Vulnerability Exposes Dell Laptops, Pcs to Remote Hijacks

reporter 1222 — Thu, 02 May 2019 06:41:44 +0000

A vulnerability in the Dell SupportAssist utility exposes Dell laptops and personal computers to a remote attack that can allow hackers to execute code with admin privileges on devices using an older version of this tool and take over users’ systems.

Dell has released a patch for this security flaw on April 23; however, many users are likely to remain vulnerable unless they’ve already updated the tool –which is used for debugging, diagnostics, and Dell drivers auto-updates, ZDnet reported.

The number of impacted users is believed to be very high, as the SupportAssist tool is one of the apps that Dell will pre-install on all Dell laptops and computers the company ships with a running Windows OS (systems sold without an OS are not impacted).

CVE-2019-3719

According to Bill Demirkapi, a 17-year-old security researcher from the US, the Dell SupportAssist app is vulnerable to a “remote code execution” vulnerability that under certain circumstances can allow attackers an easy way to hijack Dell systems.

The attack relies on luring users on a malicious web page, where JavaScript code can trick the Dell SupportAssist tool into downloading and running files from an attacker-controlled location.

Because the Dell SupportAssist tool runs as admin, attackers will have full access to targeted systems, if they manage to get themselves in the proper position to execute this attack.

ATTACK REQUIRES LAN/ROUTER COMPROMISE

“The attacker needs to be on the victim’s network in order to perform an ARP Spoofing Attack and a DNS Spoofing Attack on the victim’s machine in order to achieve remote code execution,” Demirkapi told ZDNet today in an email conversation.

This might sound hard, but it isn’t as complicated as it appears.

Two scenarios in which the attack could work include public WiFi networks or large enterprise networks where there’s at least one compromised machine that can be used to launch the ARP and DNS attacks against adjacent Dell systems running the SupportAssist tool.

Another plausible scenario is in situations where hackers have compromised the users’ local WiFi router, and are in a position to alter DNS traffic directly on the router.

As we’ve seen in the past few months, hacking routers to hijack DNS traffic isn’t a sophisticated attack anymore and is happening more and more often, mainly due to the sad state of router security.

ATTACK REQUIRES NO USER INTERACTION

Furthermore, the attack requires no user interaction except tricking users on accessing a malicious page, and the malicious JavaScript code that drives the attack can also be hidden inside ads (iframes) on legitimate sites, if ever necessary.

As Demirkapi explained to ZDNet, the iframe will point to a subdomain of dell.com, and then a DNS spoofing attack performed from an attacker-controlled machine/router will return an incorrect IP address for the dell.com domain, allowing the attacker to control what files are sent and executed by the SupportAssist tool.

The good news is that Dell took the researcher’s report seriously and has worked for the past months to patch CVE-2019-3719, a task that concluded last week with the release of SupportAssist v3.2.0.90, which Dell users are now advised to install.

Proof of concept to reproduce an attack is available on GitHub, and Demirkapi also published a demo video showing how easily an attack can lead to a full device compromise. Demirkapi’s vulnerability report, for additional technical details, is available on the young researcher’s blog.

The post Vulnerability Exposes Dell Laptops, Pcs to Remote Hijacks appeared first on Iran News Daily.

Microsoft Is Selling Excellent Dell XPS 13, Inspiron 15 for Hundreds off

reporter 1222 — Mon, 11 Dec 2017 07:38:43 +0000

Microsoft’s 12 Days of Deals features dozens of deals on Dell PCs, but here’s two we really like — including our best budget gaming laptop for $200 off.

Microsoft’s 12 Days of Deals continues on today with a number of discounts across various Dell laptops and desktops. Two caught our eye: the highly-reviewed Dell XPS 13 9360 ultrabook on sale for $999, and the best budget gaming laptop, the Dell Inspiron 15, on sale for $599.

Dell XPS 9360: why it’s a good deal

Here’s why we like the $999 Dell XPS 13 9360 deal. For one thing, Dell’s XPS 13 ultrabooks consistently perform at or near the top of our tests: we rated the 2017 Dell XPS 13 4.5 out of 5 stars, and the 2016 Dell XPS 13equally highly. The latest update has a Intel 8th-generation Core chip inside, helping boost performance and battery life.

Here’s the catch, though: the vast majority of the Dell XPS 13s you’ll find online contain a Core i7 chip, the most powerful of Intel’s lineup. That’s perfectly fine, but what if the MSRP of $1,299 is too rich for your blood? That’s where the $999 Dell XPS 13 9360 deal helps out. You’ll save $200 off of the Core i7 price and still get a solid Core i5 ultrabook for the price.

Granted, the deal’s not absolutely perfect. With 8GB of memory, you shouldn’t experience any slowdowns browsing or running apps on the Dell XPS 13 9360. But with just a 128GB of storage, things may get a little cramped unless you have an external hard drive.

Don’t worry, though—there’s an alternative. Remember how highly reviewed the Dell XPS 13 was for both the 2017 generation as well as the 2016 model? Sure, we’d always advise buying a machine with the latest components. But if you’d like a Dell XPS 13, consider browsing the available Dell XPS 13 models on Amazon or elsewhere. (You can bump up the SSD size to 256GB with this XPS9360 model, and get a better screen, to boot, for just over $1,000.)

Just know what you’re shopping for: if you see a laptop with a processor model number that begins with a “6,” that’s a sixth-generation Core chip—possibly a bit out of date for a good gift. Look for a 7th-generation (or 8th-generation) Core chip instead.

Dell Inspiron 15 i5577: why it’s a good deal

Dell offered a deal on the Inspiron 15 earlier this year, pricing it at $800. For that price, you got a 15.6-inch display, 8GB of RAM, and discrete Nvidia GeForce GTX 1050 graphics. Now, Microsoft is selling that same configuration (or close to it) for just $599.

So what, you may say. Well, not only did we rank the nearly identical Dell Inspiron 15 7000 4 out of 5 stars, but PCWorld consistently ranks it at as our best budget gaming laptop. This looks like a pretty solid deal.

About the only small hitch that we can find is that Microsoft doesn’t list the actual panel type. One of the complaints we had was early models used a poor 1080p TN panel. Dell’s since rectified that fact by essentially making a much nicer IPS panel standard, but this could be Dell clearing out some of its inventory for the holidays. You can always just use an external monitor, though.

Microsoft and Dell have a ton of additional deals on Microsoft’s site, from Dell XPS 8910 Signature Edition desktops to Alienware laptops, and more. While you may find other deal to whet your buying appetite, we think both the XPS 13 and the Inspiron 15 are good deals, albeit for slightly different reasons.

The post Microsoft Is Selling Excellent Dell XPS 13, Inspiron 15 for Hundreds off appeared first on Iran News Daily.

Dell Archives - Iran News Daily

Vulnerability Exposes Dell Laptops, Pcs to Remote Hijacks

Microsoft Is Selling Excellent Dell XPS 13, Inspiron 15 for Hundreds off