• Home
  • Laptops
  • Laptops News
  • Asus WebStorage Cloud Backup Update Service Used to Install Malware on Users’ PCs, Researchers Say

Asus WebStorage Cloud Backup Update Service Used to Install Malware on Users’ PCs, Researchers Say

The news comes just a few months after a major security flaw allowed Asus' desktop software to be used to infect up to a million PCs worldwide.

Share on Facebook Tweet Share Reddit Comment
Asus WebStorage Cloud Backup Update Service Used to Install Malware on Users’ PCs,  Researchers Say

Photo Credit: Eset

Asus' own digital signature on the infected software update.

Highlights
  • Malware researchers at Eset discovered the problem and notified Asus
  • Asus says it has put additional security measures in place
  • The WebStorage update service was not verifying digital signatures

Security researchers at Eset have reported that Asus' online WebStorage cloud service has been used to distribute malware thanks to a security flaw in the desktop client's automatic updater. By exploiting an insecure HTTP connection and faulty code signing checks, attackers were able to distribute and execute software that installs a backdoor known as Plead on affected computers. The Plead malware is a simple backdoor that infects PCs and then downloads additional malware, which is added to the Windows startup routine so that it is executed every time the infected PC is booted up.

According to Eset, the malware was discovered on computers in Taiwan belonging to its clients, and the issue could be far more widespread. Beginning in April, the company started detecting infected files being downloaded automatically onto PCs by the Asus WebStorage updater, which is a legitimate Windows background service. The attackers were able to trick the software into downloading the malware from a compromised Taiwanese government server rather than a genuine update from Asus's own servers. Asus' software was not verifying the digital signatures of the updates it received, according to Eset reseracher Anton Cherepanov.    

Eset says it notified Asus about the issue before going public with the information. In response, Asus has published a notice on its WebStorage site, saying it shut down the WebStorage update server as a precaution, and has since implemented new security measures, but recommends that users run their own virus scans immediately to be sure that they are safe.  

Eset is still investigating the case, and believes that the attackers did not use the same method as the supply-chain attack that leveraged Asus' Live Update software and potentially infected over a million users earlier this year. However, the Asus WebStorage servers are not being used as command and control servers for the new malware, and the updater continued to receive legitimate Asus files during this time. 

The more likely scenario is a man-in-the-middle method, where the attackers are able to interfere with communication between servers and computers, and substitute legitimate data for the malware. Eset researchers also suspect that compromised routers might have been used, as many of the affected clients were using Asus routers which allow remote access to their admin control panels over the Internet.

Trend Micro, another anti-malware vendor, has previously associated the Plead backdoor with a malicious group called BlackTech, which is known to have conducted online espionage in Asia.          

Comments

For the latest tech news and reviews, follow Gadgets 360 on Twitter, Facebook, and subscribe to our YouTube channel.

Further reading: Asus, Asus WebStorage, ESET
Jamshed Avari

Jamshed Avari has been working in tech journalism as a writer, editor and reviewer for over 13 years. He has reviewed hundreds of products ranging from smartphones and tablets to PC components and accessories, and has also written guides, feature articles, news and analyses. Going beyond simple ratings and specifications, he digs deep into how emerging products and services affect actual users, and what marks they leave on our cultural landscape. He's happiest when something new comes ...More

Musk to Review All of Tesla's Expenses in New Cost Cutting Plan
Huawei Mate 20 X 5G Goes Official With 5G Support, Smaller Battery, and 40W Fast Charging
 
 

Advertisement

 

Advertisement

© Copyright Red Pixels Ventures Limited 2019. All rights reserved.