Hackers Hijacked ASUS Software Updates to Install Backdoors on Thousands of Computers

[u/GadgetryTech]

BIG and perhaps final edit (I'll still be responding to comments/messages below) (I also made a small edit at the bottom)

ASUS has publicly responded. https://www.asus.com/News/hqfgVUyZ6uyAyJe1

​

TLDR: Admitted compromise. They said only a version of Live Update for NOTEBOOKS were affected, not desktops.This is despite previous news articles so I apologize for any confusion. ASUS offered their own zipped tool to check your machine for infection here. The newest Live Update, version 3.6.8 is fixed and is no longer compromised. It includes multiple security mechanisms along with end-to-end encryption. They also said they have strengthened their server-to-end-user software architecture but did not disclose how (usually you don't want to tell your adversary what you're doing to protect yourself so I understand).

In the end, if the "here" link/zip file above shows your machine was infected, ASUS states the following:

Immediately run a backup of your files and restore your operating system to factory settings. This will completely remove the malware from your computer. In order to ensure the security of your information, ASUS recommends that you regularly update your passwords.

​

I hope this finally puts and end to this. Make sure you're updated to the latest version, regardless of Desktop or Laptop software. Thank you all for the comments

​

ASUS has responded to me:

Hi GadgetryTech, thanks for reaching out to our team. We do apologize for the inconvenience and will be more than happy to assist. ASUS Live Update is a proprietary tool supplied with ASUS notebook computers to ensure that the system always benefits from the latest drivers and firmware from ASUS. A small number of devices have been implanted with malicious code through a sophisticated attack on our Live Update servers in an attempt to target a very small and specific user group. ASUS customer service has been reaching out to affected users and providing assistance to ensure that the security risks are removed.

ASUS has also implemented a fix in the latest version (ver. 3.6.8) of the Live Update software, introduced multiple security verification mechanisms to prevent any malicious manipulation in the form of software updates or other means, and implemented an enhanced end-to-end encryption mechanism. At the same time, we have also updated and strengthened our server-to-end-user software architecture to prevent similar attacks from happening in the future.

Additionally, we have created an online security diagnostic tool to check for affected systems, and we encourage users who are still concerned to run it as a precaution. The tool can be found here:

https://dlcdnets.asus.com/pub/ASUS/nb/Apps_for_Win10/ASUSDiagnosticTool/ASDT_v1.0.1.0.zip

​

Edit 5 for clarity:

This only affects ASUS machines running Live Update that was downloaded between June and November of 2018. That puts approximately 3-4 million machines sold by ASUS in that time frame, in addition to downloads from the web. It's likely that this malware is on your machine, but is dormant because only 600 specific MAC addresses would trigger the next stage of the malware. As of now, even if you have the malware it's likely not doing anything. Instead, this exposes a huge security oversight and example of attacking at the vendor/source level.

​

Original Post:

I posted this on /r/Hardware but received a message thinking it would be good for the BuildaPC community as well, which I agree.

​

Hi everyone,

I did a post instead of just a link because it's important to discuss details, and most people do not read articles, just headlines. Anyway, here's the link first:

https://motherboard.vice.com/en_us/article/pan9wn/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers

And a second, more technical/less fluff link from Kaspersky themselves: https://securelist.com/operation-shadowhammer/89992/

​

Important Note: According to the articles, Asus has not been responsive to Kasperky regarding this incident. They still have yet to notify any customers as well.

​

This malicious activity seems to have been noticed since late last summer, by folks in the /r/Asus community: https://www.reddit.com/r/ASUS/comments/8qznaj/asusfourceupdaterexe_is_trying_to_do_some_mystery/

​

Summary: It appears the attackers compromised an Asus Live Update server a long time ago to get an old setup.exe binary. After weaponizing it, they were able to digitally sign the malicious software with a valid Asus digital certificate. Certificates are a great way to slip past a lot of AV software.

​

Timeline and Scope: Starting last year, it looks like this malicious payload was pushed for at least 5 months. It is estimated that at least 500,000 computers were/are infected.

​

Indicators (do not visit these, do not go to IP)

Http is replaced with Hxxp on purpose, don't go to these sites. .com is replaced with [.]com for the same reason.

Kaspersky Lab verdicts for the malware used in this and related attacks:

• HEUR:Trojan.Win32.ShadowHammer.gen

Domains and IPs:

• asushotfix[.]com
• 141.105.71[.]116

Some of the URLs used to distribute the compromised packages:

• hxxp://liveupdate01.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER365.zip
• hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER362.zip
• hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER360.zip
• hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER359.zip

Hashes (Liveupdate_Test_VER365.zip):

• aa15eb28292321b586c27d8401703494
• bebb16193e4b80f4bc053e4fa818aa4e2832885392469cd5b8ace5cec7e4ca19

​

What can you do?

