Security researcher uncovers high-risk BIOS vulnerability in Lenovo PCs (yet again!!)
http://thetechportal.com/2016/07/05/security-researcher-uncovers-high-risk-bios-vulnerability-lenovo-pcs/ According to researcher Dmytro Oleksiuk aka Cr4sh, the erroneous code exploits the 0day privileges escalation vulnerability in Lenovo's BIOS. This bug allows users to exploit the flash write protection, disabling of UEFI Secure Boot, Virtual Secure Mode and Credential Guard on most Windows Enterprise powered Lenovo PCs. And this is just a small list of possible evil things that can be executed using this vulnerability. The vulnerability is present in most ThinkPad Series laptops, ranging from the newest T450s to the oldest X220s. The faulty firmware drivers seems to have been copy-and-pasted by the PC-manufacturer using data supplied by Intel. Though it is still uncertain whether the vulnerable code is available in the public, but it has already been detected in another HP laptop dating back to 2010. - - - --Lauren-- Lauren Weinstein ([email protected]): http://www.vortex.com/lauren Founder: - Network Neutrality Squad: http://www.nnsquad.org - PRIVACY Forum: http://www.vortex.com/privacy-info Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info Member: ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com Google+: http://google.com/+LaurenWeinstein Twitter: http://twitter.com/laurenweinstein Tel: +1 (818) 225-2800 / Skype: vortex.com I have consulted to Google, but I am not currently doing so -- my opinions expressed here are mine alone. _______________________________________________ pfir mailing list http://lists.pfir.org/mailman/listinfo/pfir
