Security researcher Mr. Brub discovered a critical vulnerability in MSI’s MSI Center software, specifically within the Notebook Foundation service, which is pre-installed on MSI laptops, desktops, and handhelds. This flaw allows any authenticated user, even without admin privileges, to communicate with the application via a named pipe, modify system registry keys, monitor hardware, change system settings, and run or terminate executables with the highest privileges. Such capabilities could be exploited by malware to disable Windows Defender or escalate privileges, posing severe security risks. The vulnerability was reported to MSI’s product security team, but initial communication was hindered by a “mailbox full” message, delaying the response.
The vulnerability centers around MSI’s Notebook Foundation Service spawning a named pipe accessible to any authenticated user. This pipe accepts several commands, including handshake, registry manipulation, hardware monitoring via WMI, and executing or killing processes. Mr. Brub demonstrated that an attacker could register an arbitrary client name and use it to escalate privileges by running commands as the local system. Although remote exploitation via SMB is possible, it requires valid user credentials, limiting the attack vector to authenticated users. Despite this, the risk remains significant given MSI Center’s ubiquity on MSI devices.
After initial difficulties reaching MSI’s security team, Mr. Brub was connected to an MSI employee who facilitated the resolution process. MSI responded promptly once contact was established, releasing a patch within a month of the report. The update, MSI Center 2.0.70.0, restricts named pipe communication to MSI-created programs only and limits executable launches via the pipe to MSI software, effectively closing the vulnerability. The patch was praised by Mr. Brub as thorough and well-implemented, adding multiple layers of protection against unauthorized access.
This incident highlights ongoing challenges in software security, especially with pre-installed utilities that have broad system access. MSI has a history of security lapses, including a prior leak of over 600,000 customer warranty records. Users are advised to update MSI Center to the latest version or uninstall it if unnecessary, as extra software increases attack surface. The case also underscores the importance of responsible vulnerability disclosure and cooperation between researchers and manufacturers to protect users.
In conclusion, while MSI’s initial response was hampered by communication issues, the company ultimately addressed the critical security flaw effectively and quickly. Mr. Brub’s work exemplifies the value of ethical hacking and coordinated disclosure in enhancing cybersecurity. Users of MSI devices should remain vigilant, keep their software updated, and consider minimizing installed software to reduce potential vulnerabilities. For those interested in cybersecurity, following researchers like Mr. Brub provides valuable insights into real-world security challenges and resolutions.
