TechCrunch: ASUS was warned of hacking risks months ago, but did nothing about it

Topic

New Reply

A fiery condemnation from Zack Whittaker at TechCrunch: A security researcher warned Asus two months ago that employees were improperly publishing pas
[See the full post at: TechCrunch: ASUS was warned of hacking risks months ago, but did nothing about it]

2 users thanked author for this post.

Elly, PhotM

Reply | Quote

Replies

woody wrote:

ASUS was warned of hacking risks months ago,
A security researcher warned Asus two months ago that employees were improperly publishing passwords in their GitHub repositories that could be used to access the company’s corporate network.

A day after the ShadowHammer attack was notified to ASUS by Kaspersky (and 3-8 months after the actual attacks).

 

woody wrote:

but did nothing about it
One password, found in an employee repo on the code sharing, allowed the researcher to access an email account used by internal developers and engineers to share nightly builds of apps, drivers and tools to computer owners.

“Six days later, he could no longer log in to the mailbox” (eight weeks ago now).

Doesn’t sound much like “did nothing about it” to me.

 

Reply | Quote

(Just to be clear, those are Zack’s words, not mine.)

Reply | Quote

Zack didn’t say, “but did nothing about it“.

He did say, “A day after we alerted Asus to the researcher’s email, the repos containing the credentials were pulled offline and wiped clean.”

Reply | Quote

“This specific security breach wasn’t directly responsible for the ShadowHammer infiltration, but it demonstrates an incredible lack of concern over simple security procedures.”

Three months ago I bought an Asus router (RT-AC68U), but hesitated due to the company’s history of a lax attitude toward router security issues, including failing to keep customers apprised of threats (see link). Asus had even received warnings from the FTC regarding this.   While the router has performed beautifully thus far, it appears that attitude persists — across products —  and I’m now wondering if getting the Asus router was a mistake.

Computerworld – Asus router warnings on privacy and security

Reply | Quote