Software pre-installed in all new HP laptops and computers have a number of major security flaws which could open up the device to hackers, experts have warned.
The HP Support Assistant software was found to have several unpatched vulnerabilities which could have let hackers access the system remotely, make changes in privileges or even execute arbitrary files.
Ten vulnerabilities, including three remote code execution vulnerabilities, five local privilege escalation flaws, two arbitrary file deletion vulnerabilities, were found and highlighted in October 2019. However, even after a couple of software updates, HP has not been able to patch three local privilege bugs, leaving users vulnerable to attack.
- Zoom apologies for major security vulnerabilities, promises fixes
- Chrome patches another serious zero-day vulnerability
- Vulnerable Gigabyte driver allowed RobbinHood ransomware infections
HP Support Assistant is a DIY tool that is designed to assist users with regular firmware and driver updates for their devices including laptops, PCs, as well as HP printers.
Unpatched
The vulnerabilities let the malware elevate permissions, and, after a device is infiltrated, can mean the device is compromised even further.
According to Bill Demirkapi, the researcher who uncovered the threats, “It is important to note that because HP has not patched three local privilege escalation vulnerabilities, even if you have the latest version of the software, you are still vulnerable unless you completely remove the agent from your machine.”
Owing to the serious nature of these flaws and HP’s failure in fixing them even with their latest March update, users have been advised to delete both HP Support Assistant and HP Support Solutions Framework from their devices.
However, anyone who relies on both these update assistants should manually ensure that the latest versions of these applications are installed on the system.
Users can always install the latest app from HP’s website or can also turn on the built-in automatic updates. By default, automatic update is not turned on and the users are required to turn on the feature manually.
It is worth keeping in mind that even if you're using the latest HP Support Assistant software, you're still vulnerable to hacks, as HP has not fully patched the bugs.
Apart from HP, Demirkapi has also revealed vulnerabilities in similar apps on other Windows PC vendors, like Lenovo and Dell.
- Best malware removal software of 2020
Via: BleepingComputer
