How Asus Recovery Disks Ended Up Carrying Software Cracks
Anthony_Cargile writes "We all now know about Asus shipping illegal software cracks and confidential documents/source code on their recovery DVD (and in the system root), but this article tells exactly how it happened. It's even more careless than you think, and most likely an accident."
Asus Recovery DVD scandal: How it happened
Posted by anthony Published in Security, Software
For those who havenâ(TM)t already heard, the PC OEM company Asus was involved in a major scandal where a directory on the recovery DVD and inside c:\Windows\ConfigSetRoot\ contained a software crack for the WinRar program, software serial numbers, a resume (presumably for a now-jobless Asus employee), an internal Asus powerpoint describing âoeknown compatibility issuesâ, Asus source code, and even an OEM issued Microsoft document, which mainly says âoedo not distribute DR-DOS with any computersâ.
We now know from an OEM source how exactly the files got where they did in the first place, and it isnâ(TM)t very surprising.
An Asus representative said they would be investigating the matter, and while someone is still going to lose their job over this just so Asus can say so, the way the files made it to thousands of PCs is pretty common.
An OEM employee (name not mentioned here) discussing the matter said that during the vista installs, the generic vista disc installing the OS looks for an XML file (unattend.xml) on a flash drive, and upon finding it the installation parses it and runs the XML code as installation instructions so nobody has to go through the installation menu for the hundreds of synchronous installations (hence the unattend).
BUT⦠there is another twist: If a certain tag or attribute is present, all files other than unattend.xml itself on the flash drive will be copied to c:\windows\configsetroot - see the connection?
So apparently an Asus employee happened to have a personal flash drive, and stored his resume (presumeably, conspiracy theorists may disagree) as well as a few âharmlessâ(TM) keygens and serials on it as well, in his defence in case maybe he lost the serial to winrar or other programs. Apparently the same employee used the flash drive to store or back up confidential Asus documents and source code, as well.
So if the Asus internally distributed unattend.xml file was copied to this unnamed (and jobless) employeeâ(TM)s personal flash drive, and included the xml tag/attribute to copy over everything to the system root and, therefore, recovery DVD as well, then voila! Then the only way somebody could come under fire because of this is because of oh, I donâ(TM)t know, not checking the installation root once everything was installed!
So now we know HOW exactly this whole ordeal was started, and there is a lesson to be learned hereâ¦. somewhere.
Damn that lipstick!
I can how an internal ASUS USB flash disk with an unattend.xml file on it, might get used to move documents around, and then also get used to install windows.
That might explain how certain documents got put on a lot of harddrives inside ASUS.
It doesn't explain how that directly ended up being part of what they made an ISO out of, and how no one apparently did quality control and checked every single file on a CD before it was replicated and sent out to the world.
butthis article tells exactly how it happened.
Don't tell me-- like everything else, it had something to do with the derivative debt instruments, mortgage-related assets, and deregulated credit market tightening.
FTA:
"c:\Windows\ConfigSetRoot\ contained a software crack for the WinRar program...
So apparently an Asus employee happened to have a personal flash drive, and stored his resume (presumeably, conspiracy theorists may disagree) as well as a few harmless keygens and serials on it.."
It amazes me that this employee chose illegal means of getting an archiving program instead of using a FOSS solution such as 7-zip ( http://www.7-zip.org/).
I know some companies have protocols for handling FOSS software, but this should have never have happened if the employee had just turned to his company's legal department for obtaining software licenses.
while(1) attack(People.Sandy);
You, sir, are bringing down the good name of anonymous cowards everywhere. For shame, sir, for shame.
"It amazes me that this employee chose illegal means of getting an archiving program instead of using a FOSS solution such as 7-zip ( http://www.7-zip.org/)."
Why should it be surprising? The idea that attitudes don't have consequences should have been debunked.
Shai Schticks:"You don't make peace with friends, you make peace with enemies"
Wow that was GOOD, you are a really talented piss & poop joke maker. Keep up the great job, send Bill Gates your resume, maybe you'll end up taking over Seinfelds place.
I am completely unsurprised. When I heard about it I thought, "Oh, some jackball inadvertently copied his personal files via some install script. That's pretty funny."
I personally have the exact same stuff on my thumb drive - my resume and some cracking tools. As we all know, nobody tests their own work. That's why testers have jobs.
So he screwed up - at least he has a good story to tell!
"It's even more careless than you think, and most likely an accident."
