7 Vulns in 7 Days - Breaking Bloatware Faster Than It's Built

7 Vulns in 7 Days: Breaking Bloatware Faster Than It's Built

Speakers: Leon Jacobs

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=zSBf2CMKlBk

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Leon%20Jacobs%20-%207%20Vulns%20in%207%20Days%20Breaking%20Bloatware%20Faster%20Than%20It%E2%80%99s%20Built.pdf

Overview

Leon Jacobs, a security researcher from Orange Cyber Defense's Sense Post team, spent a portion of his summer holiday noticing something odd: an ASUS DriverHub utility installed silently on his gaming machine had opened a browser tab to driverhub.asus.com, which triggered a system reboot almost instantly when he clicked a button. Digging into why, he discovered a local HTTP server running on his machine — and in the span of about a week, found seven distinct vulnerabilities across four major PC hardware vendors' pre-installed software: ASUS DriverHub, MSI Center, Acer Control Center, and Razer Synapse 4.

The talk is both a practical guide to attacking the "bloatware" category of software and a wake-up call about the systemic security problems inherent in OEM utilities that ship with hundreds of millions of consumer and enterprise PCs. These applications share a common design pattern — local privileged services that interact with browser-accessible interfaces — and that design pattern consistently produces a recognizable set of exploitable vulnerabilities.

What makes this research particularly impactful is not just the number of bugs found, but the speed: one vulnerability per day, across four different vendors, each with different codebases and implementation choices but the same underlying architectural weaknesses. Jacobs demonstrates that the bloatware vulnerability class is not an anomaly but a predictable consequence of how these applications are built.

Background

▶ Watch: All of these vans have been fixed. (2:00)

Hardware OEMs — ASUS, MSI, Acer, Razer, Lenovo, Dell, HP, and others — routinely ship pre-installed software on new hardware. Marketed as driver management utilities, device tuning tools, or RGB lighting controllers, these applications commonly elevate to SYSTEM or Administrator privilege to perform hardware-level operations. To allow their web-hosted portals to trigger local operations (driver installs, hardware configuration, system reboots), they expose local HTTP or WebSocket servers that respond to requests from the vendor's web domain.

This architecture creates a bridge between the fully-privileged local process and the partially-trusted web context. Historically, similar patterns have produced serious vulnerabilities: the Dell SupportAssist RCE chain (CVE-2019-3719), the HP Support Assistant vulnerabilities, and various Lenovo Vantage issues all follow the same general shape. Jacobs' research demonstrates that four major vendors in 2024–2025 were still making the same mistakes.

The four targets covered in the talk represent a significant portion of the global gaming and consumer PC market. Razer Synapse alone ships on a large fraction of Razer gaming peripherals; ASUS DriverHub is distributed with ASUS motherboard driver packages; MSI Center ships with MSI gaming hardware; Acer Control Center ships on Acer laptops and desktops.

Key Findings

▶ Watch: Should I run elevated or not? (13:51)

ASUS DriverHub — Remote Code Execution via Origin Bypass and Silent Install

The most severe finding in the talk. ASUS DriverHub exposes a local HTTP server (bound to 127.0.0.1 on port 53000) that responds to requests purportedly from driverhub.asus.com. The server validates the Origin header of incoming requests to ensure they originate from the official ASUS domain. However, Jacobs found that the validation was a simple string match that could be bypassed with a crafted domain name — for example, driverhub.asus.com.evil.com — where the attacker's domain contains the expected value as a substring.

With Origin validation bypassed, the local server's /InstallDriver endpoint accepted attacker-controlled parameters specifying which driver package to download and install. The installation path could be directed to arbitrary locations, and the installed package was executed with SYSTEM privileges. By hosting a malicious "driver" package on an attacker-controlled web server and persuading a victim to visit a malicious page, an attacker could achieve remote code execution as SYSTEM without any user interaction beyond the initial page visit.

Jacobs also found that the application would silently install packages — it would pop up a brief installation progress indicator but would not request explicit user confirmation before execution. This meant the attack was nearly invisible to an unsuspecting user.

Two CVEs were assigned for the ASUS DriverHub findings (covering the origin bypass and the silent execution primitive).

