Raevenlord
News Editor
- Joined
- Aug 12, 2016
- Messages
- 3,755 (1.23/day)
- Location
- Portugal
| System Name | The Ryzening |
|---|---|
| Processor | AMD Ryzen 9 5900X |
| Motherboard | MSI X570 MAG TOMAHAWK |
| Cooling | Lian Li Galahad 360mm AIO |
| Memory | 32 GB G.Skill Trident Z F4-3733 (4x 8 GB) |
| Video Card(s) | Gigabyte RTX 3070 Ti |
| Storage | Boot: Transcend MTE220S 2TB, Kintson A2000 1TB, Seagate Firewolf Pro 14 TB |
| Display(s) | Acer Nitro VG270UP (1440p 144 Hz IPS) |
| Case | Lian Li O11DX Dynamic White |
| Audio Device(s) | iFi Audio Zen DAC |
| Power Supply | Seasonic Focus+ 750 W |
| Mouse | Cooler Master Masterkeys Lite L |
| Keyboard | Cooler Master Masterkeys Lite L |
| Software | Windows 10 x64 |
(Update 1: It seems that Logitech has launched an updated version of their Options software with a fix for the vulnerabiity - but this only happened after the vulnerabiiity became public. You can go on over Logitech's own webpage to download the updated version, which includes the fix in its changelogs, from here. Safe browsing.)
Adding to the critical vulnerability galore that's been coming out of Google's Project Zero, a researcher has demonstrated how an inherent bug in the "Logitech Options" software renders users vulnerable when visiting web pages. Tavis Ormandy, with Google Project Zero, found that Logitech Options opens a local Websocket port that doesn't require authentication for external commands. Attackers could exploit this issue by sending simulated keystrokes from any website - and thus execute pretty much anything on affected systems.
Ormandy reported the issues to Logitech developers in September this year, and although Logitech recognized the problem, it still wasn't fixed in the last software release put out by the company. As part of Google Project Zero's responsible disclosure policy, Logitech was given a 90-day deadline to fix the issue - which they didn't, and hence, the vulnerability has been publicly disclosed. And as such, there's a whole world of potentially malicious hackers with the knowledge to execute this attack in the wild now - just uninstall the software until a fix is available, for your security. It's sure nice to have Options, but those shouldn't be given to hackers.
View at TechPowerUp Main Site
Adding to the critical vulnerability galore that's been coming out of Google's Project Zero, a researcher has demonstrated how an inherent bug in the "Logitech Options" software renders users vulnerable when visiting web pages. Tavis Ormandy, with Google Project Zero, found that Logitech Options opens a local Websocket port that doesn't require authentication for external commands. Attackers could exploit this issue by sending simulated keystrokes from any website - and thus execute pretty much anything on affected systems.
Ormandy reported the issues to Logitech developers in September this year, and although Logitech recognized the problem, it still wasn't fixed in the last software release put out by the company. As part of Google Project Zero's responsible disclosure policy, Logitech was given a 90-day deadline to fix the issue - which they didn't, and hence, the vulnerability has been publicly disclosed. And as such, there's a whole world of potentially malicious hackers with the knowledge to execute this attack in the wild now - just uninstall the software until a fix is available, for your security. It's sure nice to have Options, but those shouldn't be given to hackers.
View at TechPowerUp Main Site
