Asus has released a fix for a supply chain attack and downplayed the impact on customers while promising to contact all those affected as incident highlights code signing vulnerabilities
Taiwan-based computer hardware firm Asus has released a fix a day after security researchers went public with news of a supply chain attack that has underlined vulnerabilities in code signing processes.
Security researchers at Kaspersky Lab said threat actors had injected a backdoor into the Asus Live Update utility between June and November 2018, affecting more than a million users worldwide.
However, Asus claimed that only “a small number of devices” had been implanted with the malicious code through an attack on its Live Update servers, according to Reuters.
Asus said it had implemented a fix in version 3.6.8 of its Live Update software that implements “an enhanced end-to-end encryption mechanism”, reports TechRadar. Asus said it had also updated and strengthened its server-to-end-user software architecture to prevent similar attacks in future.
The hardware company said customers could run an online security diagnostic tool to check whether their system was affected.
Dubbed Operation ShadowHammer, the security researchers described the attack as an advanced persistent threat (APT) campaign.
As seen with CCleaner in September 2017, where major tech firms were targeted by malware hidden in Avast-owned Piriform software, supply chain attacks target weaknesses in the interconnected systems of human, organisational, material and intellectual resources involved in the product lifecycle, from initial development stage through to the user.
While a supplier’s infrastructure can be secure, Kaspersky Lab researchers said there could be vulnerabilities in its providers’ facilities that would sabotage the supply chain, leading to a devastating and unexpected data breach.
In this case, the attackers targeted the Asus Live Update utility, which is a pre-installed utility in most new Asus computers for automatic updates of BIOS, UEFI, drivers and applications.
Using stolen digital certificates used by Asus to sign legitimate binaries, the researchers said the attackers tampered with older versions of Asus software, injecting their own malicious code. Trojanised versions of the utility were signed with legitimate certificates and were hosted on and distributed from official Asus update servers, making them “mostly invisible” to the “vast majority” of protection systems, the researchers said.
Operation ShadowHammer chose its victims
While potentially every user of the affected software could have become a victim, the researchers said the attackers appeared to have been focused on gaining access to several hundred users, which they had prior knowledge about.
Each backdoor code contained a table of hardcoded MAC addresses, the unique identifier of network adapters used to connect a computer to a network. Once running on a victim’s device, the backdoor verified its MAC address against this table, the researchers said.
If the MAC address matched one of the entries, the malware downloaded the next stage of malicious code. Otherwise, the updater did not show any network activity, which is why it remained undiscovered for such a long time, the researchers said.
In total, they were able to identify more than 600 MAC addresses, which were targeted by more than 230 unique backdoored samples with different shellcodes.
The modular approach and extra precautions taken when executing code to prevent accidental code or data leakage indicates that the attackers were keen to remain undetected, while hitting some very specific targets with surgical precision, the researchers said.
“Nearly every operating system is dependent on code signing. However, cyber criminals see code signing certificates as a valuable target due to their extreme power”
Kevin Bocek, Venafi
The search for similar malware has revealed software from three other suppliers in Asia, all backdoored with very similar methods and techniques, the researchers said, adding that the issue had been reported to Asus and the other affected suppliers.
“The selected vendors are extremely attractive targets for APT groups that might want to take advantage of their vast customer bases,” said Vitaly Kamluk, director of Kaspersky Lab’s APAC global research and analysis team.
“It is not yet very clear what the ultimate goal of the attackers was, and we are still researching who was behind the attack. However, techniques used to achieve unauthorised code execution, as well as other discovered artefacts, suggest that ShadowHammer is probably related to the Barium APT, which was previously linked to the CCleaner incident, among others.
“This new campaign is yet another example of how sophisticated and dangerous a smart supply chain attack can be nowadays,” he said.
Kevin Bocek, vice-president of security strategy and threat intelligence at machine identity protection provider Venafi, said code signing certificates are used to establish which updates and machines should be trusted, and they are in the applications that power cars, laptops, aeroplanes and more.
“Nearly every operating system is dependent on code signing, and we will see many more certificates in the near future due to the rise of mobile apps, DevOps and IoT [internet of things] devices. However, cyber criminals see code signing certificates as a valuable target due to their extreme power.
“With a code signing certificate, attackers can make their malware seem trustworthy and evade threat protection systems. Unfortunately, in many organisations the protection of code signing processes falls mostly to developers who are not prepared to defend these assets. In fact, most security teams aren’t even aware if their developers are using code signing or who may have access to the code signing process.
“It’s imperative for organisations to know what code signing certificates they have in use and where, especially as it’s likely we’ll see similar attacks in the future,” he said.
