 Five serious vulnerabilities in a driver used by Dell devices have been disclosed by researchers. On Tuesday, SentinelLabs said the vulnerabilities were discovered by security researcher Kasif Dekel, who explored Dell's DBUtil BIOS driver -- software used in the vendor's desktop and laptop PCs, notebooks, and tablet products. The team says that the driver has been vulnerable since 2009, although there is no evidence, at present, that the bugs have been exploited in the wild. The DBUtil BIOS driver, which comes pre-installed on many Dell machines running Windows, contains a component -- the dbutil_2_3.sys module -- which was subject to Dekel's scrutiny. Dell has assigned one CVE (CVE-2021-21551), CVSS 8.8, to cover the five vulnerabilities disclosed by SentinelLabs. Two are memory corruption issues in the driver, two are security failures caused by a lack of input validation, and one logic issue was found that could be exploited to trigger denial-of-service. "These multiple critical vulnerabilities in Dell software could allow attackers to escalate privileges from a non-administrator user to kernel mode privileges," the researchers say. The team notes that the most crucial issue in the driver is that access-control list (ACL) requirements, which set permissions, are not invoked during Input/Output Control (IOCTL) requests. As drivers often operate with high levels of privilege, this means requests can be sent locally by non-privileged users. "[This] can be invoked by a non-privileged user," the researchers say. "Allowing any process to communicate with your driver is often a bad practice since drivers operate with the highest of privileges; thus, some IOCTL functions can be abused "by design." Functions in the driver were also exposed, creating read/write vulnerabilities usable to overwrite tokens and escalate privileges. Another interesting bug was the possibility to use arbitrary operands to run IN/OUT (I/O) instructions in kernel mode. "Since IOPL (I/O privilege level) equals to CPL (current privilege level), it is obviously possible to interact with peripheral devices such as the HDD and GPU to either read/write directly to the disk or invoke DMA operations," the team noted. "For example, we could communicate with ATA port IO for directly writing to the disk, then overwrite a binary that is loaded by a privileged process." Proof-of-Concept (PoC) code is being withheld until June to allow users time to patch. Dell was made aware of Dekel's findings on December 1, 2020. Following triage and issues surrounding some fixes for end-of-life products, Dell worked with Microsoft and has now issued a fixed driver for Windows machines. The PC giant has issued an advisory (DSA-2021-088) and a FAQ document containing remediation steps to patch the bugs. Dell has described the security flaw as "a driver (dbutil_2_3.sys) packaged with Dell Client firmware update utility packages and software tools [which] contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. "We remediated a vulnerability (CVE-2021-21551) in a driver (dbutil_2_3.sys) affecting certain Windows-based Dell computers," a Dell spokesperson said. "We have seen no evidence this vulnerability has been exploited by malicious actors to date. We appreciate the researchers working directly with us to resolve the issue."For more navigate to OUR FORUM.
 The European Commission is issuing antitrust charges against Apple over concerns about the company’s App Store practices. The Commission has found that Apple has broken EU competition rules with its App Store policies, following an initial complaint from Spotify back in 2019. Specifically, the Commission believes Apple has a “dominant position in the market for the distribution of music streaming apps through its App Store.” The EU has focused on two rules that Apple imposes on developers: the mandatory use of Apple’s in-app purchase system (for which Apple charges a 30 percent cut), and a rule forbidding app developers to inform users of other purchasing options outside of apps. The Commission has found that the 30 percent commission fee, or “Apple tax” as it’s often referred to, has resulted in higher prices for consumers. “Most streaming providers passed this fee on to end-users by raising prices,” according to the European Commission. “Apple’s rules distort competition in the market for music streaming services by raising the costs of competing music streaming app developers,” says a statement from the Commission. “This, in turn, leads to higher prices for consumers for their in-app music subscriptions on iOS devices.” The EU has also sent Apple a statement of objections, which is essentially a list of how the Commission believes Apple has violated competition rules. This is the initial, formal stage of antitrust proceedings against Apple, and the company will have the chance to respond to the Commission’s list of objections within the next 12 weeks. This specific case is limited to Apple’s App Store practices for music streaming, and the EU is investigating additional separate cases on ebooks and the App Store in general. “This is not the last case we will have when it comes to the App Store,” said European commissioner Margrethe Vestager in a press conference this morning. Vestager also revealed the Commission is taking an interest in Apple’s policies around games on the App Store. “We also take an interest in the gaming app market,” said Vestager, responding to a question about the money involved in gaming apps on the App Store. “That’s really early days when it comes to that,” Microsoft called on regulators to investigate the App Store last year, just a couple of months before a public spat with Apple over its xCloud game streaming service. Apple now faces a fine of up to 10 percent of its annual revenue if it’s found guilty of breaking EU rules, which could be as high as $27 billion based on Apple’s annual revenue of $274.5 billion last year. Apple could also be forced to change its business model, which has more damaging and lasting effects than a fine. Spotify has welcomed the initial