricking is game over, everything else is everything else"

I was under the impression that it was bricked if you couldn't bring it back without hacking the hardware. Like with the OpenWRT routers, they are said to be bricked if you install a bad firmware update but you can JTAG them and potentially bring them back. And that context has been around as long as I can remember.

Re:Two points about the article's headline.

Exactly. The term implies that, from the perspective of its intended purpose, the device is as functional as a brick.

Re:Two points about the article's headline.

Notwithstanding its actual existing specific meaning, "bricked" is fairly obviously now a slang term for when something electronic is, temporarily or permanently, inoperative.

No, it is being used by some headline writers like that. But not anyone knowledgeable. It still means "permanently" , not "temporarily" fucked. In this article, for instance, the post by the "hacker" who found this never uses the word "brick". Only the sensationalist headline writer.

Re:Two points about the article's headline.

About twelve years ago I had a meeting with a guy who used "brick" for "image", as in imaging PCs.

"Will your company brick all our desktops?"
"WTF are you talking about?"

After it got straightened out, he insisted that this was mainframe speak. I've never heard the term used that way again, though.

Re:Two points about the article's headline.

Well, it's just a variation of what people used to say when their OS got corrupted and they said "my hard drive crashed". It just meant "My PC wouldn't boot".

On the other hand, most people are so mystified by computers that the difference between software and hardware is not obvious and they don't care.

Re:Two points about the article's headline.

Slashdot has editors?!

Re:Two points about the article's headline.

But do these computers come with a recovery CD, or just a recovery partition? I've also read about recovery CDs that entirely reformat the computer's hard drive, taking My Documents with it.

The point is, if you can use the computer after the exploit, it is not a brick, so it is not *bricked*. If you lost your documents or not has nothing to do with it.

Re:Two points about the article's headline.

I've also read about recovery CDs that entirely reformat the computer's hard drive, taking My Documents with it.

Popping the hard drive in to one of those USB enclosures and copying your data files onto another machine before running the recovery CD looks after that. The summary says the exploit just corrupts Windows' kernel files. Assuming it doesn't do anything further to make your data unreadable, there is no reason to lose any data.

Re:Two points about the article's headline.

The summary says the exploit just corrupts Windows' kernel files.

So how does the owner of a PC that did not come with a recovery CD get the kernel file back?

HPs and Compaqs are the topic of TFA. These have either come with a set of recovery media or (more recently) a program that will burn them to CD-R or DVD-R. If the former is the case, you're all set. If the latter, and you didn't bother to make recovery discs, whose fault is that? (IIRC, it'll nag you to make them until you get around to it.)

Lately, they've taken to putting an installable copy of Windows on one disc and installable copies of drivers and apps on the other disc(s)...that's nice for controlling how much shovelware gets loaded back on. It's not as fast as a Ghost (or whatever) image, but it's much more controllable.

Re:Two points about the article's headline.

Does it encrypt the data, or just set the folder ACLs so it can't be accessed?

If it's just ACLs, then you can read it from anywhere. Linux's NTFS support ignores ACLs for example, because it's going to have a very hard time trying to make them map to anything sensible. On another Windows box the SUIDs will be unknown but respected, but you should be able to take ownership of the folder and reset the permissions.

If it IS encrypted, that's another matter.

Re:Two points about the article's headline.

Apologies for the possibly stupid question, but how are you booting OS X on an HP laptop?

Re:Two points about the article's headline.

He's probably running a hacked version of the Intel release of OSX. See http://wiki.osx86project.org/ [osx86project.org] for more info.

Re:Two points about the article's headline.

The original headline I submitted was: Researcher lists new HP/Compaq laptop exploits Not too far from your suggestion ...

Desktops?

Does this apply to any of the HP desktop line?

According to my sources...

there's a patch available, but it involves penguins ;-)

Re:According to my sources...

Linux. The OS even bricks can run.

Re:Donate how much to Wine?

For the price of donating enough money Wine to pay a programmer to implement complete support for the application, one could buy several copies of genuine Windows Vista Ultimate.

For the cost of a thousand copies of Vista Business, you could pay Wine programmers to support every app your company uses.

Re:Donate how much to Wine?

For a fraction of the investment, support the development of POSIX portable apps, and dump the platforms which don't have POSIX calls and portable libraries.

