#Asus live update 3.6.8 update

Using stolen digital certificates used by ASUS to sign legitimate binary files, attackers manipulated older versions of ASUS software and injected their own malicious code into a backdoor. ASUS pre-installs this tool on its machines.

#Asus live update 3.6.8 update

The actors behind ShadowHammer targeted the ASUS Live Update Utility as the first source of infection. If the attacker managed it, infecting the manufacturer's supply chain, the infected software is rolled out to a large number of devices. While the infrastructure of a vendor such as ASUS can often be described as secure, there may be vulnerabilities in the facilities of sub-suppliers or in the transfer interfaces. Such an attack attempts to exploit specific weaknesses in the interconnected systems of all those involved in the product lifecycle. Such a component is a found food for any attacker.ДЄ successful supply chain attack for such a tool is one of the most dangerous and effective infection vectors used in advanced operations in recent years (as seen in ShadowPad or CCleaner). ASUS utility infected in a supply chain attackДЄSUS Live Update is a utility that is preinstalled on most ASUS computers and is used to automatically update certain components, such as BIOS, UEFI, drivers, and applications. However, the research team estimates that a much larger number of users are affected, with a total of over one million infected computers. Kim Zetter of Motherboard reported that the deposited version of the ASUS Live Update was downloaded and installed by more than 57,000 Kaspersky users. The GReAT team (Global Research and Analysis) from Kaspersky Lab named this vicious campaign ShadowHammer. We estimate this may have affected over 1 million computer users between June and Nov 2018. This campaign probably affected users who downloaded the ASUS Live Update Utility on their computers between June and November 2018.ДЄsus Live Updater was used in a big supply chain attack we dubbed Operation #ShadowHammer.

Kaspersky Lab discovered a new Advanced Persistent Threat (APT) campaign in January 2019 вЂ“ and made it public today.