HP Touchpoint Analytics Opens PCs to Code Execution Attack

[silversurfer]

A security flaw, discovered in an open-source software program that is a key component of HP’s TouchPoint Analytics service, is opening up a wide swath of HP computers to attack. The vulnerability, if exploited by local attackers with administrative privileges, can allow them to execute arbitrary code on victim systems.
 
The affected software, Open Hardware Monitor, monitors temperature sensors, fan speeds, voltages, load and clock speeds of a computer. It is utilized by tens of millions of computers and is a key third-party component of HP Touchpoint Analytics, said researchers with SafeBreach Labs, who discovered the flaw.
 
HP TouchPoint Analytics is a service that anonymously collects diagnostic information about hardware performance. The service is pre-installed on most HP PCs, meaning the flaw has a wide attack surface, said researchers.
 
“A number of potential attacks could result from exploiting this vulnerability giving  attackers the ability to load and execute malicious payloads using a signed service, effectively whitelisting those applications,” said Peleg Hadar, security researcher with SafeBreach Labs in a Thursday advisory.

Read more here: https://threatpost.com/hp-touchpoint-ana...ck/149069/