Argh

This is NOT bricking. The OS is simply disabled and can be reinstalled/system repaired whatever.

Bricking means rendering the device completely inert and beyond normal repair methods.

Re:Argh

Ahh, it's not at all, that reminds me of the old joke:

A couple goes on vacation to a fishing resort. The husband likes to fish at the crack of dawn. The wife likes to read. One morning the husband returns after several hours of fishing and decides to take a short nap. Although she isn't familiar with the lake, the wife decides to take the boat. She motors out a short distance, anchors, and continues to read her book. Along comes the game warden in his boat. He pulls up alongside her and says,"Good morning, Ma'am, what are you doing?" "Reading my book," she replies, thinking isn't that obvious? "You're in a restricted fishing area," he informs her. "But officer, I'm not fishing. Can't you see that?" "Yes, but you have all the equipment. I'll have to take you in and write you up." "If you do that, I'll have to charge you with rape," says the woman. "But I haven't even touched you," says the game warden. "That's true, but you do have all the equipment."

The capability does not equal the crime, thankfully, so while you might put the laptop in a position it's brickable, it's not. Also, with dual bios's, bricking something like a laptop requires quite a bit of effort!

Perhaps

We should revisit what "Brick" *actually* means: "When used in reference to electronics, "brick" describes a device that cannot function in any capacity (such as a machine with damaged firmware)." (Wikipedia)

Lately several submissions have used this term incorrectly. Come on, we're supposed to be nerds, not Cringely.

!BRICK FFS

Corrupting a Windows install does NOT BRICK A GOD DAMNED LAPTOP. You can reinstall Windows and it will work. Therefore it is not a brick, it is not bricked, it has no aspect of brickishness, not even a hint of brickening.

What the HELL is wrong with you morons??? Do you even read Slashdot discussions? This has been pointed out over and over and over again.

Bricking involves killing something dead in such a way that it becomes, in effect, an expensive paperweight or 'brick' if you will. As you are clearly retarded, let me explain that a 'brick' is typically a rectangular piece of clay or similar material hardened in a furnace and used to construct buildings and other structures, and usually has no functionality beyond this. Unlike the device in this story, reinstalling Windows on an actual brick will not lead to increased capabilities.

Re:!BRICK FFS

Corrupting a Windows install does NOT BRICK A GOD DAMNED LAPTOP.

If it did, then Windows would be considered self-bricking.

Re:!BRICK FFS

No, no, it does. It's, uh, you need a new one. So just, you interested in selling that one? You know... for parts?

Re:!BRICK FFS

In that respect, a truly "bricked" laptop is probably even less useful than a real brick. Too big to fit in most socks...

:)

There's a patch for that. A pillow case

Re:!BRICK FFS

I beg to differ. I've seen bricks used as paperweights, doorstops, melee weapons, missiles, jackstands, stepping stools, water-saving devices, exercise equipment, depth probes, counterweights, tourist attractions, ballast, keyless entry devices, cookware, heating elements, hammers...

I will not have you slandering the name of the noble and versatile brick!

Brick?

Bricking refers to rendering a device inoperable in a more significant way than corrupting data on a hard drive. These machines can still be booted from external media and restored. A truly bricked device would have its firmware corrupted or suffer some sort of damage not easily repaired without specialist tools.

Editors: Learn the meaning of words

Bricking means to render unbootable with no means of recovery other than sending back to the manufactures. This is usually done through the corruption of the firmware.

BS

Corrupt the BIOS = bricked. Corrupting Windows = not bricked.

Bricked?

Did anybody mention that they used "bricked" incorrectly?

Line Up!

So who wants to be the first to try? ;-)

Maybe it's just Arthur vs Ford

to paraphrase Mr Dent:

Ah, this is obviously some strange use of the word brick that I wasn't previously aware of.

porkythepig

It will l-l-l-let an attacker corrupt W-w-w-windows! T-t-t-that's all folks!

From the exploit description

It sounds like the user needs to be using Internet Explorer in order to be vulnerable. I doubt anything happens on Firefox or other browser since there is purposely no ActiveX support there.

Also I note that the exploit description itself never uses the inaccurate word "brick".

Okay, "bricked" was the wrong word...but!

The story is yet another illustration of how dangerous ActiveX is. This is not the first example and it probably won't be the last. So many other things depend on or otherwise utilize activex... some are highly security sensitive like in the case of ADP. I cannot understand why, after all these years of examples why Microsoft hasn't recalled the use of the technology as inherently dangerous. But really, it's worse than that. It breaks the premise of the web. The use of the web is not supposed to be limited to a certain hardware specification under a certain software configuration... this is irrelevant, of course, to the dangers pushed upon the users who are often required to use it.

Agree with both points.

1) Bricked is the wrong word.

2) This hilights the dangers of any holes in a sandbox. The only secure way to design a sandbox is for there to be no mechanism from inside the sandbox to request access outside it... whether by installing a plugin, executing an external application, or otherwise elevating privileges. Even if the request is normally denied, the existince of that mechanism itself creates a new class of attacks.

The corollary to point two is that ActiveX is not just a security hole, it's a different *kind* of security hole.

On the other hand, all three of the most common browsers have a mechanism to request access outside the sandbox. None of them are as bad as ActiveX, but they're all unnecessary.

* Any browser on Windows is subject to URI quoting attacks on helper applications, due to the lack of a guaranteed quote-safe command line and the use of a single set of helper bindings for trusted and untrusted sources.

* LaunchServices on OS X duplicates the second problem as well.

* Firefox and Safari both allow web pages to request plugins be installed: XPI in Firefox and Dashboard plugins in Safari on OSX. They both wrap these interfaces in multiple levels of "approval dialogs", but my experience is that there are too many people who can be relied upon to eventually hit "go ahead and infect me" by reflex.

* Safari and Internet Explorer can both be made to, with various amounts of approval dialogs, open downloaded documents automatically. Safari used to do this by default but thankfully it's now an option... but really that capability should not be there at all.

None of these holes in the sandbox actually make things more convenient for users. They look like they might, but it's actually easier to download a document or a plugin and than (as a separate step) request that it be opened or installed from a file browser or from a download manager, because making the operation asynchronous and deliberate like that means you don't have to go crazy with approval dialogs, because you're not running the risk of an unexpected dialog coming up for a user with an itchy mouse button...

This is why we make our own clone-images

We have some of the affected models here at work, but I make my own clone images sans the HP crapware.

If you removed the crap..

If you removed the crapware that HP sent out with it.. You'll be fine.. Just takes like 3 or 4 hours to do it all though... Extremely annoying...

"bricking"

"Bricking" a device means destroying hardware or destroying firmware in a way that cannot be recovered.

Merely destroying a Windows installation is not "bricking" a machine; Windows needs to be reinstalled from time to time anyway.

I've known about this for years...

..But I didn't know "Plugging it in and using it" was considered an exploit.

A slight correction

A security researcher calling himself porkythepig...

OK, let's be honest here. Competent Slashdot "editors" could have made these corrections...

An irresponsible hacker calling himself porkythepig...

A theory...

...I must propose that Slashdot editors are involved in a conspiracy. To wit: In the past few months or so, we have had at least three submissions that have incorrectly used the term "brick" to describe a problem with typically simple solutions- distinctly not problems without solution. Anyone interested enough to submit an article to Slashdot would know the meaning of the term. Therefore, the only explanation is that the editors are cultivating the submissions in a way calculated to stimulate numerous off topic posts highlighting the improper use of the term, in turn increasing the traffic in order to generate add revenue. What's the definition of troll?

Re:A theory...

It all started with the iPhone. Apple is so ahead of their time, first product to be "bricked" without actually being BRICKED. PCs are just now catching up.

My Theory

Now news sources are just trolling /.

Tell me why...

Tell me why a legitimate "security researcher" calls himself "porky the pig." Tell me why I should trust anything he says.

Irene Demova Virus

Well, at least that explains how the Irene Demova Virus [wordpress.com] could affect only a single brand of laptop. Now we just have to hope that teh terrists use unpatched HP laptops as bomb timers. [wikidot.com]

Waitaminute...

Why...

