Windows PCs Exposed to Attacks by Critical HP Support Assistant Bugs

guest · Apr 4, 2020

Windows PCs Exposed to Attacks by Critical HP Support Assistant Bugs
April 4, 2020
https://www.bleepingcomputer.com/ne...ttacks-by-critical-hp-support-assistant-bugs/

Several critical HP Support Assistant vulnerabilities expose Windows computers to remote code execution attacks and could allow attackers to elevate their privileges or to delete arbitrary files following successful exploitation.

HP Support Assistant, marketed by HP as a "free self-help tool," is pre-installed on new HP desktops and notebooks, and it is designed to deliver automated support, updates, and fixes to HP PCs and printers.

"Improve the performance and reliability of your PCs and printers with automatic firmware and driver updates," HP says. "You can configure your options to install updates automatically or to notify you when updates are available."
Some critical flaws patched, others not so much
Security researcher Bill Demirkapi found ten different vulnerabilities within the HP Support Assistant software, including five local privilege escalation flaws, two arbitrary file deletion vulnerabilities, and three remote code execution vulnerabilities.
Click to expand...

HP PSIRT partially patched the vulnerabilities in December 2019 after receiving an initial disclosure report from Demirkapi during October 2019.
"It is important to note that because HP has not patched three local privilege escalation vulnerabilities, even if you have the latest version of the software, you are still vulnerable unless you completely remove the agent from your machine," Demirkapi explained in his detailed technical description.
Click to expand...

Several Critical Vulnerabilities on most HP machines running Windows

In this blog post, we’ll be looking at HP Support Assistant which is “pre-installed on HP computers sold after October 2012, running Windows 7, Windows 8, or Windows 10 operating systems”. We’ll be walking through several vulnerabilities taking a close look at discovering and exploiting them.

Here is a table of contents to help navigate my research. In any case, I strongly suggest reading the General Discovery and General Exploitation sections as they provide significant foundational material important to understanding most of the vulnerabilities.
Click to expand...

Krusty · Apr 4, 2020

Oh great!

Krusty · Apr 4, 2020

I have always had HP Support Assistant protected by HitmanPro.Alert. I hope that is enough.

guest · Sep 7, 2022

HP fixes severe bug in pre-installed Support Assistant tool
By Bill Toulas @billtoulas - September 7, 2022

HP issued a security advisory alerting users about a newly discovered vulnerability in HP Support Assistant, a software tool that comes pre-installed on all HP laptops and desktop computers, including the Omen sub-brand.

The flaw, discovered by researchers at Secure D and reported to HP, is tracked as CVE-2022-38395 and has a "high" severity score of 8.2, as it enables attackers to elevate their privileges on vulnerable systems.
Click to expand...

While the computer maker hasn't provided many details about the security issue, the advisory mentions that it's a DLL hijacking flaw triggered when users attempt to launch HP Performance Tune-up from within HP Support Assistant.

DLL hijacking happens when a malicious actor places a DLL containing malicious code on the same folder as the abused executable, exploiting Windows' logic to prioritize those libraries against DLLs in the System32 directory.
Click to expand...

The code that executes by loading the library assumes the privileges of the abused executable, in this case, HP Support Assistant running with 'SYSTEM' privileges.
Hence, CVE-2022-38395 can be exploited by attackers who have already established their presence on a system via low-privileged malware or a RAT tool.

This is not the first time HP's pre-installed self-help tools create security risks for users and not even the first time for Support Assistant in particular.
In April 2020, it was revealed that HP Support Assistant suffered from at least ten elevation of privilege and remote code execution vulnerabilities, some remaining unpatched since October 2012 and for a year after their disclosure to HP.
Click to expand...

Considering the above, if you don't need or use your computer vendor's bloatware, deleting these tools would remove all associated risks.
Click to expand...

Log in or Sign up

Windows PCs Exposed to Attacks by Critical HP Support Assistant Bugs

guest Guest

Krusty Registered Member

Krusty Registered Member

guest Guest

Log in or Sign up

Windows PCs Exposed to Attacks by Critical HP Support Assistant Bugs

guest Guest

Krusty Registered Member

Krusty Registered Member

guest Guest

Useful Searches