After more than a decade, SentinelOne researchers weed out Dell vulnerabilities

Dell issued fixes for the issues in question.

Since 2009, vulnerabilities have lurked in Dell drivers that potentially affect hundreds of millions of machines, SentinelOne researchers said on Tuesday.

Hackers could use the vulnerabilities to instigate a range of attacks, from ransomware to wipers that can erase hard drives, said J.A. Guerrero-Saade, principle threat researcher at the security firm.

“They can basically do whatever they want,” Guerrero-Saade told CyberScoop.

Dell released mitigation steps on Tuesday in advance of SentinelOne publishing its research.

Those flaws sitting undiscovered for 12 years is not unheard of, despite a whole industry of security researchers dedicated to weeding out bugs that could abet cyberattacks. A 2017 study found that a quarter of zero-day vulnerabilities remain hidden for more than nine and a half years.

In the case of the Dell flaws, Guerrero-Saade said their dormant nature reflects a “target-rich environment,” especially as it pertains to drivers that allow computers to communicate with hardware. The same phenomenon makes it difficult to access the full scope of the Dell vulnerabilities, he said, but SentinelOne determined the consistent presence of the drivers over the course of 12 years’ worth of equipment.

SentinelOne made its discovery only because a senior security researcher at the company, Kasif Dekel, happened to have a Dell laptop.

“It’s not like somebody gives you a guide and says, ‘These are all the drivers that we load on these machines over this span of time,'” Guerrero-Saade said. “It’s a really opaque environment.”

One thing that makes the vulnerabilities less severe is that attackers would have to have access to an individual device or server. But having access to a server would give a hacker the equivalent power of a system administrator for an organization, Guerrero-Saade said.

And on the positive side, neither Dell nor SentinelOne have seen anyone using the flaws.

“We have seen no evidence this vulnerability has been exploited by malicious actors to date,” said Katie Taylor, a spokesperson for Dell.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure