Story image

ASUS' own servers compromised in malware attack

27 Mar 2019

ASUS’ own servers have been compromised in attack that has put hundreds of thousands of users at risk of malware infection.

Asus Live Update is a tool that comes with Asus notebook computer. It helps Asus systems keep up with proprietary firmware and driver updates.

However, the company admitted yesterday that a sophisticated attack on its Live Update servers led to ‘a small number of devices’ being implanted with malicious code, because the attackers used a fake update to push the malware.

Asus believes that the attacks are the work of an Advanced Persistent Threat (APT) group that was trying to target a ‘small and specific’ user group - although Asus has not yet provided details of how the attackers accessed its servers.

According to security firm Avira, early estimates suggest that the compromised update was sent to more than a million devices. Of those, several hundred thousand devices may have installed it.

'So far at Avira, we've seen more than 438,000 executions of the initial installer by Asus customers,'' comments Avira Protection Lab head  Alexander Vukcevic. 

Of those infected devices, around 600 were chosen for an additional stage of malware infection, according to Avira.

''The second stage PE file, which contains the malicious code and will be executed by the installer, is already flagged by Avira as ''TR/ShadowHammer.ME'' with the current pattern update.''

Asus has also fixed the latest version of Live Update (ver. 3.6.8) and added multiple security verification mechanisms to prevent any further malicious manipulation of software updates. It has also implemented an enhanced end-to-end encryption mechanism and strengthened its server-to-end-user software architecture.

Tenable research engineer Satnam Narang, Sr notes that the attacks put the spotlight back on supply chain security.

“Supply chain attacks pose serious risks as they threaten the implicit trust users have in manufacturers and software developers. This can result in end-user scepticism about applying software updates, which often contain critical security updates that, if left unpatched, could be exploited by attackers. However, a common thread among many of these supply chain attacks is that, despite having access to a trove of compromised systems at their disposal, attackers have only targeted a smaller subset of those systems. While the risk of supply chain attacks is concerning, the greater concern lies in failing to patch known vulnerabilities that could be exploited more broadly."

Asus says it is contacting affected users and providing support to help remove the risks. Asus has also created an online security diagnostic tool to check for infected systems.

How do I know whether or not my device has been targeted by the malware attack?

Only a very small number of specific user group were found to have been targeted by this attack and as such it is extremely unlikely that your device has been targeted. However, if you are still concerned about this matter, feel free to use ASUS’ security diagnostic tool or contact ASUS Customer Service for assistance.

What should I do if my device is affected?

Immediately run a backup of your files and restore your operating system to factory settings. This will completely remove the malware from your computer. In order to ensure the security of your information, ASUS recommends that you regularly update your passwords.

How do I make sure that I have the latest version of ASUS Live Update?

You can find out whether or not you have the latest version of ASUS Live Update by following the instructions shown in the link.

Have other ASUS devices been affected by the malware attack?

No, only the version of Live Update used for notebooks has been affected. All other devices remain unaffected.

This Iron Man drone wants you to fly like a superhero
Iron Man must be one of the most popular superheroes of 2019 – because this year he has been transformed into a robot, and now he’s styled as his very own drone.
HP back on board with Emirates Team NZ
HP 3D print technology will supposedly help the team innovate at speed.
Do you use the Peel Smart Remote app? Delete or update it now
Peel Smart Remote could leak your personal pictures, information, and documents to an unknown server.
How printing solutions can help save the planet
Y Soft has identified five key ways organisations can become more economical and reduce their environmental impact.
Information is power when choosing electricity plans
While 90% of respondents knew their average power bill over the summertime, more than half didn’t know their kilowatt hour (kWh) price, or their monthly usage amount. 
A quick look at Haier & LG's take on the smart home revolution
Haier is going all-in on the smart home revolution – and it believes your home should be smart all the way from the laundry to the bedroom.
An 8K TV for $80,000? Samsung has you covered
8K televisions have landed in New Zealand, but they come with eye-watering price tags of up to $80,000.
Scammers targeting more countries in sextortion scam - ESET
The attacker in the email claims they have hacked the intended victim's device, and have recorded the person while watching pornographic content.