News for hackers. Stuff that matters.

A comment on Dell patches 12-year-old driver vulnerability impacting millions of PCs. Parent comment

Re:Dell patches 12-year-old driver vulnerability impacting m... by martey on Tuesday May 04, 2021 @12:08PM (#27039134)
From the security company's report at https://labs.sentinelone.com/cve-2021-21551-hundreds-of-mill... :

> The firmware update driver component, which is responsible for Dell Firmware Updates via the Dell Bios Utility, comes pre-installed on most Dell machines running Windows and freshly installed Windows machines that have been updated.

Dell's security advisory page (https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-...) suggests that it would be installed if you installed any of a number of their update programs:

> This driver file may have been installed on your Dell Windows operating system when you used firmware update utility packages, Dell Command Update, Dell Update, Alienware Update, Dell System Inventory Agent, or Dell Platform Tags, including when using any Dell notification solution to update drivers, BIOS, or firmware for your system.

[ Parent | on HN ]
Re:Dell patches 12-year-old driver vulnerability impacting m... by greenyoda on Tuesday May 04, 2021 @05:23PM (#27043066)
The "Process Hacker" tool that this article refers to seems quite useful. It can be found here: https://processhacker.sourceforge.io (free GPL software)
[ Parent | on HN ]
Re:Dell patches 12-year-old driver vulnerability impacting m... by w7 on Tuesday May 04, 2021 @10:14PM (#27045398)
Yes, +1 for Process Hacker, it's basically an open source alternative to Sysinternals Process Explorer[0]. The service alerts noted in this article in particular led me to getting spooked and discovering that Windows Defender likes creating fun malware-like driver service names like MpKslasdfas3.sys. I'm at the point where it's always open to increase system awareness, and for quick filehandle views when I forget what application is stopping me from ejecting a USB.

[0] https://docs.microsoft.com/en-us/sysinternals/downloads/proc...

[ Parent | on HN ]
Re:Dell patches 12-year-old driver vulnerability impacting m... by _carbyau_ on Wednesday May 05, 2021 @01:42AM (#27046609)
I find it weird that Windows doesn't already tell you what app is holding a file/directory/USB locked when you try to move/delete/eject something.

Is there some common use case that makes this hard?

[ Parent | on HN ]
Re:Dell patches 12-year-old driver vulnerability impacting m... by w7 on Wednesday May 05, 2021 @05:42AM (#27047951)
Yeah I don't believe windows tells you in the pop-up at all. Spawning questions like https://superuser.com/questions/87364/can-windows-tell-me-wh...

For me sometimes it's something as simple as a "rogue" notepad I lost track of on another monitor.

[ Parent | on HN ]
Re:Dell patches 12-year-old driver vulnerability impacting m... by _carbyau_ on Wednesday May 05, 2021 @09:28PM (#27058122)
I agree it doesn't tell you.

Your link has some great pointers, even the event log will straight up tell you.

So why doesn't the popup tell you?

It doesn't seem like a complicated issue, hence my query as I feel like I am missing something here.

[ Parent | on HN ]
Re:Dell patches 12-year-old driver vulnerability impacting m... by dang on Tuesday May 04, 2021 @06:39PM (#27043751)
Ok, we've changed the URL at the top to that one, from https://therecord.media/dell-patches-12-year-old-driver-vuln..., which points to it. Thanks!
[ Parent | on HN ]