Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Operation ShadowHammer APT targeted ASUS Live Update Utility

4 Weeks Ago   #1
Brink

64-bit Windows 10 Pro
 
 
Operation ShadowHammer APT targeted ASUS Live Update Utility

Quote:
Earlier today, Motherboard published a story by Kim Zetter on Operation ShadowHammer, a newly discovered supply chain attack that leveraged ASUS Live Update software.

While the investigation is still in progress and full results and technical paper will be published during SAS 2019 conference in Singapore, we would like to share some important details about the attack.

In January 2019, we discovered a sophisticated supply chain attack involving the ASUS Live Update Utility. The attack took place between June and November 2018 and according to our telemetry, it affected a large number of users.

ASUS Live Update is an utility that is pre-installed on most ASUS computers and is used to automatically update certain components such as BIOS, UEFI, drivers and applications. According to Gartner, ASUS is the world’s 5th-largest PC vendor by 2017 unit sales. This makes it an extremely attractive target for APT groups that might want to take advantage of their userbase.

Based on our statistics, over 57,000 Kaspersky users have downloaded and installed the backdoored version of ASUS Live Update at some point in time. We are not able to calculate the total count of affected users based only on our data; however, we estimate that the real scale of the problem is much bigger and is possibly affecting over a million users worldwide.

The goal of the attack was to surgically target an unknown pool of users, which were identified by their network adapters’ MAC addresses. To achieve this, the attackers had hardcoded a list of MAC addresses in the trojanized samples and this list was used to identify the actual intended targets of this massive operation. We were able to extract more than 600 unique MAC addresses from over 200 samples used in this attack. Of course, there might be other samples out there with different MAC addresses in their list.

We believe this to be a very sophisticated supply chain attack, which matches or even surpasses the Shadowpad and the CCleaner incidents in complexity and techniques. The reason that it stayed undetected for so long is partly due to the fact that the trojanized updaters were signed with legitimate certificates (eg: “ASUSTeK Computer Inc.”). The malicious updaters were hosted on the official liveupdate01s.asus[.]com and liveupdate01.asus[.]com ASUS update servers.



Digital signature on a trojanized ASUS Live Update setup installer
Certificate serial number: 05e6a0be5ac359c7ff11f4b467ab20fc


We have contacted ASUS and informed them about the attack on Jan 31, 2019, supporting their investigation with IOCs and descriptions of the malware.

Although precise attribution is not available at the moment, certain evidence we have collected allows us to link this attack to the ShadowPad incident from 2017. The actor behind the ShadowPad incident has been publicly identified by Microsoft in court documents as BARIUM. BARIUM is an APT actor known to be using the Winnti backdoor. Recently, our colleagues from ESET wrote about another supply chain attack in which BARIUM was also involved, that we believe is connected to this case as well.

A victim distribution by country for the compromised ASUS Live Updater looks as follows:



It should be noted that the numbers are also highly influenced by the distribution of Kaspersky users around the world. In principle, the distribution of victims should match the distribution of ASUS users around the world.

We’ve also created a tool which can be run to determine if your computer has been one of the surgically selected targets of this attack. To check this, it compares MAC addresses of all adapters to a list of predefined values hardcoded in the malware and alerts if a match was found.

Download an archive with the tool (.exe)

Also, you may check MAC addresses online. If you discover that you have been targeted by this operation, please e-mail us at: shadowhammer@kaspersky.com

IOCs

Kaspersky Lab verdicts for the malware used in this and related attacks:
  • HEUR:Trojan.Win32.ShadowHammer.gen
Domains and IPs:
  • asushotfix[.]com
  • 141.105.71[.]116
Some of the URLs used to distribute the compromised packages:
  • hxxp://liveupdate01.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER365.zip
  • hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER362.zip
  • hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER360.zip
  • hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER359.zip
Hashes (Liveupdate_Test_VER365.zip):
  • aa15eb28292321b586c27d8401703494
  • bebb16193e4b80f4bc053e4fa818aa4e2832885392469cd5b8ace5cec7e4ca19
A full set of IOCs and Yara rules is available to customers of Kaspersky Intelligence Reporting service – contact intelreports@kaspersky.com

Read more:


My System SpecsSystem Spec
.
4 Weeks Ago   #2
erpster4

Windows 7 SP1 Home Premium 64bit [x64]
 
 

recent response from ASUS, Brink

"ASUS response to the recent media reports regarding ASUS Live Update tool attack"
ASUS USA


fix is to obtain v3.6.8 of ASUS Live update
My System SpecsSystem Spec
4 Weeks Ago   #3
Brink

64-bit Windows 10 Pro
 
 
ASUS response to recent media reports regarding ASUS Live Update tool

Quote:
2019/03/26
ASUS response to the recent media reports regarding ASUS Live Update tool attack by Advanced Persistent Threat (APT) groups

Advanced Persistent Threat (APT) attacks are national-level attacks usually initiated by a couple of specific countries, targeting certain international organizations or entities instead of consumers.

