Newsgroup: it.comp.sicurezza.varie
Titolo: ASUS: update automatici con backdoor

 
"ASUS is believed to have pushed malware to hundreds of thousands of
customers through its trusted automatic software update tool after
attackers compromised the company's server and used it to push the
malware to machines."
 
"The researchers estimate half a million Windows machines received the
malicious backdoor through the ASUS update server"
 
https://yro.slashdot.org/story/19/03/25/144248/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers
 
 
https://motherboard.vice.com/en_us/article/pan9wn/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers
 
 
:-(
 
 
nota: x-post su icsv/icoww10, follow up in icsv
 
 



qui la "risposta" di ASUS
 
https://www.asus.com/News/hqfgVUyZ6uyAyJe1
 
 
<GROAN> :(
 

*ObiWan* scrive:

Disattivato sempre e disinstallata quella merda sui NB Asus dei clienti
 
 
 
 
 
 
 
 
-- 
Don Fizzy® on MV 910R "Maverick"
  "Non c'é trucco non v'é inganno"
       /)/)
      ( '.')
   o(_('')('')    That's all, folks!
 Nessun bit è stato maltrattato
per spedire questo messaggio. 
 


Interessante che abbiano specificato "in an attempt to target a very small and 
specific user group". Si saprà mai chi era questo obiettivo da colpire?

 da colpire?
 
Quoto alcune parti rilevanti di quanto riportato al link sopra
 
=======================================================================
 
"The researchers estimate half a million Windows machines received the
malicious backdoor through the ASUS update server, although the
attackers appear to have been targeting only about 600 of those
systems. The malware searched for targeted systems through their unique
MAC addresses. Once on a system, if it found one of these targeted
addresses, the malware reached out to a command-and-control server the
attackers operated, which then installed additional malware on those
machines."
 
"He noted that ASUS denied to Kaspersky that its server was compromised
and that the malware came from its network when the researchers
contacted the company in January. But the download path for the malware
samples Kaspersky collected leads directly back to the ASUS server,
Kamluk said."
 
"the US-based security firm Symantec confirmed the Kaspersky findings
on Friday after being asked by Motherboard to see if any of its
customers also received the malicious download. The company is still
investigating the matter but said in a phone call that at least 13,000
computers belonging to Symantec customers were infected with the
malicious software update from ASUS last year."
 
"Most of the infected machines belonging to Kaspersky customers (about
18 percent) were in Russia, followed by fewer numbers in Germany and
France. Only about 5 percent of infected Kaspersky customers were in
the United States. Symantec’s O’Murchu said that about 15 percent of
the 13,000 machines belonging to his company’s infected customers were
in the U.S."
 
"The Kaspersky researchers were able to crack most of the hashes they
found to determine the MAC addresses, which helped them identify what
network cards the victims had installed on their machines, but not the
victims themselves. Any time the malware infected a machine, it
collected the MAC address from that machine’s network card, hashed it,
and compared that hash against the ones hard-coded in the malware. If
it found a match to any of the 600 targeted addresses, the malware
reached out to 
asushotfix.com
, a site masquerading as a legitimate ASUS
site, to fetch a second-stage backdoor that it downloaded to that
system. Because only a small number of machines contacted the
command-and-control server, this helped the malware stay under the
radar."
 
"But even if silent on non-targeted systems, the malware still gave the
attackers a backdoor into every infected ASUS system."
 
=======================================================================
 
in pratica il malware ha infettato un bel mucchio di sistemi (la stima
di mezzo milione credo sia prudenziale, probabilmente sono molti di
più) però si è attivato SOLO su quei sistemi in cui il MAC address
della scheda di rete corrispondeva ad uno dei MAC contenuti in una
lista, a questo punto è interessante notare come gli attaccanti
conoscessero IN ANTICIPO i MAC delle vittime, per il resto, dubito che
si saprà "chi/cosa" era (è) oggetto dell'attacco, anche se si hanno
alcuni sospetti sulla possibile origine dello stesso; vedi qui
 
https://www.fireeye.com/current-threats/apt-groups.html
 
 
:P