Not really. While the details are interesting, this is about the level of carelessness I expected.
Software cracks and other personal files somehow made it into the master ISO, and nobody caught it. We knew that already, and that fact alone implies massive carelessness by several individuals. TFA just shows the path that carelessness took.
And of course this is an accident. Unless you think Asus decided to go into the software crack business, what the hell else would it be? Someone screwed up.
I'm all for rhetoric and such, but come on--in a 2 sentence OP, 1 of those sentences shouldn't be throwaway.
I always get keygens and cracks for software I buy as a safety measure, and test them in a virtual machine to make sure they work. With all the phone home activation that software does these days I don't want to have to call a vendor and beg for access to to software I've already paid for when Windows takes a nose dive. What if the vendor doesn't support that version any more and doesn't want to give me a new activation key? What if the vendor is bought or goes out of business? If I reach that point I can at least use the keygen or crack to protect my investment.
I can't fault anyone for having keygens for their apps.
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
I have one key that is over 10 years old, that was updated by the company from an 8 digit code to a more secure 6-groups-of-5-alphanumeric code that still works.
Never needed a crack, and the key takes up a lot less space. Plus it I know it isn't a trojan program or a virus.
This issue is a bit more complicated than you think.
for using TrueCrypt (or some other derivative). Aforementioned individual wouldn't have exposed that kind of sensitive information with an encrypted volume on the thumb drive. Shoot, Vista wouldn't have "looked" for an XML file in the case of an encrypted volume in the first place! This doesn't change my love for the ASUS mobo in my desktop. Solid.
This useless space for sale, inquire at front desk.
This is disappointing. A few months back ASUS got into a flamewar with GIGABYTE. GIGABYTE came out and told Tom's Hardware that ASUS used inferior parts, changed their % gains versus their competitor without changing the product whatsoever, and that ASUS's EPU feature is software instead of hardware(meaning it is inferior to GIGABYTE). GIGABYTE did come back and appologize for claiming ASUS used inferior parts(it was found that it was a different vendor's board that contained inferior parts). ASUS threatened to sue any website that talked dirty about ASUS when this all came to light. Check out http://www.tomshardware.com/news/asus-gigabyte-motherboard,5348.html to read about the GIGABYTE versus ASUS drama. Then check http://www.tomshardware.com/news/asus-gigabyte-motherboard,5480.html for ASUS suing GIGABYTE for the bad publicity.
I have been an ASUS user for many years, building many computers with ASUS parts. While GIGABYTE did include some false claims, they did have valid complaints for their other arguements. I was one of the people that was stuck with a motherboard that cost me $250 that didn't do quite what it was supposed to do, and as a result my linux based computer cannot use their power management function(because it is software based). GIGABYTE's is hardware, and is enabled in BIOS and doesn't care which OS you use. This one hit home for me. My computer is on 24x7, and I wanted my computer to be green. Unfortunately that dream will not be a reality with ASUS hardware.
This again paints a bad picture of the quality work ASUS has been doing lately. I am sure that my next motherboard won't be ASUS. They have lost points with me, and I am going to check out one of the other top tier motherboard companies.
I have never purchased a motherboard from GIGABYTE, but I'm already looking for motherboards for Nahelem when it comes out next month, and I'm not even looking at what ASUS is offering. Bite me once, shame on you. Bite me twice, shame on me!
Reasons for leaving ASUS:
1. Changing your product efficiency % gains after shipping the product for months, AND not changing anything on the product! As if they wouldn't get caught? Competitors are always shopping their other competitors!
2. They fail to mention that EPU REQUIRES Windows to run. I don't care what ASUS says. If it requires software(Windows based at that!), then it's software based. Even if its hardware functions are enabled by using the software.
3. Suing anyone who talks about their bad publicity from GIGABYTE. WTF? Seriously, WTF? That's RIAA type behavior, and I will not tolerate that type of child in my house.
Is this something recent? Someone have one of these restore CDs to post the text? With the history of bad blood this could be a story in itself
I think he means the plural form of ass.
Coral CDN to the rescue
http://thecoffeedesk.com.nyud.net/news/index.php/archives/30
I personally have the exact same stuff on my thumb drive - my resume and some cracking tools.
What is important to learn is to learn from mistakes. Some learn from other's mistakes. Others wait till it happens to them. This is why proceedures are put into place. Often they are there to prevent common mistakes. Bypassing written proceedures is a gateway to making known types of mistakes.
