4 ms·

Does anyone know where to get and verify a known good version if Asus’s software, or identify and clean a system of backdoored software? I ask as an owner of an

Does anyone know where to get and verify a known good version if Asus’s software, or identify and clean a system of backdoored software? I ask as an owner of an Asus motherboard.

deleted 8y ago
[deleted]
Crosseye_Jack 8y ago
Depends on what the other payload did. The infected updates checked your MAC and if it matches a list of targets downloaded and executed the 2nd payload. The payload from ASUS itself seems to be pretty tame asking as you were not one of the target machines... Check you MAC here https://securelist.com/operation-shadowhammer/89992/ https://securelist.com/operation-shadowhammer/89992/ (which also contains infor about some of the payloads, apparently there was over 200 samples found by Kaspersky). If you dont match you “should” be fine. But who know where the “update” was installed to to purge it from the system. A full wipe may be in order (or wait a short while and allow the various AV engines get hold of the signatures of the first stage malware and allow them to scan your machine). If you were on the target list then who knows what the secondary payload contained... Though as it was just a small number of MAC’s targeted and if you were targeted the device maybe more valuable to you and others untouched so it can be analysed then the cost of a replacement and trying to figure out why you were targeted. As for where to get known good software. ASUS used to have an ftp site with all their stuff on it, dunno if they still do. This attack seems to be targeting the live update method so downloads from the support page for your model are probably fine... But it would be on ASUS to come clean and report on what and when got infected to be sure. They have revoked the certs used to sign the updates, you could check any downloads from ASUS to see if the cert matches just in case MS has yet to push the irrevocation to everyone or just stick with the stock drivers from MS until everything is sorted out.
- TxRedneck 8y ago
  Where are you reading that they've revoked the certs? I've not seen anything that says indicates they've done so.
  - Crosseye_Jack 8y ago
    Sorry, I was sure I read somewhere that ASUS themselves had requested the cert to be revoked but I can't find that site I read that from now to cite other than "ASUS are no longer using that cert" with Kaspersky are saying. ASUS are using a new code signing cert though, but it is dated from earlier today so maybe it was "ASUS are due to revoke the cert".

Does anyone know where to get and verify a known good version if Asus’s software, or identify and clean a system of backdoored software? I ask as an owner of an Asus motherboard.

deleted 8y ago

[deleted]

Crosseye_Jack 8y ago

Depends on what the other payload did. The infected updates checked your MAC and if it matches a list of targets downloaded and executed the 2nd payload. The payload from ASUS itself seems to be pretty tame asking as you were not one of the target machines... Check you MAC here https://securelist.com/operation-shadowhammer/89992/ https://securelist.com/operation-shadowhammer/89992/ (which also contains infor about some of the payloads, apparently there was over 200 samples found by Kaspersky). If you dont match you “should” be fine. But who know where the “update” was installed to to purge it from the system. A full wipe may be in order (or wait a short while and allow the various AV engines get hold of the signatures of the first stage malware and allow them to scan your machine). If you were on the target list then who knows what the secondary payload contained... Though as it was just a small number of MAC’s targeted and if you were targeted the device maybe more valuable to you and others untouched so it can be analysed then the cost of a replacement and trying to figure out why you were targeted. As for where to get known good software. ASUS used to have an ftp site with all their stuff on it, dunno if they still do. This attack seems to be targeting the live update method so downloads from the support page for your model are probably fine... But it would be on ASUS to come clean and report on what and when got infected to be sure. They have revoked the certs used to sign the updates, you could check any downloads from ASUS to see if the cert matches just in case MS has yet to push the irrevocation to everyone or just stick with the stock drivers from MS until everything is sorted out.

TxRedneck 8y ago
Where are you reading that they've revoked the certs? I've not seen anything that says indicates they've done so.
- Crosseye_Jack 8y ago
  Sorry, I was sure I read somewhere that ASUS themselves had requested the cert to be revoked but I can't find that site I read that from now to cite other than "ASUS are no longer using that cert" with Kaspersky are saying. ASUS are using a new code signing cert though, but it is dated from earlier today so maybe it was "ASUS are due to revoke the cert".