aibad.blogg.se

Update mechanisms are valuable targets for attackers, because they can be tainted to distribute malware. BIOSConnect is part of a broader Dell update and remote operating system management feature called SupportAssist, which has had its own share of potentially problematic vulnerabilities. The vulnerabilities show up in a Dell feature called BIOSConnect, which allows users to easily, and even automatically, download firmware updates. "The industry has achieved all this maturity of security features in application and operating system-level code, but they're not following best practices in new firmware security features." It's essentially like traveling back in time-it's almost like the '90s again," says Jesse Michael, principal analyst at Eclypsium. "These vulnerabilities are on easy mode to exploit. Dell is releasing patches for the flaws today. The researchers estimate that the vulnerabilities expose 30 million devices in total, and the exploits even work in models that incorporate Microsoft's Secured-core PC protections-a system specifically built to reduce firmware vulnerability. The new findings from researchers at the security firm Eclypsium affect 128 recent models of Dell computers, including desktops, laptops, and tablets. And these vulnerabilities could be exploited to gain full access to target devices. Now a well-intentioned mechanism to easily update the firmware of Dell computers is itself vulnerable as the result of four rudimentary bugs. It's often riddled with vulnerabilities, it's difficult to update with patches, and it's increasingly the target of real-world attacks. Researchers have known for years about security issues with the foundational computer code known as firmware. Artur Widak | Getty Images reader comments 78 with