YES, it is 'bricked.' Totally and utterly useless, yes. You'll need to buy a brand new one. Seeing as I'm a nice guy, I'll buy this completely bricked, utterly useless laptop from you. Just for the case and spare parts, you see. Does $100 sound reasonable for a bricked, totally useless laptop that you can never use again? Hmmm?

my install of fedor aworks just fine

even for 64-bit HP, I'm cranking along... oh ..what? no I didn't RTFM why?

Laptops ONLY

Disclaimer: Did not read the article.

Does this affect Desktop machines from HP-Compaq as well? We just received a metric buttload of these machines and I'm curious if they can all be suceptible.

"Bricked" has become the new "SKU"

FFS.. learn how to use the term!

So...?

Could I un-brick it if I ran Linux?

This is the reason I buy only...

...Acme brand laptops. For some reason, they seem impervious to bricking.

In other news

They though they had a headline when they realized it was easy to brick a HP but then they realized how much more efficient an HP is when its "bricked".

In defense of "brick"

a) it's amusing to see people clamor for the "good old days" when "brick" meant a very specific form of computer disablement. Yes, those were the days, long ago, perhaps even before the television writers' strike began, why way back in ... aw, heck, you can't expect me to believe quite *that* far back, can you? I imagine a cadre of formerly peaceful hippies in a battle to the death on the proper etymology of "roach," and whether a joint which can still be successfully smoked while held between the fingers is or is not technically a roach.

b) Brick clearly means more than "a small glitch in a basically working device," but "renders useless until a complete system re-install" doesn't seem too crazy; I've seen this use many times, esp. wrt gadgets whose firmware can be replaced with firmware. It's certainly used sometimes to refer to the kind of situation where (as here) the device becomes a doorstop until a complete new system image is installed.

You can choose to fixate on the word (hey, it's a free world! :)), but there's some evidence [google.com] that not everyone agrees that a bricking is forever.

And if anyone would like to argue some sort of Ur-grammar definition into "brick" in the hyper-recent use to refer to borked electronics, complain about how today's kids aren't true enough to their l447sp3@k roots, may I introduce the brick (older meaning) [xinhuanet.com].

Uh-oh...

"Exploit Found to Brick Most HP and Compaq Laptops"

Well, I have a Compaq Presario C500T...

"The exploit uses an ActiveX control in HP's Software Update. It would 'let an attacker corrupt Windows' kernel files..." ...which I installed Ubuntu on. Oh well.

"Most HP and Compaq Laptops"

Hmm, according to the article the culprit is "HP Software Updates", a program I unistalled long ago and I think many else have uninstalled too (or not installed after a clean install). So say "most" feels a little wrong to me...

Lucily I uninstalled all the crapware...

I uninstalled all the HP crapware as soon as I got it home.

The only thing the updater program seemed to update was itself. It certainly didn't download any new graphics/network drivers or anything useful like that.

fix

I'm not expecting a fix in the next quarter... since i got my HP this summer there have been no new updates, even though at least my Graphics card has gotten several updates (if i wasnt running a HP I could have used them)

Did anybody notice?

Did anybody notice that they mention term bricked incorrectly?

I effectively bricked my compaq with linux!

this was like 5 years ago:

installed linux, don't know which distrib...
activate power saving
wait a while, the laptop goes into hibernate
and it stays there. forever.
even removing batteries, harddisk etc... for several days did not help.
needed to send it to compaq for repair.

meaning equals use, use equals meaning

Sorry folks, you're making the mistake of thumping the dictionary instead of looking at actual, in the wild use, of the word "brick". It works perfectly, in this context, as a term to describe breaking some aspect of a device. It appears that some people like using the term that way, and are perfectly happy with it. It works for them. You don't have to like it, and don't have to participate in the usage, but this is demonstrably what is happening. Measurable field data exists, and native speakers of English, in context, are now using the word "brick" to mean precisely what you are all claiming it cannot mean. Go back to working on computers, and leave linguistic analysis to those who know something about it. Disclaimer: I drive a brick [caunter.ca], and know something about language.

Bricked = Toileted

Bricked should be reserved for the hardware related destruction of a machine.

I prefer the term toileted when the exploit only causes Windows XP re-flushing.

For the destruction of a data centre, I recommend the term "constipated". Ie the entire data centre was constipated by the active-x exploit.

When an entire country is disrupted by an exploit I feel the term "mega-plopped" is fitting.

