ReVault! When your SoC turns against you…

Source: Cisco Talos Blog

Author: Philippe Laulheret

URL: https://blog.talosintelligence.com/revault-when-your-soc-turns-against-you/

ONE SENTENCE SUMMARY:

Talos revealed multiple vulnerabilities in Dell’s ControlVault3 firmware, posing significant security risks across over 100 laptop models.

MAIN POINTS:

1. Reported vulnerabilities in ControlVault3 firmware and Windows APIs termed “ReVault.”
2. Vulnerabilities affect over 100 Dell laptop models, primarily in Latitude and Precision series.
3. ReVault attack enables persistence even after Windows reinstalls.
4. Physical compromise grants attackers admin privileges without login credentials.
5. Vulnerabilities include out-of-bounds, arbitrary free, stack-overflow, and unsafe deserialization issues.
6. Attack scenarios include post-compromise pivot and physical tampering.
7. Significant risk of leaking key security material and unnoticed firmware implants.
8. Attackers can exploit vulnerabilities by accessing the USH board.
9. Recommended mitigation involves keeping systems updated and disabling unused security peripherals.
10. Detection includes enabling chassis intrusion via BIOS and monitoring Windows logs for anomalies.

TAKEAWAYS:

1. Regularly update firmware and software to mitigate vulnerabilities.
2. Disable unused security features like fingerprint login to reduce risk.
3. Enabling chassis intrusion detection can help identify physical tampering.
4. Monitoring Windows logs can detect signs of potential compromise.
5. Proactive risk assessments are vital for maintaining secure hardware and software environments.