MSI Center — Privilege Escalation via Named Pipe Impersonation

MSI Center runs a SYSTEM-privileged Windows service that exposes a named pipe for inter-process communication with the user-mode front end. Jacobs found that the service side of the pipe did not call ImpersonateNamedPipeClient() safely, allowing a low-privileged attacker to create a malicious pipe server, cause the MSI Center service to connect to it, and then use the resulting impersonation handle to execute commands as SYSTEM.

This is a classic named pipe squatting / impersonation attack, but it is notable that a major hardware vendor's widely-distributed software was still vulnerable to it in 2024. The attack required a local low-privileged foothold, making it more of a privilege escalation than a remote compromise, but in combination with any initial access vector it represented a full local privilege escalation to SYSTEM.

A CVE was assigned for the MSI Center named pipe issue.

Acer Control Center — DLL Hijacking and Unquoted Service Path

Jacobs found two distinct issues in Acer Control Center. First, the application loaded a DLL from a user-writable directory, enabling a classic DLL hijacking attack where a malicious DLL placed in the search path would be loaded by the privileged process at startup. Second, the service was registered with an unquoted path containing spaces, allowing an attacker with write access to a parent directory to place an executable named after the first token of the path and have it run as SYSTEM when the service started.

While these are individually "low-hanging fruit" vulnerability classes, their presence in actively-distributed software in 2024 reflects the continuing failure of OEM software development processes to apply standard Windows security baselines. Both vulnerabilities required local access to exploit but enabled full SYSTEM privilege escalation.

Razer Synapse 4 — COM Object Abuse and Installer Privilege Escalation

Razer Synapse 4 — the latest generation of Razer's RGB and device management platform — exposed a COM object registered by its privileged installer service that could be instantiated by low-privileged user-mode code. The COM interface exposed methods intended for the installer workflow, including the ability to specify file paths for operations performed with elevated privilege.

By calling these COM methods with attacker-controlled paths, a local user could induce the SYSTEM-privileged service to write arbitrary content to arbitrary locations (a write primitive) or to execute files from attacker-controlled locations. Combined, these produced a local privilege escalation to SYSTEM.

Jacobs noted that Razer Synapse 4 was the most recently released of the four products, making the presence of these vulnerabilities particularly frustrating — newer software with the benefit of years of public research on the same vulnerability classes was still making similar mistakes.

Technical Deep Dive

▶ Watch: One is a target program and arguments for it. (21:43)

The Local HTTP Server Pattern

The defining architectural anti-pattern in the ASUS and similar cases is the local privileged HTTP server. These servers are typically:

• Bound to localhost on a high-numbered port
• Protected by an Origin header check against the vendor's domain
• Exposed to any web content that runs in the victim's browser

The Origin header protection is fundamentally weak. It is a client-supplied value. Any origin validation based on substring matching, prefix matching, or case-insensitive comparison can likely be bypassed with a crafted domain. Even exact-match validation is insufficient if the attacker can perform DNS rebinding or if the browser extension or redirect chain can set the Origin to the expected value.

For ASUS DriverHub, the specific bypass used a domain like driverhub.asus.com.attacker.com — this was served from the attacker's DNS and HTTPS infrastructure, but the local server's check only verified that the origin contained the string driverhub.asus.com, not that it equaled it.

Silent Execution and TOCTOU

The ASUS DriverHub install endpoint fetched a driver package from a URL specified in the request parameters, performed a hash check against a value also supplied in the request, and then executed the package. The hash value in the request was compared to the downloaded package — but since the attacker controlled both the hash value and the download URL, the check provided no security guarantee. The attacker simply pre-computed the hash of their malicious payload and supplied it in the Origin-bypassed request.

Windows Service Exploitation Patterns

The MSI Center named pipe impersonation, Acer DLL hijacking and unquoted service path, and Razer COM object abuse are all well-documented Windows privilege escalation classes, collectively described in MITRE ATT&CK under techniques T1574 (Hijack Execution Flow), T1574.001 (DLL Search Order Hijacking), T1574.005 (Executable Installer File Permissions Weakness), and T1021.003 (COM Object Hijacking). Their consistent presence in OEM software reflects a lack of security review rather than novel attacker ingenuity.

