Proprietary 2018-06-01 · 153 days ·Backdoor, Remote Access

ASUS Live Update delivered targeted backdoors

Attackers compromised ASUS Live Update servers and signed trojanized utility builds with stolen digital certificates.

Story

ShadowHammer used the ordinary ASUS update path. Trojanized Live Update installers were signed as ASUS software and hosted on official ASUS update servers, which made them look like routine maintenance to users and endpoint controls.

The malware was broad in delivery and narrow in intent. Kaspersky saw more than 57,000 users install backdoored updates in its own telemetry and estimated the real count could be much larger. The code then checked hardcoded network-adapter MAC addresses to select a smaller set of intended targets.

That design kept the noisy part in the supply chain and the costly part in the second stage. Most infected systems carried a signed backdoor that did little. Systems matching the target list could receive follow-on action.

ASUS acknowledged the incident after notification and issued updated tooling. The case remains a clean example of targeted espionage hidden inside mass distribution: official server, valid signature, malicious installer, selective activation.

Affected Artifacts

ASUS Live Update

· asus.com · Binary Archive
Observed
2018-06-01 to 2018-11-01
Compromised Versions
Unknown
Fixed
Not listed
Hashes
  • sha256:0f49621b06f2cdaac8850c6e9581a594128d69204c18589921e1fb5b7074da30
  • sha256:5855a5562d9add04ce523bfec4166c4cd252ffc398b18b2856a2faec8b1142e7
  • sha256:72a4bed7e48266794e07c8acc3ac4c8e6a6d0fbe6aa6eb8be3880d32e1874627
  • Affected ASUS scope covered multiple Live Update utility versions distributed between June and November 2018.

Incident Context

Motive
Espionage Highly Targeted
Attribution
State
Cause
Update Server Compromise Stolen Certificates
Transitive
No
Actor
Nation-state
User Impact
57000

External References

Source record: proprietary/asus/meta.yaml