itb-au logo
Story image

ASUS' own servers compromised in malware attack

27 Mar 2019

ASUS’ own servers have been compromised in attack that has put hundreds of thousands of users at risk of malware infection.

Asus Live Update is a tool that comes with Asus notebook computer. It helps Asus systems keep up with proprietary firmware and driver updates.

However, the company admitted yesterday that a sophisticated attack on its Live Update servers led to ‘a small number of devices’ being implanted with malicious code, because the attackers used a fake update to push the malware.

Asus believes that the attacks are the work of an Advanced Persistent Threat (APT) group that was trying to target a ‘small and specific’ user group - although Asus has not yet provided details of how the attackers accessed its servers.

According to security firm Avira, early estimates suggest that the compromised update was sent to more than a million devices. Of those, several hundred thousand devices may have installed it.

'So far at Avira, we've seen more than 438,000 executions of the initial installer by Asus customers,'' comments Avira Protection Lab head  Alexander Vukcevic. 

Of those infected devices, around 600 were chosen for an additional stage of malware infection, according to Avira.

''The second stage PE file, which contains the malicious code and will be executed by the installer, is already flagged by Avira as ''TR/ShadowHammer.ME'' with the current pattern update.''

Asus has also fixed the latest version of Live Update (ver. 3.6.8) and added multiple security verification mechanisms to prevent any further malicious manipulation of software updates. It has also implemented an enhanced end-to-end encryption mechanism and strengthened its server-to-end-user software architecture.

Tenable research engineer Satnam Narang, Sr notes that the attacks put the spotlight back on supply chain security.

“Supply chain attacks pose serious risks as they threaten the implicit trust users have in manufacturers and software developers. This can result in end-user scepticism about applying software updates, which often contain critical security updates that, if left unpatched, could be exploited by attackers. However, a common thread among many of these supply chain attacks is that, despite having access to a trove of compromised systems at their disposal, attackers have only targeted a smaller subset of those systems. While the risk of supply chain attacks is concerning, the greater concern lies in failing to patch known vulnerabilities that could be exploited more broadly."

Asus says it is contacting affected users and providing support to help remove the risks. Asus has also created an online security diagnostic tool to check for infected systems.

How do I know whether or not my device has been targeted by the malware attack?

Only a very small number of specific user group were found to have been targeted by this attack and as such it is extremely unlikely that your device has been targeted. However, if you are still concerned about this matter, feel free to use ASUS’ security diagnostic tool or contact ASUS Customer Service for assistance.

What should I do if my device is affected?

Immediately run a backup of your files and restore your operating system to factory settings. This will completely remove the malware from your computer. In order to ensure the security of your information, ASUS recommends that you regularly update your passwords.

How do I make sure that I have the latest version of ASUS Live Update?

You can find out whether or not you have the latest version of ASUS Live Update by following the instructions shown in the link.

Have other ASUS devices been affected by the malware attack?

No, only the version of Live Update used for notebooks has been affected. All other devices remain unaffected.

Story image
Q&A: StorageCraft director on how backup and recovery has changed in 2020
Techday spoke to StorageCraft international product marketing senior director Florian Malecki, who discusses the importance of backup and recovery, the products and solutions that StorageCraft offers in this field, and the revenue opportunities partners can capitalise on. More
Link image
You’re invited: The secrets to workplace happiness in the post-pandemic world
It has been a rough year for workplace wellbeing, with disruption and health concerns worrying every employee. Join Poly’s A/NZ Kickstart 2021 on 10 December from 11am AEDT, where special guest Dr Justin Coulson will share secrets to workplace happiness in the post-pandemic world. Register now.More
Story image
AppsFlyer opens Sydney office, expands into A/NZ region
AppsFlyer has opened an office in Sydney, it’s 19th office worldwide and its first in Australia and New Zealand (A/NZ), marking the company’s expansion into the region.More
Story image
Voice phishing attacks on the rise, remote workers vulnerable
There is an increase in voice phishing attacks, where hackers use existing employee names in attempt to trick victims into sharing login credentials and data by phone.More
Story image
In the sprint towards digital transformation, don’t neglect your data
Three tips to locate, secure, and understand dispersed corporate data.More
Story image
GCloud VMware Engine available in Sydney cloud region
Businesses in the A/NZ region can deploy Google Cloud VMware Engine closer to their operations and unlock new growth opportunities.More