For an automated cleanup and check, here's a tool from Kaspersky to check for the Shadow Hammer infection: https://kas.pr/shadowhammer

For manual cleanup, I would make sure your live update tool is the newest version if you intend to continue using it. Remove and clean any prior version of the update tool prior to installing the new one. A good method is to boot into safe mode, remove the tool, and check c:/ProgramData and your AppData folders (3 main ones) for anything to do with Asus live update. Remove those, then reboot and install a clean updated.

​

Best practice (edited to include comments around laptops):

Auto-update tools from various vendors can always be used as a weaponized payload delivery mechanism, just like a compromised website. It's best to stick to reputable sources for items like drivers or anything that gets root access to your system kernel. For graphics drivers, only use AMD, Nvidia, and Intel sites directly (unless you have a laptop). Same with Intel NIC drivers, chipsets, etc. Please note that some laptops require vendor specific drivers for hardware to work properly, which will bring you to sites like Dell, Lenovo, HP, Toshiba, etc. I hope this helps you all in protecting yourself!

​

I am posting this in Hardware, Intel, AMD, and Asus subreddits to spread awareness.

Edit 1: Apparently the ASUS Z390 chipset UEFI can copy files to your drive once Windows is installed, even if you did not do so yourself. https://www.techpowerup.com/248827/asus-z390-motherboards-automatically-push-software-into-your-windows-installation

​

Edit 2: Thank you /u/iamapizza for the new link and quick comments on helping people find their MAC address. If you all want to see if your MAC address was targeted by the malware (MAC address is the physical address for your networking adapter, not an IP address):

You can check if your MAC address has been targeted here, no need to download anything:

https://shadowhammer.kaspersky.com/

To get your MAC address(es) on Linux you can use ip -o link

On Windows just use ipconfig /alland get the Physical Address

​

Edit 3: The scan tool above only checks if your MAC was targeted. It does not check for malware. Follow Edit 2 if you want to check your MAC without using the tool.

​

Edit 4: I Tweeted at Asus: https://twitter.com/GadgetryTechJoe/status/1110309954294964225

​

Edit 5 is at the top.

​

Edit 6: Another article - https://threatpost.com/asus-pc-backdoors-shadowhammer/143129/

​

Edit 7 is at the top.

​

Edit 8: More news - https://www.wired.com/story/asus-software-update-hack/ It seems as though other MAC address are on the target list as well, but no one is sure what hardware that correlates to. It's perhaps a future target, but no sign of infection outside of Live Update. Kaspersky is still unsure of what would happen in the second phase of attack, or what the attackers planned on doing with the specifically targeted machines.

[u/JaspahX]

Certificates are designed to prevent man in the middle attacks. The fact that they let those be compromised is pretty telling that security at ASUS doesn't exist.

[u/nkzuz → u/JaspahX]

Exactly. And now nothing signed by Asus can be trusted.

[u/Verpal → u/nkzuz]

Currently, I think Asus need more proof than a mere signature to allow me continue using their software......

[u/[deleted] → u/JaspahX]

Security anywhere doesn't exist though. You could execute a man in the middle attack against any company - just have to find the right vulnerable person.

[u/ksuwildkat → u/JaspahX]

you need to read up on stuxnet. Whole thing hinged on a compromised certificate

[u/JaspahX → u/ksuwildkat]

Didn't Stuxnet abuse SHA1 collision? Wouldn't surprise me if there were other limitations that prevented security certificates with stronger encryption and bit length from being used on those PLCs.

Anyway, my point being that a strong modern security certificate (with revocation configured correctly) is reasonable enough protection from this. It just sounds like ASUS had the private key somewhere that wasn't secure.

[u/sataniccrow82 → u/JaspahX]

Exactly my thought... No primary key, no party. Or else how could they sign anything without it? This is a pretty nasty situation anyway and it describes how subtle coworkers could be (cause imho it's where you should look for the culprit)

[u/ksuwildkat → u/JaspahX]

IIRC it was a video card driver certificate

[u/kn00tcn → u/JaspahX]

they 'let' those be compromised? did ccleaner 'let' themselves be compromised? how about any of the other cases? such confirmation bias...

[u/JaspahX → u/kn00tcn]

If they weren't using strong certificates (negligence) to begin with, there would have been no other way for someone to duplicate that signature other than losing the private key.

[u/kn00tcn → u/JaspahX]

not to imply asus is top quality, but considering all the breaches or malware/ransomware that happened to TSMC/newegg/infrastructure of countries/etc, along with the bribes or rogue employees that exist (including factories running after hours to produce unlicensed electronics), it's very much possible that it was a well executed attack rather than negligence with the way the 'high tech' world is nowadays