ASUS Live Update Utility: A new advanced persistent threat (APT) detected by Kaspersky Lab in January of 2019 seems to run from June to November of 2018.
The threat has reportedly affected over a million users who have downloaded it data from ASUS Live Update Utility on their computers.
Kaspersky Lab's Global Research and Analysis (GReAT) team named this malicious campaign Surgery ShadowHammer and as Kim Zetter first reported, led to a backdoored version of ASUS Live Update downloading and installing data on over 57.000 users using Kaspersky products (on ASUS PCs of course).
While Kaspersky was able to stop most downloads from the trojanized ASUS Live Update, the company's research team estimates that over one million users are infected.
According to GReAT:
ASUS Live Update is a utility that comes pre-installed on most ASUS computers. Used for automatic information certain components such as BIOS, UEFI, drivers and applications
And it continues:
According to Gartner, ASUS was the fifth largest company computers worldwide by 2017. This makes the company a highly attractive target for APT groups who may want to take advantage of the breadth of their users.
According to GReAT, there were multiple versions of infected files in the ASUS Live Update that were shared, targeting "unknown groups of users identified by MAC addresses."
The attackers behind the ShadowHammer mod used a hardcoded list of MAC addresses to target the distribution of the malware. Kaspersky was able to collect more than 600 MAC addresses from 200 malware samples used in this attack.
Kaspersky's researchers also found that the infected Live Update was digitally signed with "ASUSTeK Computer Inc." legal certificates. certificates hosted on the official (liveupdate01s.asus [.] com and liveupdate01.asus [.] com) update servers of ASUS.
If you're worried about your Asus computer, Kaspersky released one offline application and an online web checkerto check if your systems have been dropped by Operation ShadowHammer.
For testing, we compare your MAC address with the list of hardcoded addresses we discovered in malware.
___________________
- Windows 10 build 18362 on the Slow Ring as a RTM candidate
- Focus Mode by Google: what it is and how to turn it on
- TEDx University of Crete Saturday 6 April 2019
