reader comments
12 with 10 posters participating
Researchers have known for years about security issues with the foundational computer code known as firmware. It’s often riddled with vulnerabilities, it’s difficult to update with patches, and it’s increasingly the target of real-world attacks. Now a well-intentioned mechanism to easily update the firmware of Dell computers is itself vulnerable as the result of four rudimentary bugs. And these vulnerabilities could be exploited to gain full access to target devices.
The new findings from researchers at the security firm Eclypsium affect 128 recent models of Dell computers, including desktops, laptops, and tablets. The researchers estimate that the vulnerabilities expose 30 million devices in total, and the exploits even work in models that incorporate Microsoft’s Secured-core PC protections—a system specifically built to reduce firmware vulnerability. Dell is releasing patches for the flaws today.
“These vulnerabilities are on easy mode to exploit. It’s essentially like traveling back in time—it’s almost like the ’90s again,” says Jesse Michael, principal analyst at Eclypsium. “The industry has achieved all this maturity of security features in application and operating system-level code, but they’re not following best practices in new firmware security features.”
The vulnerabilities show up in a Dell feature called BIOSConnect, which allows users to easily, and even automatically, download firmware updates. BIOSConnect is part of a broader Dell update and remote operating system management feature called SupportAssist, which has had its own share of potentially problematic vulnerabilities. Update mechanisms are valuable targets for attackers, because they can be tainted to distribute malware.
The four vulnerabilities the researchers discovered in BIOSConnect wouldn’t allow hackers to seed malicious Dell firmware updates to all users at once. They could be exploited, though, to individually target victim devices and easily gain remote control of the firmware. Compromising a device’s firmware can give attackers full control of the machine, because firmware coordinates hardware and software, and runs as a precursor to the computer’s operating system and applications.
Dell auto-updates turned on.” If not, the company says customers should manually install the patches “at their earliest convenience.”
The Eclypsium researchers caution, though, that this is one update you may not want to download automatically. Since BIOSConnect itself is the vulnerable mechanism, the safest way to get the updates is to navigate to Dell’s Drivers and Downloads website and manually download and install the updates from there. For the average user, though, the best approach is to simply update your Dell however you can, as quickly as possible.
“We’re seeing these bugs that are relatively simple like logic flaws show up in the new space of firmware security,” Eclypsium’s Michael says. “You’re trusting that this house has been built in a secure way, but it’s actually sitting on a sandy foundation.”
After running through a number of nightmare attack scenarios from firmware insecurity, Michael takes a breath. “Sorry,” he says. “I can rant about this a lot.”
This story originally appeared on wired.com.
