Dude, Millions of Dell PCs are at risk of RCEs, disconnect your Western Digital My Book,
and RIP John McAfee! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for June 29, 2021!
This is your weekly summary of the threats to our security, privacy and Internet freedom.
FYI Hak5 fans! The team is releasing a brand new Bash Bunny on the Hak5 shop, and my
patrons automatically get a discount as a perk. Check it out, support the brand, so we can keep
making free content like this! We have a bunch of vulnerabilities to get into, so.. Onto the news!!
Four major security vulnerabilities have been found in Dell’s BIOSConnect feature of
SupportAssist. SupportAssist comes preinstalled on Dell devices that run Windows, and BIOSConnect is
a remote firmware update and OS recovery feature. This problem affects 129 models of Dell consumer
and business laptops, desktops, and tablets, leaving around 30 million devices exposed.
Security researchers at Eclypsium found the series of vulnerabilities that could allow an attacker to
remotely execute code within the BIOS using these features. The flaws are listed with an 8.3/10
severity and are tracked as CVE-2021-21571, 21572, 21573 and 21574. These include
an insecure TLS connection from the BIOS to Dell and three overflow vulns. The researchers stated
these can lead to privileged remote attacks that can impersonate the Dell.com servers
and take control of the boot process, subverting OS and higher layer security controls. Two of
these affect the OS recovery process and the other overflow flaw affects the firmware update process.
Even though they are similar, they all could work independently from one another and lead to RCE.
The attack scenario starts with the Host Device with BIOS Connect
making a request to Dell, which is intercepted by the attacker.
The attacker sends back an acknowledgement to the host device and the host device accepts
the attackers certificate. The attacker can then send multiple independent overflows at the device.
Both Eclypsium and Dell have provided reports and advisories on remediation for the issues including
using alternatives to SupportAssist for BIOS updating. Users will need to update their BIOS
OR EUFI firmware, though and Dell has an update available for impacted systems on Dell.com.
Two of the tracked vulnerabilities were fixed on the server side, while the other two require
a client update. If you can’t immediately update, you can disable BIOSConnect altogether.
A wise hacker once said on twitter… if it’s connected to the internet, then it’s not a backup.
If you own a Western Digital My Book Live, disconnect it from the internet now.
These devices are being remotely factory reset and files are being completely wiped
from these attached storage devices. The WD My Book Live is a physical device that can
chill on a desk since it’s so small, but it can be used as a network attached storage device
so you can access files or manage them remotely via it’s ethernet connection. This works as
well if they’re behind a secure network, so consumers love ‘em for their ease of use.
A few days ago, users found they couldn’t access their WD My Books anymore - the web dashboard for
the device would say “invalid password” and all of the files and data were gone.
According to bleeping computer, one owner stated it worked fine for years,
but their 2 terabytes of data was all gone, showing nothing but the empty directories.
Owners found that the device had received a remote comment to factory reset. This is called
My Book Live factoryRestore.sh, and the script began on June 23, continuing through the night.
In response, Western Digital posted an advisory stating these devices are being compromised
through exploitation of a remote command execution vulnerability which triggers the
factory reset to erase all the data. Since these devices haven’t received any updates since 2015,
this seems likely. It doesn’t seem financially motivated though, since no one has received
a ransomware threat. WD stated logs show the devices were connected to from IP addresses in
all sorts of countries, and they suspect the devices were directly connected through port
forwarding or direct connection, including UPnP. They also noticed a trojan file was installed
on some of these. WD didn’t find evidence of their own servers or services being compromised.
A remote code execution vulnerability does exist for these devices, listed as CVE-2018-18472.
This was discovered AFTER the 2015 firmware update, so it’s possible an attacker scanned
for open ports, found these devices, and decided to factory reset them. So do what
Western Digital says and disconnect these devices immediately while the investigation is underway.
While some users have reported successful recoveries using file recovery software,
that’s not always the case so continue using these over a network connection at your own risk.
Who’s to blame for this data loss? Western Digital, who likely had an
unpatched RCE vulnerability? Or the users, who may have been connecting these straight to the
interwebs. The devices were EOL but still work, so receiving updates after that time wouldn’t be
expected. Many of these users lost years and years of data. I personally back up three-fold.
To a cloud option, to a local NAS, and to an airgapped backup drive stored in a safe.
That may be overkill but it also offers peace of mind in the event that something happens.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support. And a quick shoutout to Neil for joining the ThreatWire alliance and as always,
for supporting the show!! Check out the Patreon Alliance for info on the new Hak5 Shop coupon code
and your exclusive access to an audio only podcast version of this show. Onto the third news story.
Trigger warning for suicide. In what was first reported by Spanish outlet El Pais,
the antivirus creator John McAfee, 75, has died in an apparent suicide while he was in
jail. Everyone has heard of the McAfee antivirus, and the man behind that company is John McAfee,
who created McAfee Associates in 1987, to later be acquired by Intel in 2010. McAfee left that
business in 1994 and was an entrepreneur for a lot of security firms, like QuorumEx and Tribal
Voice. He also held leadership positions in many other security companies. Because of him selling
off his stake in McAfee A/V in the 90’s, he gained a lot of wealth and was hugely popular. Like, the
dude had a posse and was a cult figure for many. He later advocated for users to uninstall McAfee
A/V, calling it bloatware along with other words that I can’t repeat here on Youtube.
His history was troubling. He was known for recreational drug use and living a,
to put it lightly, very interesting life, much of which I don’t feel comfortable detailing as it may
run afoul of Youtube’s rules. He lived in Belize, went to the US in 2013 but he was at one point
wanted for questioning due to suspicion of murder. He was also arrested in Spain in October 2020 over
tax evasion charges. He was most recently in prison in Spain when the news hit last week.
He was found dead on June 23, from an apparent suicide by hanging while in prison
near Barcelona. I mention apparent because of the circumstances surrounding his death.
What makes this important is twofold: many information security moguls do end up parting
this world due to mental health issues or due to factors that they can’t fully control,
and oftentimes this comes as a huge hit to the industry. In McAfee’s case, though,
this news went public just hours after Spanish courts approved an
extradition request from the USA for him to face tax evasion charges.
This timing is odd, given many times John McAfee has publicly stated that he believed
the US government wanted to get rid of him. So it comes as no surprise that many individuals think
of this death as very suspicious. Even though John’s early work in security was huge for users,
it was marred by controversy in the 2000’s. My thoughts are with his family and friends.
If you or someone you know is in crisis, please visit https://suicidepreventionlifeline.org
for more info.
This week on Morse Code I am moving my entire studio into a new space, so this set
may look or sound different next week, assuming I can get everything up and running this week!
Subscribe to my channel - youtube.com/shannonmorse - for more. And with that, don't forget to like
and subscribe to this channel as well! I'm Shannon Morse, I'll see you on the Internet!