According to the researcher, Asus employee left password in a repository on code sharing platform Github, which gave hackers access to the company’s corporate network.
Go from OpenAPI-to-GraphQL in 2 minutes
Create GraphQL interfaces in minutes and build mobile or client apps quicker. Leverage free, open source IBM Code Patterns.
Click here to know more
Asus is being held responsible for the attack on its software update utility that was hacked to install malware on thousands of computers. A researcher has claimed that an Asus employee left passwords on code-sharing platform GitHub that gave hackers access to company’s corporate network. Moreover, it is also being claimed that the Taiwanese tech company was warned two months before the attack was executed.
Citing a security researcher, who goes by name SchizoDuckie, Tech Crunch reported that Asus was warned two months ago that employees were “improperly publishing passwords in their GitHub repositories” that could be used to access the company’s corporate network. A password was found in an employee repo which allowed the researcher to access an email account used by internal developers and engineers to share nightly builds of apps, drivers and tools to computer owners.
The researcher claims that the repo in question was owned by an Asus engineer who left the email account’s passwords publicly exposed for at least a year. “It was a daily release mailbox where automated builds were sent,” the researcher was quoted as saying. He also said that the emails in the mailbox of that employee had the exact internal network path where drivers and files were stored, which apparently made it easy for attackers to execute the plan.
“All you’d need is send one of those emails with an attachment to any of the recipients for a real nice spearphishing attack,” he said, adding, “Companies have no clue what their programmers do with their code on GitHub.” TechCrunch claims that a day after the company was alerted about the researcher’s email, the repos containing the credentials were pulled offline and wiped clean. However, Asus spokesperson Randall Grilli said that the computer maker was “unable to verify the validity” of the claims in the researcher’s emails.
Asus has already released a fix for the issue. “We have updated and strengthened our server-to-end-user software architecture to prevent similar attacks from happening in the future. Additionally, we have created an online security diagnostic tool to check for affected systems, and we encourage users who are still concerned to run it as a precaution,” Asus told Digit in a statement.
Digit caters to the largest community of tech buyers, users and enthusiasts in India. The all new Digit in continues the legacy of Thinkdigit.com as one of the largest portals in India committed to technology users and buyers. Digit is also one of the most trusted names when it comes to technology reviews and buying advice and is home to the Digit Test Lab, India's most proficient center for testing and reviewing technology products.
We are about leadership-the 9.9 kind! Building a leading media company out of India.And,grooming new leaders for this promising industry.