Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label System Breach. Show all posts
Vulnerability and Exploits
BIOS Virus Code Execution Flaw Dell System Breach Vulnerabilities and Exploits Vulnerability and Exploits

Several Dell Systems are Affected by New BIOS Bugs

 

Active exploitation of all of the identified problems cannot be detected by firmware integrity monitoring systems, as per Firmware Insyde Software's InsydeH2O and HP Unified Extensible Firmware Interface (UEFI), which discovered the vulnerabilities. As previously stated, secure remote health attestation systems are unable to detect compromised systems due to technical limitations. 

The high-severity vulnerabilities are identified as CVE-2022-24415, CVE-2022-24416, CVE-2022-24419, CVE-2022-24420, and CVE-2022-24421 on the CVSS scoring system. 

All of the weaknesses are related to poor input validation vulnerabilities in the firmware's System Management Mode (SMM), permitting a local privileged attacker to execute arbitrary code via the management system interrupt (SMI). System Management Mode in x86 microcontrollers is a special-purpose CPU mode for performing system-wide functions like power efficiency, hardware and system control, temperature monitoring, and other exclusive manufacturer-developed code. 

A non-maskable interrupt (SMI) is activated at runtime whenever one of these tasks is requested, and SMM code installed by the BIOS is executed. The method is ripe for misuse because SMM code runs at the greatest privilege level and is transparent to the underlying operating system, making it ideal for implanting persistent firmware. A variety of Dell products are affected, including the Alienware, Inspiron, Vostro, and Edge Gateway 3000 Series, with the Texas-based PC company advising customers to replace their BIOS as soon as possible. 

"The ongoing identification of these vulnerabilities demonstrates what we call repeatable failures' around input cleanliness or, in general, insecure coding habits," according to Binarly researchers. "These errors are directly related to the codebase's complexity or support for legacy components which receive less security attention but are nevertheless frequently used in the field. In many cases, the same vulnerability can be addressed numerous times, yet the attack surface's complexity still leaves open gaps for malicious exploitation." 

Dell SupportAssist is a program which manages support functions such as troubleshooting and recovery on Windows-based Dell workstations. The BIOSConnect feature can be used to restore a corrupted operating system as well as upgrade firmware. 

The functionality does this by connecting to Dell's cloud infrastructure and pulling required code to a user's device. 
Read more »
System Breach
Data Breach Emisoft System Breach

Cybersecurity Company Emisoft Suffers System Data Breach, Founder Apologizes

The founder of Emisoft, a cybersecurity company based in New Zealand has issued an apology over a configuration miscalculation that resulted in a system data breach. The company's test systems were breached and the news came out on February 3. Christian Mairoll, founder and managing director, Emisoft, told about the incident. She wrote that the cybersecurity incident shouldn't have occurred, due to the breach, the product and services that generate Emisoft's log records, were exposed to unauthorized third-party players.  

Christian said that the database was exposed from January 18 to February 3, 2020. During that period, she suspects, at least one individual had got access to its files when the attack happened. The investigation informed that 14 customer user IDs related to 7 distinct organizations comprised of the data compromised by the attack. Emisoft on its blog said, "the stolen data in question consists of technical logs produced by our endpoint protection software during normal usages, such as update protocols, and generally does not contain any personal information like passwords, password hashes, user account names, billing information, addresses, or anything similar. 

However, as part of the investigation, we noticed that 14 customer email addresses were part of the scan logs due to detections of malicious emails stored in the users’ email clients." Following the cyberattack, Emotet shut down the compromised systems and started a full foreign analysis of the incident. Emisoft has contacted the customers affected by the data breach. Besides this, to assure no such event happens again, Emisoft has pledged to conduct all its future experiments and tests in a safe isolated environment. It'd have no internet access and data would be AI-generated.  

"As always, we continually assess our procedures and policies and seek new ways to improve our approach to security. We understand the importance of our role as guardians of your information and online safety and will continue to work every day to re-earn your trust," said Emisoft in an apology. As of now, these are the only details that E Hacking News is aware of, stay updated.  
Read more »
Subscribe to: Posts (Atom)