sb-au logo
Story image

ASUS' own servers compromised in malware attack

27 Mar 2019

ASUS’ own servers have been compromised in attack that has put hundreds of thousands of users at risk of malware infection.

Asus Live Update is a tool that comes with Asus notebook computer. It helps Asus systems keep up with proprietary firmware and driver updates.

However, the company admitted yesterday that a sophisticated attack on its Live Update servers led to ‘a small number of devices’ being implanted with malicious code, because the attackers used a fake update to push the malware.

Asus believes that the attacks are the work of an Advanced Persistent Threat (APT) group that was trying to target a ‘small and specific’ user group - although Asus has not yet provided details of how the attackers accessed its servers.

According to security firm Avira, early estimates suggest that the compromised update was sent to more than a million devices. Of those, several hundred thousand devices may have installed it.

'So far at Avira, we've seen more than 438,000 executions of the initial installer by Asus customers,'' comments Avira Protection Lab head  Alexander Vukcevic. 

Of those infected devices, around 600 were chosen for an additional stage of malware infection, according to Avira.

''The second stage PE file, which contains the malicious code and will be executed by the installer, is already flagged by Avira as ''TR/ShadowHammer.ME'' with the current pattern update.''

Asus has also fixed the latest version of Live Update (ver. 3.6.8) and added multiple security verification mechanisms to prevent any further malicious manipulation of software updates. It has also implemented an enhanced end-to-end encryption mechanism and strengthened its server-to-end-user software architecture.

Tenable research engineer Satnam Narang, Sr notes that the attacks put the spotlight back on supply chain security.

“Supply chain attacks pose serious risks as they threaten the implicit trust users have in manufacturers and software developers. This can result in end-user scepticism about applying software updates, which often contain critical security updates that, if left unpatched, could be exploited by attackers. However, a common thread among many of these supply chain attacks is that, despite having access to a trove of compromised systems at their disposal, attackers have only targeted a smaller subset of those systems. While the risk of supply chain attacks is concerning, the greater concern lies in failing to patch known vulnerabilities that could be exploited more broadly."

Asus says it is contacting affected users and providing support to help remove the risks. Asus has also created an online security diagnostic tool to check for infected systems.

How do I know whether or not my device has been targeted by the malware attack?

Only a very small number of specific user group were found to have been targeted by this attack and as such it is extremely unlikely that your device has been targeted. However, if you are still concerned about this matter, feel free to use ASUS’ security diagnostic tool or contact ASUS Customer Service for assistance.

What should I do if my device is affected?

Immediately run a backup of your files and restore your operating system to factory settings. This will completely remove the malware from your computer. In order to ensure the security of your information, ASUS recommends that you regularly update your passwords.

How do I make sure that I have the latest version of ASUS Live Update?

You can find out whether or not you have the latest version of ASUS Live Update by following the instructions shown in the link.

Have other ASUS devices been affected by the malware attack?

No, only the version of Live Update used for notebooks has been affected. All other devices remain unaffected.

Story image
Five security challenges for the Enterprise of Things
Many enterprise networks aren't adequately managed, creating risk for businesses that don’t have full visibility into all of the devices on their network, writes Forescout regional director for A/NZ Rohan Langdon.More
Story image
Video: 10 Minute IT Jams - The benefits of converged cloud security
Today, Techday speaks to Forcepoint senior sales engineer and solutions architect Matthew Bant, who discusses the benefits of a converged cloud security model, and the pandemic's role in complicating the security stack in organisations around the world.More
Link image
Gartner report: Why SD-WAN is becoming the de-facto option
Network service providers are increasingly challenged by established and new competition in the overlay SD-WAN management as well as in the underlay WAN transport, the report says.More
Story image
Jamf extends Microsoft collaboration with iOS Device Compliance
Organisations will soon be able to use Jamf for Apple ecosystem management while using Azure Active Directory and Microsoft Endpoint manager to maintain conditional access.More
Story image
Kaspersky finds red tape biggest barrier against cybersecurity initiatives
The most common obstacles that inhibit or delay the implementation of industrial cybersecurity projects include the inability to stop production (34%), and bureaucratic steps, such as a lengthy approval process (31%) and having too many decision-makers (23%). More
Story image
Video: 10 Minute IT Jam – Who is Cohesity?
If you could pick two words to describe Cohesity, ‘data management’ fit very well.More