Computerworld - The hacker who posted an exploit final week that threatened a sizable swath of Hewlett-Packard Co.'s laptop lineup followed up yesterday with new assault code that will "brick" practically every single HP laptop computer.
Within a publish towards the milw0rm.com Site Wednesday, a Polish safety researcher who utilised the alias "porkythepig" spelled out a pair of vulnerabilities in an ActiveX handle used by HP's Application Update, the patch management method bundled with practically each and every HP- and Compaq-branded laptop.
According to porkythepig's post, the Software program Update bugs let an attacker corrupt Windows' kernel files, creating the laptop unbootable,
Office Professional Plus 2007 Key, or having a minor far more energy, enable hacks that will end result within a Pc hijack or malware infection. In either situation, a drive-by attack may be carried out by feeding end users an e-mail message which has a hyperlink to a malicious Web site.
"Every HP notebook machine containing the HP Computer software Updates application is vulnerable," claimed porkythepig. "It is achievable that the vulnerable machine design checklist disclosed from the vendor like a confirmation for the prior problem about HP laptops, [the] HP Data Center situation, is going to be similar on this case."
Very last week, porkythepig disclosed multiple flaws in other computer software included with HP's portables. Once the company patched the vulnerabilities a day later, it detailed 83 affected laptops.
The scenario during which an attacker overwrites the kernel and as a result "bricks" the HP or Compaq notebook, was out of the normal,
Microsoft Office 2010, since most hacks goal to snatch handle in the machine or infect it with identity-stealing malware. But the crippling attack, stated porkythepig,
Office Professional Plus, is actually the simpler in the two. "This assault vector doesn't call for any further victim social engineering, because the technique files are often placed from the predictable areas,
Microsoft Office 2010 Pro," he stated.
A drive-by assault that hopes to execute rogue code, however,
Microsoft Office Professional Plus 2010, demands more perform. To effectively exploit the ActiveX bug in Software Update and compromise the computer, the hacker has to know the location of specific files.
The researcher said he had tested the exploit code on Windows 2000, XP, Server 2003 and Vista, and the vulnerabilities pose a risk to any user with either Net Explorer 6 (IE6) or IE7 to the Pc. Nor will HP be able to use the down-and-dirty fix it deployed previous week, mentioned porkythepig. Right after he revealed several bugs in HP's Data Center per week in the past, HP issued an update that simply disabled the vulnerable software program.
"Simple disabling from the susceptible control by the vendor's patch, like within the other HP software program vulnerability situation, HP Info, [could still] consequence within the machine['s] computer software update system [being] compromised, and would leave the user susceptible to potential safety troubles," porkythepig stated from the milw0rm.com write-up.
HP did not reply to e-mailed requests for confirmation and comment.
Related News and Discussion:
Update: Most HP, Compaq notebooks ship with code bugs
Evan Koblentz, Engineering Rewind: HP-35/35th Anniversary Edition expected shortly
Robert L. Mitchell, Fact Check: Ink wars: HP's glass 50 % empty defense
Robert L. Mitchell, Truth Verify: Kodak vs HP ink wars: Decide on your paper wisely
HP unveils its initial Linux laptop
Ken Mingis, Mingis on Macs: Mac customers 'unbearably smug' about safety?
C.J. Kelly's weblog: Hacking Stupidity 101: Never ever hack from property
The eight most hazardous client technologies
Read much more about Safety in Computerworld's Protection Subject Center.
Office Professional Plus 2007 Key 'Bricking' bug t
Threaded Mode