OEM software update tools preloaded on PCs are a security mess

Serious vulnerabilities have crept into the software tools that PC manufacturers preload on Windows computers, but the full extent of the problem is much worse than previously thought.

Researchers from security firm Duo Security have tested the software updaters that come installed by default on laptops from five PC OEMs (original equipment manufacturers) — Acer, ASUSTeK Computer, Lenovo, Dell and HP — and all of them had at least one serious vulnerability. The flaws could have allowed attackers to remotely execute code with system privileges, leading to a full system compromise.

In most cases, the problems resulted from the OEM software updaters not using encrypted HTTPS connections when checking for or downloading updates. In addition, some updaters didn’t verify that the downloaded files were digitally signed by the OEM before executing them.

To read this article in full or to leave a comment, please click here