According to the researcher, Asus employee left password in a repository on code sharing platform Github, which gave hackers access to the company’s corporate network.
Highlights:
- A researcher blames Asus for attack on their software update utility.
- He claims that company employees shared passwords on Github which gave hackers access to company’s corporate network.
- Apparently, Asus got a heads up two months before the attack was executed.
Asus is being held responsible for the attack on its software update utility that was hacked to install malware on thousands of computers. A researcher has claimed that an Asus employee left passwords on code-sharing platform GitHub that gave hackers access to company’s corporate network. Moreover, it is also being claimed that the Taiwanese tech company was warned two months before the attack was executed.
Citing a security researcher, who goes by name SchizoDuckie, Tech Crunch reported that Asus was warned two months ago that employees were “improperly publishing passwords in their GitHub repositories” that could be used to access the company’s corporate network. A password was found in an employee repo which allowed the researcher to access an email account used by internal developers and engineers to share nightly builds of apps, drivers and tools to computer owners.
The researcher claims that the repo in question was owned by an Asus engineer who left the email account’s passwords publicly exposed for at least a year. “It was a daily release mailbox where automated builds were sent,” the researcher was quoted as saying. He also said that the emails in the mailbox of that employee had the exact internal network path where drivers and files were stored, which apparently made it easy for attackers to execute the plan.
“All you’d need is send one of those emails with an attachment to any of the recipients for a real nice spearphishing attack,” he said, adding, “Companies have no clue what their programmers do with their code on GitHub.” TechCrunch claims that a day after the company was alerted about the researcher’s email, the repos containing the credentials were pulled offline and wiped clean. However, Asus spokesperson Randall Grilli said that the computer maker was “unable to verify the validity” of the claims in the researcher’s emails.
Asus has already released a fix for the issue. “We have updated and strengthened our server-to-end-user software architecture to prevent similar attacks from happening in the future. Additionally, we have created an online security diagnostic tool to check for affected systems, and we encourage users who are still concerned to run it as a precaution,” Asus told Digit in a statement.
Related Read:
NotPetya is a wiper, not ransomware: Here's what that means
4% of Indian users attacked by banking Trojans in 2018: Kaspersky Lab
Follow Us
Digit NewsDesk
Digit News Desk writes news stories across a range of topics. Getting you news updates on the latest in the world of tech. View Full Profile
