Monday, March 25th 2019
Hackers Get to ASUS Live Update Servers, Plant Malware in Thousands of Computers
In a chilling reminder of just why system software should always be manually updated and never automatically, Vice Motherboard citing Kaspersky Labs reports that hackers have compromised the Live Update servers of ASUS, making them push malware to thousands of computers configured to fetch and install updates automatically. These include not just PC motherboards, but also pre-builts such as notebooks and desktops by ASUS. Smartphones and IoT devices by ASUS are also affected. Hackers have managed to use valid ASUS digital certificates to masquerade their malware as legitimate software updates from ASUS.
Kaspersky Labs says that as many as half a million devices have fallen prey to malware pushed to them by ASUS. The cybersecurity firm says it discovered the malware in January 2019 when implementing a new supply-chain detection technology, and informed ASUS by late-January. Kaspersky even sent a technically-sound representative to meet with ASUS in February. Kaspersky claims that ASUS has since been "largely unresponsive since then and has not notified ASUS customers about the issue." ASUS is already drowning in bad-rep from the PC enthusiast community for its Armoury Crate feature that lets motherboard BIOS push software to a Windows installation through an ACPI table dubbed "the vendor's rootkit," which ASUS enabled by default on new motherboards. Who knows what recent motherboard BIOS updates have pushed into your PC through this method.
Source:
Vice Motherboard
Kaspersky Labs says that as many as half a million devices have fallen prey to malware pushed to them by ASUS. The cybersecurity firm says it discovered the malware in January 2019 when implementing a new supply-chain detection technology, and informed ASUS by late-January. Kaspersky even sent a technically-sound representative to meet with ASUS in February. Kaspersky claims that ASUS has since been "largely unresponsive since then and has not notified ASUS customers about the issue." ASUS is already drowning in bad-rep from the PC enthusiast community for its Armoury Crate feature that lets motherboard BIOS push software to a Windows installation through an ACPI table dubbed "the vendor's rootkit," which ASUS enabled by default on new motherboards. Who knows what recent motherboard BIOS updates have pushed into your PC through this method.
43 Comments on Hackers Get to ASUS Live Update Servers, Plant Malware in Thousands of Computers
dlcdnets.asus.com/pub/ASUS/nb/Apps_for_Win10/ASUSDiagnosticTool/ASDT_v1.0.1.0.zip
you believe?
Also no luck overcloking RAM so far. 3000Mhz rated kit and XMP option is unstable at 2933 or anything above it even when keying in specific values from Ryzen DRAM calculator based on my memory (Teamgroup Delta RGB 2x4GB using Micron B-Die chips).
Also unlike ASUS and some others the BIOS does not show what settings you have changed when saving or exiting. You can't select to load or save custom profiles with only keyboard. The RGB tool is unable to control connected RAM sticks from BIOS. The autoupdate tool for ODD-less systems supposedly downloads drivers to...somewhere on disk which i have yet to find where.
God what a mess. I should have gone with ASUS instead. Not saying they are perfect but atleast their hardware and BIOS is manageable. Well except for Z390 VRM-s and windows based software.
am i in danger?
I totally agree with Abaidor, ASUS has the best BIOS BUT the absolute WORST software...There was the period of time a Windows update broke all ASUS software and I was left high and dry. ASUS put a "new" version of AI Suite out as a solution. It didn't even see ANYTHING on my board so it was absolutely useless to me and well ASUS is also terrible with uninstallers, once you get it in there getting it out again is near impossible.
But bottom line I NEED AI Suite and specifically the one for my motherboard, not a generic version.But I strip it down on install to just the bit I need because it always comes with a ton of bloat.Just built a 2600X rig for a friend on an ASUS board recently and it's still the buggy bloated mess even now.
Most probably I will end up with an Aquaero + their LED controllers since both fan/pump/sensor control through BIOS is limited while Aura is simply a piece of junk software once you add some burden to it while it lacks in features and stability. Damn Aura does not even have profiles.