I've been reading about ShadowHammer over the last couple of days:

Kaspersky researchers estimated half a million Windows machines received the malicious backdoor via ASUS' update server. But the attack appeared intended for approximately 600 of the affected PCs.

Is it known whether there any exposure to this on, say, Ubuntu? If not, I'm trying to understand if there's a particular reason why not other than it wasn't attempted.

  • Does ASUS install their own software on Ubuntu computers they sell in the first place? – Daisetsu Mar 27 '19 at 16:47
  • 1
    Look at the comment on this compatibility page. It seems ASUS isn't working with Canonical to make Ubuntu systems out of the box certification.ubuntu.com/desktop/models/… – Daisetsu Mar 27 '19 at 16:50
  • @Daisetsu I'm not sure I follow you (link is helpful). I'm not sure it matters if ASUS installed the OS. It's where BIOS UEFI and driver updates are pulled from. Looks like that's not ASUS? – JimmyJames Mar 27 '19 at 17:10
  • ShadowHammer was distributed by software designed by ASUS, which checked for updates from ASUSs update server. The updates weren't installed by Windows Update. This means the victims were running the OS which ASUS installed out of the box. Here's a description of the software "The Asus Live Update software is designed to look for new versions of the programs released on the Asus website and then automatically update a PC’s BIOS, drivers, and applications." – Daisetsu Mar 27 '19 at 17:41
  • @Daisetsu Right. I understand that. The question is more why the impact seems to only be with the Windows distribution chain. I think you have indirectly answered that: ASUS isn't involved in the linux distribution chain for ASUS drivers. If you put in in an answer, I will likely accept it (after a reasonable period) – JimmyJames Mar 27 '19 at 17:58

The software (Asus Live Update) which downloaded and installed the malicious code was written by ASUS to run on their Windows products. The goal was to automatically look for new versions of programs released on the ASUS website and update the BIOS, drivers, and applications. The update server was compromised, and malicious code was distributed signed with ASUS certificates.

ASUS Live Update was installed by the OEM as part of the Windows OS. ASUS doesn't sell computers with Ubuntu installed from the factory, so anyone running Ubuntu wouldn't have the effected software.

That limits exposure to drivers and BIOS firmwares provided by ASUS. It doesn't appear that ASUS offers Linux specific drivers for their laptops/desktops. A BIOS update though could still be effected if the malicious firmwares made their way into the APT sources.

EDIT: I looked into this a but more and it was the update software itself that was backdoored. The malicious software was hosted on liveupdate01s.asus[.]com and liveupdate01.asus[.]com ASUS update servers. This implies those servers were intended only for the Windows application. https://securelist.com/operation-shadowhammer/89992/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.