HP Omen Hub Exposes Millions of Gamers to Cyberattack

Millions of units jogging the HP Omen Gaming Hub were being utilizing on a driver with a bug that could give attackers kernel-mode entry with out administrator privileges.

HP has since unveiled a patch, but a new report on the flaw (CVE-2021-3437) from scientists from SentinelLabs facts how the gaming computer software was created in section by copying code from a problematic open up-supply driver known as WinRing0.sys.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

HP Omen Gaming Hub is program that will come pre-installed on HP Omen desktops and laptops and capabilities as an optimizer for enjoying video games, producing computerized changes to admirer speeds, lights and accent controls for the greatest gaming expertise, SentinelLabs’ report defined.

Vulnerable HP OMEN Variations:

• HP OMEN Gaming Hub prior to edition 11.6.3.
• HP OMEN Gaming Hub SDK Deal prior to edition 1..44

Metadata showed the researchers the HP OMEN Gaming Hub re-employed code for its driver that is vulnerable unauthorized privilege escalation.

“Unfortunately, issues with the WinRing0.sys driver are nicely-regarded,” the SentinelLabs report stated. “This driver enables consumer-mode apps to accomplish numerous privileged kernel-manner functions by using (input/output controls) IOCTLs interface.”

The HP driver perhaps offers accessibility as a result of IOCTLs using product specific registers (MSRs) to accessibility or change CPU information, scientists included.

“This high-severity flaw, if exploited, could allow for any user on the computer system, even without having privileges, to escalate privileges and run code in kernel manner,” the report added. “Among the clear abuses of these vulnerabilities are that they could be made use of to bypass security items.”

The moment inside, attackers could gain lateral obtain to broader networks, Sentinel Labs reported.

Back again in Oct. 2019, SafeBreach published their findings on the exact driver vulnerability in the HP Touchpoint Analytics Computer software, which could have clued danger actors into looking at identical vulnerabilities throughout other HP goods.

HP set out a deal with on Sept. 14, adding that the business will both thrust out automatic updates as nicely as offer you handbook solutions for patching.

“To reduce the attack area presented by system motorists with uncovered IOCTLs handlers, builders need to implement solid ACLs on system objects, verify user enter and not expose a generic interface to kernel-mode functions,” the report encouraged.

Gaming More and more Less than Cyber-Assault

This most recent bug will come amid a wave of attacks aimed at players throughout all sorts of platforms. The analysts have not observed any attackers exploiting this vulnerability so much, the report claimed, but that doesn’t mean there are not attackers out there hunting for the subsequent substantial rating on the team.

Over the summertime, Akamai launched its 2020 gaming report exhibiting that attacks on the online video-game business exploded by 340 per cent in 2020, many thanks to armies of pandemic-weary people turning to game titles for enjoyment. The report also observed a lot more attack site visitors on the gaming business than any other in 2020.

Gaming platform Steam was uncovered previously this calendar year to have malware lurking in profile photographs and in January, caches of leaked insider credentials ended up observed up for sale on legal marketplaces. Additional not long ago, a malicious network filter rootkit that would enable attackers spoof gamers’ geo-locations, called Netfilter, was found circulating all-around gamer community.

For its portion, HP was responsive to the issue, SentinelLabs extra.

“While we have not viewed any indicators that these vulnerabilities have been exploited in the wild up until eventually now, utilizing any OMEN-branded Personal computer with the vulnerable driver utilized by OMEN Gaming Hub makes the consumer potentially vulnerable,” the researchers warned. “Therefore, we urge people of OMEN PCs to be certain they choose proper mitigating actions with no delay.”

Rule #1 of Linux Security: No cybersecurity alternative is feasible if you do not have the fundamentals down. JOIN Threatpost and Linux security execs at Uptycs for a Stay roundtable on the 4 Golden Regulations of Linux Security. Your major takeaway will be a Linux roadmap to having the fundamentals suitable! REGISTER NOW and be part of the LIVE party on Sept. 29 at Midday EST. Joining Threatpost is Uptycs’ Ben Montour and Rishi Kant who will spell out Linux security finest practices and get your most urgent questions in serious time.