Attention Dell Owners!

[Digerati]

As per the Department of Homeland Security, US-CERT/NIST Vulnerability Summary for CVE-2015-2890,

The BIOS implementation on Dell Latitude, OptiPlex, Precision Mobile Workstation, and Precision Workstation Client Solutions (CS) devices with model-dependent firmware before A21 does not enforce a BIOS_CNTL locking protection mechanism upon being woken from sleep, which allows local users to conduct EFI flash attacks by leveraging console access, a similar issue to CVE-2015-3692.

This vulnerability can only be exploited "locally", that is, someone would need physical access to your computer. That makes portable devices most vulnerable but PCs in areas with public access, or those stolen by someone breaking into your home are affected too. For a list of affected Dells, see this CERT Vulnerability Note. Even if your Dell is not listed, I recommend you visit the Dell website for your Dell to see if a new BIOS update is out that addresses this problem.

 

[Aura]

Probably half of our laptop fleets are Dell Latitude E6520 and E6530. The E6520 are being changed for new ones right now, but the E6530 won't be before another 2 years. Eek.

 

[Digerati]

Yeah, the notebooks are the ones that bother me. Notebooks grow feet and wander off and if they contain personal or sensitive company information on them, that can be a much greater problem than just a lost piece of hardware.

 

[Aura]

Do you think this would work against laptops that have encrypted hard drives with Symantec Encryption Desktop?

 

[Digerati]

I think it could allow a badguy to take over the notebook and wipe the drive or use a different drive. But I don't think they could access the data on the encrypted drive.

I will note the same US-CERT advisory where I learned of this also has advisories for Symantec Endpoint Protection. So if Symantec Encryption is part of that, you might want to do some more investigating.

https://www.us-cert.gov/ncas/bulletins/SB15-222

BTW, if not subscribed to these summary notices, I recommend you do so. See the bottom of that page.