Flaw in Dell Software Leaves Computers Vulnerable to Hacks
Owners of Dell laptops might want to dust off the company’s bundled software update tool. There’s a critical update addressing a flaw that could allow an attacker to take over your system simply by sending you to a compromised website. Amusingly, the bug is in Dell’s own remote support tool that is supposed to help the company fix your laptop. In this case, it’s breaking things. That’s only slightly less bizarre than Asus pushing malware with its support tools.
The attack relies on tricking a user into visiting a particular website configured by the perpetrator. There, custom JavaScript fools the Dell software into running files of the attacker’s choosing. Someone could use this to steal data, install ransomware, or add the computer to a botnet. You can see a demo of the vulnerability in the video below.
There is at least a shred of good news. Your system is only vulnerable if the attacker is on the same local network where they can use ARP Spoofing. That’s not exactly an insurmountable task. Public Wi-Fi networks are a prime target, as are large corporate networks where someone can quietly plug in and launch an attack. A remote attacker may also be able to fool the SupportAssist tool by compromising a user’s router.
Dell issued the patch on April 23, but many users are probably conditioned to ignore popups and alerts from Dell’s bundled software — it’s usually not important. This is one of those times when you really need to update, though.
To its credit, Dell responded to the report by Demirkapi and took quick action to patch the vulnerability. SupportAssist v3.2.0.90 is available as a direct download on Dell’s site as well as a push installation via the company’s bundled software.
Continue reading
Someone Hacked Ray Tracing Into the SNES
Surely, a game console from the 90s couldn't support ray tracing, right? Wrong. Game developer and engineer Ben Carter hacked ray tracing into the Super NES with a little help from an FPGA dev board.
Apple Urges Immediate iPhone Update to Block Active Online Hacks
There's a new version of Apple's iOS software for iPhone and iPad devices, and as usual, Apple is going to start pestering users to update. This time, the nagging for iOS 14.4 comes with a little more urgency.
Signal Founder Hacks Cellebrite’s Phone Hacking Tools
The Israeli firm recently bragged that it has helped law enforcement retrieve data from the encrypted Signal chat app. Well, Signal founder Moxie Marlinspike had something to say about that.
New ‘Morpheus’ CPU Design Defeats Hundreds of Hackers in DARPA Tests
A new CPU design has won accolades for defeating the hacking efforts of nearly 600 experts during a DARPA challenge. Its approach could help us close side-channel vulnerabilities in the future.