# MA-718.042019: MyCERT Alert - ASUS Releases Security Update for Live Update Software

**Date:** 02 Apr 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-718.042019  
**Advisory ID:** MA-718.042019

---

**1.0 Introduction**
ASUS Live Update is a proprietary tool supplied with ASUS notebook computers to ensure that the system always benefits from the latest drivers and firmware from ASUS. However, it was recently reported by ASUS, that a small number of devices have been implanted with a malware, through a sophisticated attack on ASUS Live Update servers in an attempt to target a very small and specific user group. ASUS customer service has been reaching out to affected users and providing assistance to ensure that the security risks are removed.
**2.0 Impact**
Failure to update may cause exploitation of the vulnerabilities and may allow a remote attacker to take control of an affected system.
**3.0 Affected Products**
ASUS Live Update software for notebooks, version below 3.6.8.  All other devices remain unaffected.
**4.0 Recommendation**
4.1 ASUS has released Live Update version 3.6.8 to address vulnerabilities in ASUS Live Update software.
In order to check if your computer is running the latest Live Update version 3.6.8, please refer here:
<https://www.asus.com/support/FAQ/1018727/>
4.2 ASUS have created an online security diagnostic tool for user to download and check for affected devices. The tool can be found here:
<https://dlcdnets.asus.com/pub/ASUS/nb/Apps_for_Win10/ASUSDiagnosticTool/ASDT_v1.0.1.0.zip>
Kaspersky has released an online web page where ASUS PC users can search for their MAC addresses to check whether they were in the hit list.
<https://shadowhammer.kaspersky.com/>
4.3 If users find their computer MAC address in the list, it means their computer has been backdoored by the malicious update, and ASUS recommends you perform a factory reset to wipe up the entire system. This will completely remove the malware from their computer.
In addition, users are also advised to regularly update their passwords to secure their sensitive information.
For incident reporting and other enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#21425843445318181861425843445352444254534855580f4c58) or [[email protected]](/cdn-cgi/l/email-protection#abc6d2c8ced9dfebc6d2c8ced9df85c4d9cc85c6d2)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
•  <https://www.us-cert.gov/ncas/current-activity/2019/03/26/ASUS-Releases-Security-Update-Live-Update-Software>
•  <https://securelist.com/operation-shadowhammer/89992/>
•  <https://www.kaspersky.com/blog/shadow-hammer-teaser/26149/>
•  <https://www.asus.com/News/hqfgVUyZ6uyAyJe1>
• [https://www.asus.com/support/FAQ/1018727/](https://www.asus.com/support/FAQ/1018727/ )
• <https://shadowhammer.kaspersky.com/>