0 Members and 1 Guest are viewing this topic.
Dell has denied building backdoors into its kit following a security researcher's discovery of an insecure update assistant app.Tom Forbes alleges that the Dell Service Tag Detector app* is so insecure that it creates a backdoor on machines it is installed upon.More specifically, Forbes alleges that the app caries a Remote Code Execution (RCE) risk which, if true, would create a means for hackers and cyberspies to smuggle malware onto vulnerable systems.An attacker could trigger the program to download and execute an arbitrary file without any user interaction, according to Forbes."The little 'Dell Service Tag Detector' program that they push people to download on the Dell.com website does a lot more than just detect service tags - it gives Dell access to your entire machine, allowing them to download and install software and collect system information without you knowing," Forbes told El Reg.The issue was reported to Dell in November, fixed two months later in January. Forbes only went public about it this week.Forbes' detailed technical write up of the issue can be found here.
Author
Topic: Dell denies 'insecure autoupdate app' (Read 795 times)
