IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Secure Boot flaws could enable hackers to take control of Dell devices

Around 30 million Dell devices at risk of hacking

Dell sign on top of a building with overcast skies

Security researchers have discovered several vulnerabilities affecting the BIOSConnect feature within Dell Client BIOS. The bugs could enable hackers to run code at the Bios level.

The bugs affect 129 models of enterprise and consumer laptops, tablets, and desktops protected by Secure Boot. Researchers believe more than an estimated 30 million devices are affected.

According to a new report by security researchers at Eclypsium, the chain of flaws gets a CVSS score of 8.3. When used together, these flaws enable a privileged network adversary to impersonate Dell.com and gain arbitrary code execution at the BIOS/UEFI level of the affected device.

This means that hackers could control the device’s boot process and subvert the operating system (OS) and higher-layer security controls. Researchers warned that such code may alter the initial state of an operating system, violating common assumptions on the hardware/firmware layers and breaking OS-level security controls.

“As attackers increasingly shift their focus to vendor supply chains and system firmware, it is more important than ever that organizations have independent visibility and control over the integrity of their devices,” researchers said.

BIOSConnect is part of SupportAssist and enables users to perform a remote OS recovery or update device firmware. In either case (firmware update or OS recovery), BIOSConnect enables the system’s BIOS to contact Dell backend services over the internet and coordinate the update or recovery process.

Related Resource

A new trust model for the 5G era

Data-in-motion security through a 5G infrastructure

Data-in-motion security through a 5G infrastructure - Business man and woman standing together - whitepaper from ThalesDownload now

Researchers found four vulnerabilities that would enable a privileged network attacker to gain arbitrary code execution within the BIOS of vulnerable machines. These flaws were found on a Dell Secured-core PC Latitude 5310 using Secure Boot. Researchers soon found the problem existed on other Dell laptops and desktops.

The first flaw is an insecure TLS Connection from BIOS to Dell. A hacker with a privileged network position could impersonate Dell and deliver attacker-controlled content back to the victim device.

The remaining flaws concern overflow vulnerabilities allowing arbitrary code execution. Hackers impersonating Dell could deliver malicious content back to the victim machine. Two of these vulnerabilities affect the OS recovery process, while the other affects the firmware update process.

The researchers notified Dell of the flaws. Dell has since issued a security advisory and is scheduling BIOS/UEFI updates for affected systems and updates to affected executables from Dell.com.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Unlocking the value of data with data innovation acceleration
Whitepaper

Unlocking the value of data with data innovation acceleration

12 May 2022
Protect and preserve your data from endpoint to infrastructure
Whitepaper

Protect and preserve your data from endpoint to infrastructure

12 May 2022
Technology reimagined
Whitepaper

Technology reimagined

12 May 2022

Most Popular

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
Researchers demonstrate how to install malware on iPhone after it's switched off
Security

Researchers demonstrate how to install malware on iPhone after it's switched off

18 May 2022
Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022