Thumb drives are nice, but what exactly is your company policy regarding their use?
The one hanging on my employee badge is not treated the same as the one hanging on my keyring. Personal and professional never mix.
The truth shall set you free!
and stored his resume (presumeably, conspiracy theorists may disagree) as well as a few ÃharmlessÃ(TM) keygens and serials on it as well
... So, are you implying that you're a coincidence theorist???
Fact: Everything I say is fiction.
You insensitive clod, I'm dyslexic and that's almost exactly how I read the headline.
Has anyone else noticed he bizarre renaissance of racism going on right now? I know it's garbage trolling and I'm (sort of) taking the bait, but I don't remember Slashdot being this quick or eager to bash black people in the past. It's every thread now, right below first post!
The company should make it unpossible to mix the two. Is that even possible on a technical level, or is that just sloving a social problem with a technical solution?
Don't fight for your country, if your country does not fight for you.
All it takes is one bored idiot. Just ignore it.
Becauses it's hard to imagine anyone else posting that?
I am a Chinese, but I'm not going to cover them. Try take a look at the Taiwan manufacturer's driver ... all kinds of mistakes in the document!
The driver itself have similar problem was usual, and it truly reflect the quality control was a mess.
Not only Asus, also MSI, Gigabyte, IWILL, CMI, Realtek ... there're much more mistakes everythere!
So now we know HOW exactly this whole ordeal was started, and there is a lesson to be learned here... somewhere.
Did you check your c:\windows\configsetroot?
First rule of comedy, know your audience. Most of the world aint dyslexic, your comedy is lost to us. Would you find it funny if say... a Synesthetic joked how a article on Java programming tasted like coffee?
Hello, this is Terry, from -big company name-. We found your resume in one of our PC's... apparently, it appeared in the 'windows' folder of our newly-bought PCs.
Well, anyway, the thing is we liked your resume a lot. Can you stop by so we can talk, and maybe hire you? We'll pay you more than the value that's listed in the Excel sheet you're using to control your funds.
Yours,
Terry
Any life is made up of a single moment, the moment in which a man finds out, once and for all, who he is.
I remember the Amiga from the late 80s/early 90s, from the perspective of a gamer/private user. For a while it was superior to a similarly priced PC. But that advantage slipped away as PCs got cheaper and faster, and the supply of games also caught up to the Amiga. When I wanted a replacement for my aging C64 in 1991, the PC already looked more attractive overall. I ended up buying a 386SX then, which was equivalent or superior to the Amiga 3000 (as described on Wikipedia http://en.wikipedia.org/wiki/Amiga_3000) in most regards.
I think the Amiga lost out against the PC in the early 90s, and no further meddling was necessary on Microsoft's part to kill it.
C - the footgun of programming languages
It is possible that the (nameless, now jobless) employee actually ran a QC script that was simply fooled because it built its reference file list from the already "enhanced" ISO.
Not saying that he's not a dip---- for not knowing what's supposed to be there, but I wouldn't be surprised if he actually executed a QC script given to him by some manager who got it from an employee they haven't seen in years....
There are severe technical difficulties securing most OS against USB based drives. There are complicated registry hacks in Windows to try and prevent thumb drive access (R/W) as there doesn't seem to be a group policy to govern this.
Some computers have USB disconnected and/or plugged up to prevent access. So there is no easy technical solution.
Don't be apathetic. Procrastinate!
This is why if I buy a computer, it had better come with a genuine Microsoft Windows installation disk. I don't know what is on that recovery disk, and I don't want to find out when I'm a victim of identity theft because my installation comes with a free virus. Never mind all their crapware that I can uninstall. Viruses don't come with an uninstall. If I want an "uninstaller" it's called AntiVirus. I'm pretty sure Dell/HP/etc would be MORE than happy to sell me a copy too. Aren't they nice? First give me the problem, and then sell me the fix.
This sounds like one of those TV ads...
"But wait! There's more! Call in the next 15 mins and we'll send you a FREE virus! Yes, FREE! A $250 value, yours free!"
There's an election coming up.
I am trolling
Becauses it's hard to imagine anyone else posting that?
Not hard at all. You see racism is not due to a lack of intelligence it goes much deeper than that. So it is very possible that an otherwise intelligent person could also be a racist. So if you were to put a small amount of thought into your post instead of just typing during a Knee-Jerk reaction you might not sound like what you are accusing someone else of sounding like.
