4 ms·

Interesting hack, but not really a surprise that attackers are continuing to look at supply chain's to get into targets that might otherwise be quite hardened.

Interesting hack, but not really a surprise that attackers are continuing to look at supply chain's to get into targets that might otherwise be quite hardened. From what I've seen of PC laptops, in many cases (especially with companies that don't usually have large corps as customers) they don't provide the option for corporates to enforce downloads of firmware/utilities from a company controlled source, so they'll come from the vendor's central location. So Asus' risk profile isn't going to include good defences against high-end/state-level attackers, so it's a nice vector for one of that class of attacker to get into companies who are customers of Asus'. It would seem like the attacker must have had some foreknowledge of what systems they wanted to target (i.e. that their target used Asus laptops) but that's not impossible to achieve.

Nadboy1 8y ago
This reminds me of the Runaway Evidence episode from the Ghost in the shell series. An employee with access to the codebase for a military weapons manufacturer manipulates it for their personal reasons
- fapjacks 8y ago
  Indeed, this scenario is so ubiquitous that it will certainly continue happening as far into the future as there are human beings, for whatever definition of "human being" you can come up with. One of the first things I learned in the military was that many many things -- which are so shocking as to be almost unbelievable -- never see the light of day and become news stories. It happens so often that I would be willing to bet a hundred United States dollars that your local police department has some not-insignificant percentage of employees (think five or ten percent) that regularly use their patrol car computers for personal reasons, or quasi-personal reasons. I've met more than one police officer personally who genuinely saw nothing wrong with it. They think that it's harmless, or worse, that they're justified in doing so because their intentions are good.

Nadboy1 8y ago

This reminds me of the Runaway Evidence episode from the Ghost in the shell series. An employee with access to the codebase for a military weapons manufacturer manipulates it for their personal reasons

fapjacks 8y ago
Indeed, this scenario is so ubiquitous that it will certainly continue happening as far into the future as there are human beings, for whatever definition of "human being" you can come up with. One of the first things I learned in the military was that many many things -- which are so shocking as to be almost unbelievable -- never see the light of day and become news stories. It happens so often that I would be willing to bet a hundred United States dollars that your local police department has some not-insignificant percentage of employees (think five or ten percent) that regularly use their patrol car computers for personal reasons, or quasi-personal reasons. I've met more than one police officer personally who genuinely saw nothing wrong with it. They think that it's harmless, or worse, that they're justified in doing so because their intentions are good.