It was revealed that hackers targeted and compromised “hundreds of thousands” of ASUS computers after pushing a backdoored update software tool directly from the company’s own servers.
First reported by Motherboard, the hackers somehow got their hands to the digitally signed ASUS Live Update tool which has one of the company’s code-signing certificates.
Having this, the hackers were able to upload a tampered version of updates to ASUS servers, which were then pushed to ASUS users.
The attacks initiated by the hackers were able to infect devices without raising any red flags. This is because the hackers used ASUS' legitimate security certificate, which was hosted on the computer manufacturer's servers.
After being installed, the update with the built-in backdoor would scan the victims' unique MAC address and pulls a malicious payload from a command and control server.
Kaspersky, which first found the backdoored software, called this the "Operation ShadowHammer."
Happening between June and November 2018. Kaspersky found that it affected as many as half a million ASUS computers.
But according to Motherboard, the malware apparently affected only a small number of them, saying that the backdoor was only scanning for some 600 MAC addresses, and was likely made to infect only a small number of victims rather than cause infections on a large scale.
"They were not trying to target as many users as possible," said Vitaly Kamluk, Asia-Pacific director of Kaspersky Lab’s Global Research and Analysis Team who led the research. "They wanted to get into very specific targets and they already knew in advance their network card MAC address, which is quite interesting."
It was revealed that one of the backdoored files used a certificate created in mid-2018, but were different from ASUS' regularly used certificates in later times.
Because these older certificates were still active and had not been revoked, the hackers were able to tamper with the updates, posing continued risk to ASUS customers.
During that time, there were early hints that a signed and malicious ASUS update was being pushed to users. A number of people on Reddit commented about a suspicious alert that popped up on ASUS machines for a "critical" update.
"ASUS strongly recommends that you install these updates now," the alert warned.
Symantec confirmed Kaspersky’s findings, saying that "Our findings suggest the trojanized version of the software were sent to ASUS customers between June and October."
Motherboard said that Kaspersky reported the backdoored software on January 31.
ASUS is a multi-billion dollar Taiwan-based computer company.
Considered as one of the top consumer notebook vendors in the world, the company is said to have some 6 percent of the computer market share, shipping at least tens of millions of computers each year.
With this backdoored updates case, there are concerns regarding distrusts on legitimate automatic updates.
Many people rely on their vendors to patch their devices in order to defend against new malware. For example, in the WannaCry ransomware case, the reasons why the majority of computers were infected was because the users didn't install security updates issued by their vendors.
After seeing ASUS' case, it's discovered that legitimate updates that come from the vendors can also be compromised.
The issue is known as 'supply-chain attack', a type of attack where hackers are able to plant malicious software or components on systems as they’re manufactured or assembled, or afterward via trusted vendor channels.
Further rresearch into the backdoor revealed that it bears resemblance to Piriform CCleaner's case. When the popular utility program was hijacked, the hackers used similar code-signing certificate to hide any malicious component.
Some 2.3 million users are said to be affected by this kind of backdoor.
"The Kaspersky researchers believe the ShadowHammer attackers were behind the ShadowPad and CCleaner attacks and obtained access to the ASUS servers through the latter attack," said Motherboard.