Named Pipe Squatting (MSI Center): The attack creates a malicious named pipe server with the same name that the MSI Center service attempts to connect to. When the service connects, the attacker calls ImpersonateNamedPipeClient() to obtain a token with SYSTEM privileges and uses it to execute arbitrary code.

DLL Hijacking (Acer): The privileged Acer Control Center process searches for a DLL in a user-writable directory (e.g., a user's AppData path or a shared installation directory without proper ACLs). An attacker places a malicious DLL at that path; on next service start or process load, the malicious DLL executes with the service's elevated privilege.

Unquoted Service Path (Acer): A service registered as C:\Program Files\Acer Control Center\AcerControlCenter.exe without quotes is subject to Windows' path tokenization behavior: Windows will attempt to execute C:\Program.exe before the intended binary. Any user who can write to C:\ or C:\Program Files\ can plant the hijacking binary.

COM Object Abuse (Razer): The Razer installer registers a COM server with methods that perform privileged file operations. These are accessible to any local user via CoCreateInstance. Jacobs mapped the COM interface, identified methods that accepted path parameters, and called them with malicious arguments to achieve file write and execution with SYSTEM privileges.

Demo / Proof of Concept

▶ Watch: This is also pre-installed on a whole bunch of laptops. (32:36)

Jacobs showed a demo for the ASUS DriverHub remote code execution chain:

1. A victim machine with ASUS DriverHub installed visits a malicious web page hosted by the attacker
2. The page makes a cross-origin request to 127.0.0.1:53000 with an Origin header set to the bypassing domain
3. The /InstallDriver endpoint accepts the request and fetches a "driver" package from the attacker's server
4. The package (a simple payload executable) is installed and executed with SYSTEM privileges
5. The attacker receives a SYSTEM shell on the victim machine

The entire attack required no user interaction beyond visiting the malicious page. Jacobs noted that a further refinement would be to host the malicious page on a site that might plausibly attract ASUS hardware users.

Defensive Implications

▶ Watch: escalation would look like, uh it would be something like this. (39:19)

For end users:

• Uninstall pre-installed OEM utilities that you do not actively use. DriverHub, MSI Center, Acer Control Center, and Razer Synapse are optional; their functionality can often be replicated with Windows' built-in driver management.
• If you need these applications, ensure they are fully patched. All four vendors issued patches in response to Jacobs' responsible disclosure.
• Be skeptical of browser interactions with localhost — legitimate sites rarely need to communicate with local software.

For OEM vendors:

• Local HTTP servers exposed to the browser must implement robust origin validation using exact-match comparison against a pre-defined allowlist, ideally combined with a shared secret (e.g., a nonce established at install time).
• All software components running with elevated privilege must be subjected to security review against the OWASP Top 10 for thick clients and the standard Windows privilege escalation checklist (service ACLs, DLL search order, COM registration).
• Silent execution of downloaded packages is not appropriate for a SYSTEM-privileged service. Explicit user confirmation with package signing verification should be mandatory.

For enterprise defenders:

• OEM bloatware represents a significant and often overlooked attack surface. Asset management inventories should flag high-privilege OEM services, and endpoint detection rules should watch for unusual parent process chains (e.g., ASUS DriverHub spawning cmd.exe or PowerShell).
• Consider blocking outbound connections from OEM service processes to non-vendor domains at the network layer, which mitigates the silent install attack vector.

Key Takeaways

• Four major hardware OEMs (ASUS, MSI, Acer, Razer) shipped software in 2024 with exploitable vulnerabilities ranging from unauthenticated remote code execution to local privilege escalation to SYSTEM.
• The architectural pattern of a privileged local HTTP/WebSocket server with weak Origin validation is consistently exploitable via browser-based attacks and represents a class-level design flaw across the bloatware category.
• Seven distinct vulnerabilities were found in roughly seven days of focused research, suggesting the overall attack surface remains largely uninvestigated.
• All vulnerabilities were responsibly disclosed and patches were released; users should update or remove these applications.
• Enterprise security teams should treat pre-installed OEM utilities as a first-class attack surface in their threat models.

About the Speaker

Leon Jacobs is a security researcher at Orange Cyber Defense, based in South Africa, where he works within the Sense Post research team. His background spans penetration testing, research, and tool development. He can be found online as LeonJZ and presented this research at DEF CON 33 as part of ongoing work on the security of consumer software.