I also feel the general population would relate better to these terms and these terms would help motivate them to avoid such incidents via mental imagery association. The idea of a brick has little symbolic value, especially as many computers are shaped like bricks anyway.

Critical update for HP certain laptops

This past month HP issue a critical BIOS update for HP Pavilions 6000, 9000 and some Compaq series.. I don't know if this is related to this 'bug' or not.. They also issued updates to their 'HP' update wares... I have such a laptop.. It is my only Windors box.. All other are Slackware... FYI... IF you have such a machine using either HP update or visiting HP support you can get the BIOS updates (winflash) and other software updates for these machines...

"Paging Dr. Bubba..."

"A security researcher calling himself porkythepig [...]"

How come I never hear of a cancer researcher calling herself "Bubba the Shithammer"? Or a nuclear scientist who calls himself "Fluffy Huggy Bunny"?

And people wonder why computer security is consistently ignored.

Good Grief

Come on people. I know it's all sensational and stuff to talk about bricking, but this ain't bricking. Bricking is when the device is now as "useful as a brick" or could literally be used only as a paper weight or a door stop. When it cannot be recovered or fixed, that's a brick. This is just a fouled up machine. Which viruses have been giving us since the early 90s when hard drives became standard in PCs.

It's like there's a bunch of kiddies out there who heard all the sensation about iPhones getting bricked (now that seemed like a genuine brick for quite a while) and now think that the cool term for screwed up is now "brick". Use some precision, for crying out loud.

REPAIR INSTALL!!!!!....

all you would need to do is a simple repair install. it's an option in the xp CD(dunno about vista as i have never used it and don't plan to any time soon) this is not bricked if like lazarus it can be resurrected and make to work again using a simple sogftware route. bricking means no lazarus... not even a hint of reincarnation under a reinstall/repair install. Mind you in Scotland, where i live, a non IT meaning if "brick" is crap. as in "he saw the car coming and bricked himself". bricking in this meaning also renders a person useless but only until they wash themelves and change their garments and prpare to never live it down!

Dude, you said "batch"!!

The same researcher last week outlined a batch of additional vulnerabilities in HP and Compaq laptops, for which HP later issued patches."

OK, I admit, you didn't say "batch" in the context I'm about to use it, but bear with me. What these automatic update programs do is simple enough to put in a batch file. A small one. With a decent man page, I mean README.txt file, even mega-dolt users could get all their updates on schedule, including programs and parts they haven't purchased yet. The marginal improvement in convenience was never worth the effort it took to put basic functions under control of a GUI. When those same marginal improvements in convenience also make the purchaser vulnerable to infiltration, or even simplY vandalism "only" requiring a re-install, it's time for a grown-up computer with an actual operating system, structurally distinct from its bundled web browser.

How to Brick.

All most exploits would have to do to brick a PC is to set the ATA security password on the hard drive to something random that's instantly discarded. Done right, only the master password for the drive would unlock the drive after having done a security format first, wiping all data. And most users don't have the master password so they'd have to attempt to get it, based on their drive's serial number, from their PC manufacturer or hard drive vendor. It bricks the hard drive in most cases because getting the master password is so awkward.

Re:Deal with it

As far as I'm concerned, if it has Windows installed on it from the factory, it's already bricked.

Re:Deal with it

It's a fairly recent phenomenon.. like the iphone 'brick' that wasn't a brick at all but the press seemed to pick up on the word even though they have no idea what it means (if anyone really thinks their iphone is bricked I'm quite happy to dispose of it for them, for a fee of course).

Most people still use the term correctly.. but the press through their damned stupid ignorance is determined to change that. Slashdot should not be one of the sites doing it.. they're supposed to know better.

Re:This is NOT bricking.

Call it the law of averages as the internet gains more mainstream users.

Or call it democracy.

Re:Deal with it

"It's" will be used incorrectly, and it's meaning has changed. Don't waste time fighting it, we have lost. Just like 'Hacker' or a billion other phrases the media has misused. Really, you're time is more valuable then that. or... "You're" will be used incorrectly, and it's meaning has changed. Don't waste time fighting it, we have lost. Just like 'Hacker' or a billion other phrases the media has misused. Really, you're time is more valuable then that. etc.

Re:Deal with it

You forgot your </sarc> tag~