charges. “Ensuring the iOS platform operates fairly is an urgent task with far-reaching implications,” says Horacio Gutierrez, Spotify’s chief legal officer. “The European Commission’s statement of objections is a critical step toward holding Apple accountable for its anticompetitive behavior, ensuring meaningful choice for all consumers and a level playing field for app developers.” Central to this entire case is the 30 percent cut that Apple takes on subscriptions. Companies like Netflix and Spotify have long opposed this so-called Apple tax, but Apple has argued that the revenue contributes toward the costs of maintaining the App Store and enforcing its various content, privacy, and security policies. Spotify previously claimed that Apple uses its App Store to stifle innovation and limit consumer choice in favor of its own Apple Music service. That complaint was followed up with a similar one by Rakuten, alleging that it’s anti-competitive for Apple to take a 30 percent commission on ebooks sold through the App Store while promoting its own Apple Books service. Epic Games also joined many developers and companies opposing Apple’s App Store policies and filed an antitrust complaint with the EU earlier this year. It’s part of an ongoing dispute with Apple after the Fortnite developer publicly criticized Apple’s App Store policies around distribution and payments. This resulted in Epic attempting to circumvent Apple’s 30 percent cut on in-app purchases in Fortnite, and Apple quickly removing the game from its App Store. For more please visit OUR FORUM.
 In the age of remote work, it's easier than ever to blur the lines between our personal and professional tech. Maybe it's sending personal texts or emails from your work phone, editing personal documents or photos on your work laptop, or joining a virtual happy hour with friends from your work tablet. None of these actions may sound like a particularly risky activity, but as a former "IT guy" I'm asking, nay pleading, with you to stop doing them. At least the potentially more hazardous activities, such as storing personal data on your work machine or storing sensitive company data on your personal devices. Do it for the security of your employer. But more importantly, do it for the safety, privacy and wellbeing of yourself, your family and friends. Cybersecurity incidents can have serious negative consequences for both your employer and you. And even if an actual security breach or data leak doesn't occur, you could be reprimanded, demoted, fired, sued or even criminally prosecuted. Take the case of former CIA director John M. Deutch. In 1996, as Deutch was leaving his position as Director of Central Intelligence, he asked if he could keep his government-issued computers because they contained his personal financial information, and he did not own a personal computer to which the data could be transferred. (This seems incomprehensible today, but it was very common at the time.) The government agreed to loan the computers to Deutch basically under the condition that he become an unpaid government consultant, not use the computers for personal work and buy a computer to which he could transfer his personal data. Fast forward a few years and it's discovered that the government computers, now at Deutch's Maryland home, had been connected to the Internet and that their hard drives contained classified information. Deutch also told government investigators that family members had access to the computers, including his wife, who "used this computer to prepare reports relating to official travel" with Deutch and another family member who used the computer "to access a university library." It was also reported at the time, that the "other family member" was Deutch's son, who in addition to accessing those university resources also visited several "high-risk" porn sites, one of which had placed cookies on the computer. A survey conducted in August 2020 by antivirus vendor Malwarebytes asked respondents how they used their work devices. The company found that 53% reported sending or receiving personal email, 52% read news, 38% shopped online, 25% accessed their social media and 22% downloaded or installed non-company software. And then of course there's the flip side, using a personal device for work. A report from cybersecurity vendor Morphisec released in June 2020 found that 56% of employees reported using their personal computer as their work device. And according to a 2020 survey by antivirus software maker Kaspersky, 57% of respondents said they checked work email on their personal smartphone and 36% did work on their personal laptop or desktop. Only 30% said they never used a work device for personal activities. Keep in mind however, survey respondents don't always provide completely accurate data. They may have forgotten past events or omit information due to embarrassment or fear of potential negative consequences. As such, I suspect these figures undercount the number of folks who are actually blending their work and personal tech. Even if nothing "bad" happens, there are still headaches from blurring the lines between your personal and professional tech. What happens when you get a new machine? What happens if you change jobs? In both cases you'll need to clean your personal data off the work machine before you give it back to IT. And depending how much personal data has accumulated on the device and how you've organized it, the process can be extremely complicated and take a significant amount of time. Also, simply copying and deleting the personal data won't completely protect your privacy. To really keep your personal information personal, you'd need to wipe the machine's hard drive or physically destroy the drive, something which will likely raise red flags with your company's IT department. You also run the risk of losing access to your data permanently if you fail to copy it all and the machine's drive is wiped or destroyed as part of your employer's computer equipment disposal policy.Further details can be found on OUR FORUM.
|
Latest Articles
|