How Asus Recovery Disks Ended Up Carrying Software Cracks

Anthony_Cargile writes "We all now know about Asus shipping illegal software cracks and confidential documents/source code on their recovery DVD (and in the system root), but this article tells exactly how it happened. It's even more careless than you think, and most likely an accident."

Comments

TFA

[Anonymous Coward]

Asus Recovery DVD scandal: How it happened
Posted by anthony Published in Security, Software

For those who havenâ(TM)t already heard, the PC OEM company Asus was involved in a major scandal where a directory on the recovery DVD and inside c:\Windows\ConfigSetRoot\ contained a software crack for the WinRar program, software serial numbers, a resume (presumably for a now-jobless Asus employee), an internal Asus powerpoint describing âoeknown compatibility issuesâ, Asus source code, and even an OEM issued Microsoft document, which mainly says âoedo not distribute DR-DOS with any computersâ.

We now know from an OEM source how exactly the files got where they did in the first place, and it isnâ(TM)t very surprising.

An Asus representative said they would be investigating the matter, and while someone is still going to lose their job over this just so Asus can say so, the way the files made it to thousands of PCs is pretty common.

An OEM employee (name not mentioned here) discussing the matter said that during the vista installs, the generic vista disc installing the OS looks for an XML file (unattend.xml) on a flash drive, and upon finding it the installation parses it and runs the XML code as installation instructions so nobody has to go through the installation menu for the hundreds of synchronous installations (hence the unattend).

BUT⦠there is another twist: If a certain tag or attribute is present, all files other than unattend.xml itself on the flash drive will be copied to c:\windows\configsetroot - see the connection?

So apparently an Asus employee happened to have a personal flash drive, and stored his resume (presumeably, conspiracy theorists may disagree) as well as a few âharmlessâ(TM) keygens and serials on it as well, in his defence in case maybe he lost the serial to winrar or other programs. Apparently the same employee used the flash drive to store or back up confidential Asus documents and source code, as well.

So if the Asus internally distributed unattend.xml file was copied to this unnamed (and jobless) employeeâ(TM)s personal flash drive, and included the xml tag/attribute to copy over everything to the system root and, therefore, recovery DVD as well, then voila! Then the only way somebody could come under fire because of this is because of oh, I donâ(TM)t know, not checking the installation root once everything was installed!

So now we know HOW exactly this whole ordeal was started, and there is a lesson to be learned hereâ¦. somewhere.

Re:This doesn't explain everything

[Anonymous Coward]

As an employee of an OEM that does these installs all day long, I can say they really messed up. Using an unattend.XML from a flash drive is BAD. Using a USB drive that has anything else on it is WORSE. Having illegal software and ND docs on the MFG floor, on an unsecure USB drive, next to your install scripts, is enough to get you FIRED.

And to other comments...Yes, we do look at nearly EVERY SINGLE FILE, including c:\Windows\ConfigSetRoot\. If you send out for 100k recovery DVDs, you want to make sure they are correct.

Re:I'm curious about that anti DR-DOS document

[Orion Blastar]

Here is a reference to that but Microsoft made sure the original articles got scrubbed off the Internet. There were things Microsoft did to GEOS, GEM, the Amiga, the Atari ST, Vision, Desqview, etc to discourage OEMS and hardware and software makers from supporting them and only supporting Microsoft products like MS-DOS and Windows instead. Microsoft did the same thing to IBM over OS/2. But most of the articles about that Microsoft had scrubbed off the Internet.

The history of the Amiga clearly shows its 8-bits roots with the Atari 2600 and Atari 400/800 series that evolved into the Amiga eventually, parallel to the Macintosh.

In the 1990's PC OEMS were fighting over the Amiga, but were loyal to Microsoft. But Microsoft used the same tactics against the Amiga that they used against DR-DOS, and killed the Amiga by leveraging what OEMS could and could not do and then Gateway had to sell the Amiga division to make Microsoft happy.

"The press attention to the Microsoft case reveals their relationship with Gateway. Jim Von Holle, a former Gateway employee, describes how the company tried to punish Gateway for the type of software they shipped. Although largely in the background, it became increasingly clear why Gateway chose to develop an alternative to the Windows market. Unfortunately, just a few months later Gateway's relationship with Microsoft regarding their set-top box would have a dramatic effect upon Amiga's plans. Who could have guessed Microsoft would play a major role in the Amigas downfall?"

I have said it before, but my comments got rated down as troll, by rapid Apple and Microsoft fanboys who hate the Amiga. This time I found the links that prove it.

It was not just DR-DOS that Microsoft murdered, but the Amiga as well. Apple had a hand in it by forcing Apple dealers to lose their license if they sold Amiga computers as well as Macintoshes. Then later Apple killed the Apple Dealers and did the store within a store and web store to sell Macintoshes as revenge on Apple dealers that still tried to sell Amiga One and Classic Amiga computers along with Macs.