4 ms·
From the security company's report at https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-pri
by martey 5y ago
From the security company's report at https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/ https://labs.sentinelone.com/cve-2021-21551-hundreds-of-mill... :
> The firmware update driver component, which is responsible for Dell Firmware Updates via the Dell Bios Utility, comes pre-installed on most Dell machines running Windows and freshly installed Windows machines that have been updated.
Dell's security advisory page (https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-...) suggests that it would be installed if you installed any of a number of their update programs:
> This driver file may have been installed on your Dell Windows operating system when you used firmware update utility packages, Dell Command Update, Dell Update, Alienware Update, Dell System Inventory Agent, or Dell Platform Tags, including when using any Dell notification solution to update drivers, BIOS, or firmware for your system.
- greenyoda 5y agoThe "Process Hacker" tool that this article refers to seems quite useful. It can be found here: https://processhacker.sourceforge.io https://processhacker.sourceforge.io (free GPL software)
- w7 5y agoYes, +1 for Process Hacker, it's basically an open source alternative to Sysinternals Process Explorer[0]. The service alerts noted in this article in particular led me to getting spooked and discovering that Windows Defender likes creating fun malware-like driver service names like MpKslasdfas3.sys. I'm at the point where it's always open to increase system awareness, and for quick filehandle views when I forget what application is stopping me from ejecting a USB. [0] https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer https://docs.microsoft.com/en-us/sysinternals/downloads/proc...
- _carbyau_ 5y agoI find it weird that Windows doesn't already tell you what app is holding a file/directory/USB locked when you try to move/delete/eject something. Is there some common use case that makes this hard?
- w7 5y agoYeah I don't believe windows tells you in the pop-up at all. Spawning questions like https://superuser.com/questions/87364/can-windows-tell-me-what-is-using-my-usb-drive https://superuser.com/questions/87364/can-windows-tell-me-wh... For me sometimes it's something as simple as a "rogue" notepad I lost track of on another monitor.
- _carbyau_ 5y agoI agree it doesn't tell you. Your link has some great pointers, even the event log will straight up tell you. So why doesn't the popup tell you? It doesn't seem like a complicated issue, hence my query as I feel like I am missing something here.
- dang 5y agoOk, we've changed the URL at the top to that one, from https://therecord.media/dell-patches-12-year-old-driver-vulnerability-impacting-millions-of-pcs/ https://therecord.media/dell-patches-12-year-old-driver-vuln..., which points to it. Thanks!