3 ms·

I don't understand why one would allow untrusted IPs to upload software to be spread like this. Putting new updates on such a system should be part of a proces

by tyfon 8y ago

I don't understand why one would allow untrusted IPs to upload software to be spread like this. Putting new updates on such a system should be part of a process with many checks on the way to verify the authenticity of the software?

dhimes 8y ago
Well, the certs were legit. So I guess yeah, in hindsight only allowing certain IPs to be associated with a cert or something would be cool, but damn if I know how to do that on a Windows machine.
- tyfon 8y ago
  No I mean on Asus' side. Like you should have a very specific procedure to put files on the server not let a random computer on the internet do it without an approval process.
  - deanclatworthy 8y ago
    It wasn't a random computer on the internet. It was Asus's actual servers. If they are breached, and you have the ability to sign the packages, it's game-over. This wasn't a case of re-routing.
  - c256 8y ago
    The update service inside ASUS was broken, so it doesn’t matter what ASUS intended or implemented; the attackers would have just changed that. The second stage installer was totally owned by the attacker. Perhaps interesting to note: this is a situation where a blockchain could have been helpful.
    - tyfon 8y ago
      Yeah I understand that, but how is it possible for a company to put such a service on the network so that it _can_ be breached, that was really my question. It shouldn't have the place where you put the update files exposed to the internet at all. Unless it was an inside job somehow. The way it's described it almost sounds like the service exposed to the internet had write access to the files.
      - ecpottinger 8y ago
        Because stupid managers see security as a cost, and possible future security breaks as something that will not happen to them.
      - justinclift 8y ago
        > The way it's described it almost sounds like the service exposed to the internet had write access to the files. A service exposed to the internet gets to decide what it sends to end users. Compromise that, it can replace the stuff sent on the fly. Not saying that's what happened here, just pointing out that not having "write access to the files" isn't a guaranteed win either. Depending on what else the attackers had access to (executables key signing pieces?), likely determines the approaches they took.
raesene9 8y ago
From the article it appears that the Hardware management software was hard-coded to use Asus' update servers. that's not an uncommon model from what I've seen. Unlike Windows updates, firmware/utility/driver updates tend to come directly from the vendor.

by tyfon 8y ago

dhimes 8y ago

Well, the certs were legit. So I guess yeah, in hindsight only allowing certain IPs to be associated with a cert or something would be cool, but damn if I know how to do that on a Windows machine.

tyfon 8y ago
No I mean on Asus' side. Like you should have a very specific procedure to put files on the server not let a random computer on the internet do it without an approval process.
- deanclatworthy 8y ago
  It wasn't a random computer on the internet. It was Asus's actual servers. If they are breached, and you have the ability to sign the packages, it's game-over. This wasn't a case of re-routing.
- c256 8y ago
  The update service inside ASUS was broken, so it doesn’t matter what ASUS intended or implemented; the attackers would have just changed that. The second stage installer was totally owned by the attacker. Perhaps interesting to note: this is a situation where a blockchain could have been helpful.
  - tyfon 8y ago
    Yeah I understand that, but how is it possible for a company to put such a service on the network so that it _can_ be breached, that was really my question. It shouldn't have the place where you put the update files exposed to the internet at all. Unless it was an inside job somehow. The way it's described it almost sounds like the service exposed to the internet had write access to the files.
    - ecpottinger 8y ago
      Because stupid managers see security as a cost, and possible future security breaks as something that will not happen to them.
    - justinclift 8y ago
      > The way it's described it almost sounds like the service exposed to the internet had write access to the files. A service exposed to the internet gets to decide what it sends to end users. Compromise that, it can replace the stuff sent on the fly. Not saying that's what happened here, just pointing out that not having "write access to the files" isn't a guaranteed win either. Depending on what else the attackers had access to (executables key signing pieces?), likely determines the approaches they took.

raesene9 8y ago

From the article it appears that the Hardware management software was hard-coded to use Asus' update servers. that's not an uncommon model from what I've seen. Unlike Windows updates, firmware/utility/driver updates tend to come directly from the vendor.