Secure Boot flaws could enable hackers to take control of Dell devices
Around 30 million Dell devices at risk of hacking
Security researchers have discovered several vulnerabilities affecting the BIOSConnect feature within Dell Client BIOS. The bugs could enable hackers to run code at the Bios level.
The bugs affect 129 models of enterprise and consumer laptops, tablets, and desktops protected by Secure Boot. Researchers believe more than an estimated 30 million devices are affected.
According to a new report by security researchers at Eclypsium, the chain of flaws gets a CVSS score of 8.3. When used together, these flaws enable a privileged network adversary to impersonate Dell.com and gain arbitrary code execution at the BIOS/UEFI level of the affected device.
This means that hackers could control the device’s boot process and subvert the operating system (OS) and higher-layer security controls. Researchers warned that such code may alter the initial state of an operating system, violating common assumptions on the hardware/firmware layers and breaking OS-level security controls.
“As attackers increasingly shift their focus to vendor supply chains and system firmware, it is more important than ever that organizations have independent visibility and control over the integrity of their devices,” researchers said.
BIOSConnect is part of SupportAssist and enables users to perform a remote OS recovery or update device firmware. In either case (firmware update or OS recovery), BIOSConnect enables the system’s BIOS to contact Dell backend services over the internet and coordinate the update or recovery process.
RELATED RESOURCE
Researchers found four vulnerabilities that would enable a privileged network attacker to gain arbitrary code execution within the BIOS of vulnerable machines. These flaws were found on a Dell Secured-core PC Latitude 5310 using Secure Boot. Researchers soon found the problem existed on other Dell laptops and desktops.
The first flaw is an insecure TLS Connection from BIOS to Dell. A hacker with a privileged network position could impersonate Dell and deliver attacker-controlled content back to the victim device.
The remaining flaws concern overflow vulnerabilities allowing arbitrary code execution. Hackers impersonating Dell could deliver malicious content back to the victim machine. Two of these vulnerabilities affect the OS recovery process, while the other affects the firmware update process.
The researchers notified Dell of the flaws. Dell has since issued a security advisory and is scheduling BIOS/UEFI updates for affected systems and updates to affected executables from Dell.com.
-
Why leaders need to build resilience to avoid AI burnoutIn-depth Stress levels are surging among those in leadership roles due to accelerating AI adoption – resilience is key to avoiding burnout
-
How practical-based learning for AI can close the digital skills gapEquipping the next generation of AI-engineers, developers, and leaders with hands-on experience and practical teaching resources is key
-
How to achieve cyber resilience today, tomorrow, and beyondResilience in the event of an attack is a business need, not a nice-to-have
-
Ubuntu vulnerability exposes enterprises to root escalation, complete system compromiseNews The high-severity Ubuntu vulnerability allows an unprivileged local attacker to escalate privileges through the interaction of two standard system components
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
‘Resilience debt’ is now one of the most pressing cyber challenges for enterprises – here's what it means and how you can tackle itNews Research from Dell Technologies suggests the gap between cyber resilience and perception of readiness is getting bigger
