Asus confirms hack but contests scale

By on
Asus confirms hack but contests scale

Asus says it's deploying improved security after the company's own PC update software was compromised by hackers in order to deliver malware to users.

Cybersecurity firm Kaspersky Lab initially disclosed the cyberattack on Monday, and Symantec later confirmed the attack, as well.

Criminals compromised the Asus Live Update utility, which provides BIOS, UEFI and software updates to Asus PCs. The malicious update was delivered to users between June and November of 2018, according to Kaspersky Lab.

Asus responded on Tuesday, acknowledging that some of its devices have been affected by malicious code through a "sophisticated attack" on the company's Live Update servers.

Asus has implemented a fix in the latest version of its Live Update software, Version 3.6.8, and recommended that all users move up to the version, the company said.

Asus has also "introduced multiple security verification mechanisms to prevent any malicious manipulation in the form of software updates or other means, and implemented an enhanced end-to-end encryption mechanism," the company said in a news release.

"We have also updated and strengthened our server-to-end-user software architecture to prevent similar attacks from happening in the future," Asus said.

However, Asus appeared to downplay the scope of the attack, saying that just "a small number of devices" have been implanted with the malicious code.

Kaspersky Lab, on the other hand, estimated that about 1 million users have been affected, and said it had so far uncovered more than 57,000 users with the backdoored utility. The firm has referred to the hack, which it's calling "ShadowHammer," as "one of the biggest supply-chain attacks ever."

Asus did appear to agree with Kaspersky Lab's assessment that hackers only targeted a relatively small number of users with the attack. The attack was "an attempt to target a very small and specific user group," Asus said.

Kaspersky Lab had reported that the hackers had only meant to target 600 specific users.

This article originally appeared at

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © 2018 The Channel Company, LLC. All rights reserved.

Most Read Articles

Log In

  |  Forgot your password?