ShadowHammer: ASUS’s updater shipped a backdoor
Attackers pushed a signed, trojanised ASUS Live Update to many PCs, targeting a few hundred. Update tools are prime targets.
Researchers revealed last week that attackers compromised ASUS’s Live Update tool in 2018 and pushed a backdoored version, signed with ASUS’s real certificate, to many computers. The malware only activated on about 600 specific machines, chosen by their network card addresses. The rest were collateral.
This is a supply-chain attack: hit the update system, and every customer trusts what arrives.
What to do:
- ASUS users: update Live Update to the fixed version and run ASUS’s check tool.
- Remove vendor utilities you don’t need. Many laptops come with several updaters running with admin rights.
- In companies, manage drivers and firmware centrally instead of letting each vendor’s tool run.
A valid signature proves who shipped software, not that it’s safe. Behaviour monitoring catches what signatures miss.