Dell Laptops and Computers Found Vulnerable to Attacks

According to research, February 2019, at the University of Cambridge, it was found that many modern laptops desktop computers are vulnerable to hacking through common plug-in devices.

The research, team at the Network and Distributed Systems Security Symposium in San Diego, showed how in a matter of seconds the attackers can compromise an unattended machine through devices such as chargers and docking stations.

Vulnerabilities were found in computers with Thunderbolt ports running Windows, macOS, Linux, and FreeBSD. Many modern laptops and an increasing number of desktops are vulnerable

On May 1st ZDNet revealed how a vulnerability in the Dell SupportAssist utility exposes Dell laptops and personal computers to a remote attack that can allow hackers to execute code with admin privileges on devices using an older version of this tool and take over users’ systems.

Dell has released a patch for this security flaw on April 23; however, many users are likely to remain vulnerable unless they’ve already updated the tool –which is used for debugging, diagnostics, and Dell drivers’ auto-updates.

The number of impacted users is believed to be very high, as the SupportAssist tool is one of the apps that Dell will pre-install on all Dell laptops and computers the company ships with a running Windows OS (systems sold without an OS are not impacted).

CVE-2019-3719

According to Bill Demirkapi, a 17-year-old security researcher from the US, the Dell SupportAssist app is vulnerable to “remote code execution” vulnerability that under certain circumstances can allow attackers an easy way to hijack Dell systems.

The attack relies on luring users on a malicious web page, where JavaScript code can trick the Dell SupportAssist tool into downloading and running files from an attacker-controlled location.

Because the Dell SupportAssist tool runs as admin, attackers will have full access to targeted systems, if they manage to get themselves in the proper position to execute this attack.

ATTACK REQUIRES LAN/ROUTER COMPROMISE

“The attacker needs to be on the victim’s network in order to perform an ARP Spoofing Attack and a DNS Spoofing Attack on the victim’s machine in order to achieve remote code execution,” Demirkapi told ZDNet today in an email conversation.

This might sound hard, but it isn’t as complicated as it appears.

Two scenarios in which the attack could work include public WiFi networks or large enterprise networks where there’s at least one compromised machine that can be used to launch the ARP and DNS attacks against adjacent Dell systems running the SupportAssist tool.

Another plausible scenario is in situations where hackers have compromised the users’ local WiFi router, and are in a position to alter DNS traffic directly on the router.

As we’ve seen in the past few months, hacking routers to hijack DNS traffic isn’t a sophisticated attack anymore and is happening more and more often, mainly due to the sad state of router security.

ATTACK REQUIRES NO USER INTERACTION

Furthermore, the attack requires no user interaction except tricking users on accessing a malicious page, and the malicious JavaScript code that drives the attack can also be hidden inside ads (iframes) on legitimate sites, if ever necessary.

As Demirkapi explained to ZDNet, the iframe will point to a subdomain of dell.com, and then a DNS spoofing attack performed from an attacker-controlled machine/router will return an incorrect IP address for the dell domain, allowing the attacker to control what files are sent and executed by the SupportAssist tool.

The good news is that Dell took the researcher’s report seriously and has worked for the past months to patch CVE-2019-3719, a task that concluded last week with the release of SupportAssist v3.2.0.90, which Dell users are now advised to install.

Great work by Dell here to patch this vuln. Most other hardware vendors wouldn’t even have bothered to reply. Amazing finding by Bill as always. Can’t wait till he starts breaking Windows stuff,  t.co/hp3SA6omRb

Related Resources:

What is the Difference between a Firewall, Router & Secure Web Gateway

Important Features of Vulnerability Scanners

Hackercombat.com Presents: A Crash Course of DNS Cache Poisoning

DNS-Hijacking Malware Bypasses Antivirus and Infects Apple MacOS