ASUS Live Update is a proprietary tool supplied with ASUS notebook computers to ensure that the system always benefits from the latest drivers and firmware from ASUS. A small number of devices have been implanted with malicious code through a sophisticated attack on our Live Update servers in an attempt to target a very small and specific user group. ASUS customer service has been reaching out to affected users and providing assistance to ensure that the security risks are removed.

ASUS has also implemented a fix in the latest version (ver. 3.6.8) of the Live Update software, introduced multiple security verification mechanisms to prevent any malicious manipulation in the form of software updates or other means, and implemented an enhanced end-to-end encryption mechanism. At the same time, we have also updated and strengthened our server-to-end-user software architecture to prevent similar attacks from happening in the future.

Additionally, we have created an online security diagnostic tool to check for affected systems, and we encourage users who are still concerned to run it as a precaution. The tool can be found here: https://dlcdnets.asus.com/pub/ASUS/n...T_v1.0.1.0.zip

Users who have any additional concerns are welcome to contact ASUS Customer Service.

More information about APT groups: Advanced Persistent Threat Groups | FireEye

How do I know whether or not my device has been targeted by the malware attack?
Only a very small number of specific user group were found to have been targeted by this attack and as such it is extremely unlikely that your device has been targeted. However, if you are still concerned about this matter, feel free to use ASUS’ security diagnostic tool or contact ASUS Customer Service for assistance.

What should I do if my device is affected?
Immediately run a backup of your files and restore your operating system to factory settings. This will completely remove the malware from your computer. In order to ensure the security of your information, ASUS recommends that you regularly update your passwords.

How do I make sure that I have the latest version of ASUS Live Update?
You can find out whether or not you have the latest version of ASUS Live Update by following the instructions shown in the link below:
How do I ensure that my device has the latest and safest version of ASUS Live Update? | Official Support | ASUS Global

Have other ASUS devices been affected by the malware attack?
No, only the version of Live Update used for notebooks has been affected. All other devices remain unaffected.


Source: ASUS Global
My System SpecsSystem Spec
.

Reply

 Operation ShadowHammer APT targeted ASUS Live Update Utility




Thread Tools




Similar help and support threads
Thread Forum
Asus Utility won't run
Two of my fans are running at 50%. Although my case is running cool ( 32 to 35) and running Intel Burn Test and under full load it was 80 degrees, I would still like to adjust fan control. I have the Asus P8z77-v and downloaded the utility for Fanxpert 2 which allows for control of fans. ...
Hardware & Devices
Asus P5Q-E motherboard bios update utility software won't install?
I am trying to update the BIOS and went here to use their update utility: ASUS - Motherboards- ASUS P5Q-E However, the software Afudos BIOS update tool V2.36 will not load (3rd item of the above web page's list)!?!? :mad::mad::mad: What do I do now? Any other BIOS update utility...
Drivers
Asus live update causes Ethernet controller error.
I decided to run Asus live and have it update my computer. Around the 12th update my computer couldn't connect to the Internet saying my cable may be broken and try a new one. I ran troubleshooter and have a Ethernet Controller doesn't have a driver.
Drivers
How to use ASUS EFI Bios Utility - EZ Mode ?
Hello SF members. Note : I dont know where to put this topic. If you know better , move it. I already asked some questions here, some members helped me a lot but I need help again. In one topic I asked how to Overclock. I learned it , and know more about it. But now my problems is my...
Drivers
Asus DH Remote utility for Win 7
Hy there, i'm having a problem with Win 7 (x64)....i can't install the driver utility for my remote controler....Win 7 does recognize the usb receiver as ASUS DH REMOTE .... but when i install driver from Vista x64 the setup fails to install acpi driver (i need the program to configure the device...
Drivers


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 03:01.
Twitter Facebook