Monday, December 4, 2023

Most of the Dell Computers Vulnerable to Remote Hack Through Pre-Installed SupportAssist Software

A critical remote code execution vulnerability that exists with SupportAssist Client software allows attackers to gain access to vulnerable machines remotely.

According to Dell, SupportAssist is an Automated, proactive and predictive client support software that checks system health and send the necessary information to Dell, if any issue triggered. The software found in most of the Dell Computers.

It works by running webservers on the local machine in any of the following port 8884, 8883, 8886, or port 8885 based on the availability to establish a connection with Dell website.

Access-Control-Allow-Origin header used for validation purposes, which ensure the local computer is to accept request only from dell.com and not from any other websites.

An independent 17-year-old security researcher, Bill Demirkapi, identified vulnerabilities with integrity check for ClientServiceHandler.ProcessRequest, which allows hackers to bypass the validation and deploy malware on the vulnerable machine.

Bill Demirkapi published a blog post that details various methods to bypass the Referer/Origin check. The Remote Code Execution vulnerability can be tracked as CVE-2019-3719.

Demo video that showcasing the vulnerability.

SupportAssist Client versions prior to 3.2.0.90 are affected with the vulnerability, users are recommended to update with version 3.2.0.90 and later.

“An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites,” reads the advisory.

Dell also patched another vulnerability (CVE-2019-3718), which allows an “unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.”

Now Dell addressed both of these vulnerabilities and the customers are recommended to update with SupportAssist Client version 3.2.0.90 and later.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Related Read

ASUS Hack – Here is the List of MAC Addresses Affected in the ShadowHammer Cyberattack – Live Update

ASUS Hacked – Hackers Hijacked ASUS Company servers to Inject the Malware in Millions of Users Computer

Hackers using Android & iOS Spyware “Pegasus” to Conducting Massive Surveillance Operations in 45 Countries

Website

Latest articles

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles