Critical flaws in HP Support Assistant leave Windows computers vulnerable to attacks , and could allow hackers to escalate privileges or delete arbitrary files, after successfully exploiting them.
HP Support Assistant, available from HP as a free tool , is preinstalled on new HP computers and is designed to provide automated support, updates, and fixes for HP computers and printers. According to HP, this tool helps improve the performance and reliability of computers and printers by automatically updating firmware and drivers. In addition, with it, users have the option to choose to install updates automatically or receive notifications when updates are available. HP computers released in 2012 and later running Windows 7, Windows 8 , or Windows 10, have HP Support Assistant preinstalled.
There are some critical bugs that have been fixed, but others still exist. Specifically, security researcher Bill Demirkapi found ten different bugs in software , including five local privilege escalation bugs – two arbitrary file deletion bugs, and three remote code execution bugs. The HP PSIRT (Product Security Response Team) partially fixed the bugs in December 2019, after receiving a report about them from Demirkapi in October 2019. Another fix was made in March 2020, after the researcher sent a new report in January 2020 to fix one of the bugs that still existed as well as a new bug that emerged. However, HP failed to fix three of the local privilege escalation bugs, meaning that even if users are using the latest version of HP Support Assistant, they are still exposed to attacks, as this type of vulnerability is often exploited by hackers in the later stages of their attacks to further compromise targeted devices.
To mitigate the vulnerabilities identified by Demirkapi, users should uninstall the vulnerable software, removing HP Support Assistant and HP Support Solutions Framework from their computers. Additionally, the security notes that HP Support Assistant requires users to have automatic updates enabled by default. However, if they do not have them enabled or do not wish to enable them, they should manually update the application or install the latest version.
It is worth noting that this is not the first time that Demirkapi has identified critical bugs in software pre-installed on computers from major vendors, including Lenovo and Dell. For example, he previously discovered a remote code execution bug, identified as CVE-2019-3719, that affects most Dell that have the SupportAssist Client software installed by default. Demirkapi also identified a local privilege escalation bug that affects Dell’s SupportAssist Client, which is pre-installed on most new Dell devices running Windows. SupportAssist checks the “health” of a device’s system hardware and software and sends the necessary information about the system status to Dell to address any problems.
