Dell PCs vulnerable to remote takeover due to SupportAssist vulnerability

Bill Demirkapi, a 17-year old US-based security researcher, discovered a vulnerability in Dell's SupportAssistant utility. This tool is pre-installed on Dell laptops and PCs and can allow attackers to remotely takeover these systems. All that's needed is to trick the user into visiting a website with malicious JavaScript code, no further user action is required:

The attack relies on luring users on a malicious web page, where JavaScript code can trick the Dell SupportAssist tool into downloading and running files from an attacker-controlled location.

Because the Dell SupportAssist tool runs as admin, attackers will have full access to targeted systems, if they manage to get themselves in the proper position to execute this attack.

Dell issued an update for SupportAssist on April 23.