100,000 Dell Users Vulnerable leak In Support Tool

Certainly 100,000 Dell users at risk by a leak in the Dell System Detects support tool allowing an attacker in the worst case, the system can take over completely if a wrong website visited. Dell System Detects offered on the Dell support page and helps to find the necessary drivers for your computer. Researcher Tom Forbes discovered a vulnerability in the program, which allows an attacker to execute arbitrary code on the computer, such as installing malware.

Detect System installs a web server on port 8884 is listening to incoming messages from the Dell website. However, Dell did not check carefully whether these incoming messages are actually coming from the Dell website. So were also requests for domains containing the text "Dell" accepted. Once the user is a domain that contains the text "Dell" would visit this area may send a request that accepts computer.

The tool also proved not only to provide the service tag of the computer to search for drivers, but also offer other options, such as downloading and installing files. Also when downloading and installing files shot the control deficiency, which Forbes malware could send it to a computer when a domain containing "Dell" was visited.

The problem is compounded by System Detects after installation in the background and remains active after a restart of the system will restart automatically. Forbes warned Dell, which adopted an update. It was investigated whether the domain ".dell." contained, As a result, it was still possible to carry out an attack by, for example, to create a subdomain as dell.domain.tld.

Patch

This week, Dell has a new version (6.0.14) adopted which ensures that only requests "* .dell.com" are accepted. In addition, the software will not start automatically. The problem is that older versions of the software itself does not automatically update, and users may not know they have ever installed.

The Finnish anti-virus company did a scan among customers of the company and discovered some 100,000 computers where Detect System was installed. Only 1% of them have the most recent version. The actual number of Dell computers with vulnerable versions of System Detects is probably much higher, because the users are only 100,000 vulnerable customers F-Secure. The latest version of System Detects via this page to download.

Vulnerability Scanners F-Secure Patched

The Finnish anti-virus firm F-Secure warns of a leak in the virus scanners and security of the business which a remote attacker via a man-in-the-middle attack could attack the update channel. Then it would be possible to replace all the files on the computer.

The vulnerability, which was discovered by F-Secure itself has been assessed as "high". This is the next-to-highest rating.The problem is present in both the business and consumer software. For the affected software are now hotfixes. The warning for the leak was partly already published on 12 March, but is now updated with a description of the problem, vulnerable versions and the availability of the hotfix.

Site Checks Hijacked DNS Settings Router

The past year has regularly occurred cybercriminals adapted the DNS settings of routers so that they could direct users to malicious Web sites without direct user was clear. The Finnish anti-virus firm F-Secure says it has discovered more than 300,000 residential and business routers in 2014 of which were adapted to the DNS settings.

The Domain Name System (DNS) is similar to the directory and translates among other domain names into IP addresses.By adjusting the DNS of the router can criminals traffic from users via their servers run or redirect user to as phishing sites, even though they have stated in their browser the correct URL.

The anti-virus company therefore has a website launched that can be easily verified that the DNS settings on the router or the system are hijacked. In case the DNS hijacked, users advised to disconnect their router from the Internet and reset, change the password, disable remote management and updating the firmware. In the case of custom DNS settings on the computer that can be restarted in order to empty the DNS cache and is advised to perform a virus scan.