Slashdot Mirror
ASUS Delivers Its Updates Over HTTP With No Verification (softpedia.com)
The top five PC sellers have big security holes in the third-party tools which updates their software. Now Softpedia follows up with a report that "The ASUS LiveUpdate software that comes pre-installed on all ASUS computers downloads critical BIOS and UEFI updates via plaintext HTTP and installs them without verifying the content's source or validity." An anonymous reader shares this report from developer Morgan Gangwere: "Content is delivered via ZIP archives over plain HTTP, extracted into a temporary directory and an executable run as a user in the "Administrators" NT group ("Highest Permissions" task scheduler).
Softpedia adds that "The attackers wouldn't even need to mess around modifying low-level firmware code because the update process would launch anything you throw at it. This includes spyware, backdoors, remote access trojans, and anything an attacker would wish."
Softpedia adds that "The attackers wouldn't even need to mess around modifying low-level firmware code because the update process would launch anything you throw at it. This includes spyware, backdoors, remote access trojans, and anything an attacker would wish."
What about the following:
1. The manufacturer publishes the updated firmware on their website
2. The manufacturer notifies the OS vendors
3. The OS vendors put the updated version of the firmware into their software repos
The manufacturer doesn't have to reinvent any wheel here, and the update process is as secure and as convenient as the normal OS update process is for the OS you are using.
1) Brand loyalty like sports team;
2) Unsolicited desire to talk about anal sex;
3) Condescending tone -
Apple user detected.
And what about all the people that suffer from the botnets created by this vulnerability?
In the absence of industry self-policing, maybe a couple of lawsuits over consequential damages resulting from such incompetent security design would help Asus understand what to do next...
I mean, maybe you don't expect these kinds of manufacturers to have the security and hardware/software design teams of an Apple or IBM (or the sense of responsibility), but cmon this is ridiculous.
If you can build a mass market laptop, you have the talent to implement a secure install process at least that an above-average high school programmer could write, and would make a second rate undergraduate project at best.
My conclusion must therefore be that this is intentional: because those who control the company, for whatever reason, desire an environment where the user enjoys no security.
Or have at least created an environment where both a white hat and US-CERT are told to "go away."
asus is taiwanese. i doubt that they have a whole lot of love for "the usual Chinese MO".
"They were pure niggers." – Noam Chomsky
jojoba oil is used in a lot of things, both industrial and cosmetic.
"They were pure niggers." – Noam Chomsky
They certainly have the resources to hire people who understand security, but most companies don't. Here's something you might not expect to hear from a security professional such as myself - most companies probably SHOULDN'T hire a security expert. So they don't.
Why would I say perhaps they shouldn't hire someone like me? Because it doesn't take 40 hours a week for me to say "serve the update over TLS and sign the file". I could protect them from this level of stupid in 1 hour, the other 39 hours they don't really NEED a security expert.
IMHO what most companies should probably do is invite a security professional to join a web conference or meeting for 30 minutes to an hour at an early stage of a new software project, as the requirements are being firmed up. At this stage I'd hear "download updates" and I'd speak up.
Then invite your security pro back as the design as finalized, then once more just before release. In no more than three hours a security pro could avoid this type of egregious mistake, while also pointing out a couple of areas that affect reliability (which is also part of security).
This could cost $1,000 per project or even less if you engage your securiry pro on a regular basis. So you get 80% of the benefit of having a security professional on staff, at less than half the cost.
I definitely recall boards that needed bios updates to support new generation of cpu.
The other day my computer restarted from a power outage while the DSL connection was down, which means my annoying AT&T/Uverse modem eats all port 80/www traffic to redirect t its 'DSL Failed to Connect' HTML page.
Imagine my astonished horror to see pieces of this modem-generated page in the AVG dialog (I put the red stuff in). The firewall 'button' on the product's main screen, and the dynamic ad it places on the bottom, also the notification it puts on the bottom-right of the screen on boot.
So AVG is doing unencrypted HTTP to get its advertisements and HTML on-screen widgets. Click here to see their fake 'button' for the firewall which was visible to Wireshark. I understand when shareware does this... but AVG? An actual button on their product screen? WTF!
I hope someone from AVG who knows security reads this because I let them know about this systemic problem it and they started asking me irrelevant questions about my setup.
<blink>down the rabbit hole</blink>
This updater may be broken and insecure, but why the hell would anyone trust an automatic updater to do stuff like BIOS or UEFI updates?
This is like trusting a child with a handgun to play with and being shocked when someone gets shot.
If there's an update like that, the user should be notified, and if so inclined, should go see if it's something they want to install at a time of their choosing. Perhaps first backing up your current BIOS or UEFI and perhaps doing a data backup too, just in case. Because, you know, updates like that have been known to brick systems. They really should not be done unless there is an actual problem that will actually be solved by the update. But generally, leave the damn thing alone especially if you don't know what you are doing.
And if you do that, then these other problems are solved because the ASUS app or whatever doesn't have authority to update. Just uninstall it. Solved.
Sig for hire.
This is why the Next Generation of Open Source *has* to be hardware.
It is insane how much trust we still place in component manufacturers / assemblers that can easily be lazy, incompetent, compromised by TLAs of every country, or all three.
Sophos Antivirus's AutoUpdate feature flows over HTTP. This has been a known issue since 2013 and Sophos doesn't care.
I am familiar with the old model, used by most large corporations. How well has that been working?
I'm also familiar with what I've been DOING for the last 20 years, a model that is commonplace in certain sectors.
> you won't get anyone that's not completely useless to sign on for that. ...
> *I have no idea what your security expertise might be, but you clearly know jack about consulting.
If you haven't been paying attention to Slashdot comments over the years, you can use Google to check out my credentials. You CAN then call me and discuss a project. No, I won't fly out to California to discuss my services; telephones were invented a long time ago, we can have a discussion that way. No, I won't come in for an interview. If you've been referred to me, you can trust that referral or not. No, I won't be paid six months from now, I take Visa, Mastercard, Amex and Paypal, or a retainer check ahead of time. Yes, I will give you my full attention for 45 minutes, think over your project this evening, and email my suggestions tomorrow, for $250.
https://en.wikipedia.org/wiki/...
Jojoba oil Listeni/hhob/ is the liquid produced in the seed of the Simmondsia chinensis (Jojoba) plant, a shrub, which is native to southern Arizona, southern California, and northwestern Mexico.
Not sure what Wikipedia article you read, but I don't see anywhere in there a mention of goat nuts.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?