Why is it so hard to only have politicians for a few years, then have them go away?
Jew.
Here is a forum link for one poor unfortunate who managed to get a new non-Asus laptop: http://apcmag.com/Forum.htm?g=posts&t=504
Here is a screenshot of the config folder: http://img149.imageshack.us/img149/4320/8192008120604amaw4.png
So if you've got an affected Asus laptop with a few months of warranty left, you may be able to get a new non-Asus laptop for nix.
Don't be apathetic. Procrastinate!
Wow. A 2Mbps line immediately saturated *applause*. Next time, I'll be sure to mirror it elsewhere. At least it was bandwidth this time, last time when I was running this off just one server, it started paging and everything was hosed. This time the individual server loads never topped 0.1, although I'm sure this is partly because of the bottleneck :p.
And if anyone is interested in writing for thecoffeedesk.com for /. submissions, PM me or whatever we need writers.
It's possible to have no ill feelings towards any race and no desire to discriminate against anyone and still think that racial humor is funny. What's stupid are the people who get all offended and on their high horse and take this shit so damned seriously.
And they don't realize they are discriminating against the free speech of the people that are being "racist".
The problem with racism, is, until every "race" gives up their "identity", we will all be different. Period.
--Toll_Free
The sad thing is that Asus used to be fairly decent, but it does seem that their failed/buggy boards are a bit more common these days.
On the other hand, Gigabyte doesn't have much to be proud of either. Back when I used them a few years back, their boards gained a notoriety for failure, mainly due to bad capacitors, etc.
It's funny because since I've moved to cheaper boards I've had less issues with dead hardware, but even if I did I'd rather have to replace hardware that costs half the price.
strikes again.
We prefer to let people go on Fridays....
Huh?
How is babby formed?
Asus Recovery DVD scandal: How it happened
Posted by anthony Published in Security, Software
For those who haven't already heard, the PC OEM company Asus was involved in a major scandal where a directory on the recovery DVD and inside c:\Windows\ConfigSetRoot\ contained a software crack for the WinRar program, software serial numbers, a resume (presumably for a now-jobless Asus employee), an internal Asus powerpoint describing "known compatibility issues", Asus source code, and even an OEM issued Microsoft document, which mainly says "do not distribute DR-DOS with any computers".
We now know from an OEM source how exactly the files got where they did in the first place, and it isn't very surprising.
An Asus representative said they would be investigating the matter, and while someone is still going to lose their job over this just so Asus can say so, the way the files made it to thousands of PCs is pretty common.
An OEM employee (name not mentioned here) discussing the matter said that during the vista installs, the generic vista disc installing the OS looks for an XML file (unattend.xml) on a flash drive, and upon finding it the installation parses it and runs the XML code as installation instructions so nobody has to go through the installation menu for the hundreds of synchronous installations (hence the unattend).
BUT... there is another twist: If a certain tag or attribute is present, all files other than unattend.xml itself on the flash drive will be copied to c:\windows\configsetroot - see the connection?
So apparently an Asus employee happened to have a personal flash drive, and stored his resume (presumeably, conspiracy theorists may disagree) as well as a few `harmless' keygens and serials on it as well, in his defence in case maybe he lost the serial to winrar or other programs. Apparently the same employee used the flash drive to store or back up confidential Asus documents and source code, as well.
So if the Asus internally distributed unattend.xml file was copied to this unnamed (and jobless) employee's personal flash drive, and included the xml tag/attribute to copy over everything to the system root and, therefore, recovery DVD as well, then voila! Then the only way somebody could come under fire because of this is because of oh, I don't know, not checking the installation root once everything was installed!
So now we know HOW exactly this whole ordeal was started, and there is a lesson to be learned here.... somewhere.
http://forum.notebookreview.com/archive/index.php/t-245933.html
Acknowledging difference is different than racism - while there are small differences between races, our mental plasticity as humans makes it unlikely that any race is significantly different mentally than any other, and really race is an artificial distinction... We're all human, and racism is hate speech, not free speech
Acutally Slashdot covered the AmigaOS and GUI in 1999 as not being dead yet.
Apple didn't kill it, just stole the AmigaOS GUI for Mac OSX which was based on Next OpenStep which stole from AmigaDOS 1.0 Workbench 1.0 to create a GUI on top of BSD Unix so Steve Jobs and Next could copy the Macintosh by stealing the best parts of the Amiga GUI and claiming them as their own.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.