A new advanced persistent threat (APT) campaign has impacted more than a million users of the ASUSLive Update Utility - an online update driver that detects new versions of the programs released on the ASUS Website and then automatically updates BIOS, Drivers, and Applications.
Kaspersky Lab researchers say that the attack, Operation ShadowHammer, targets users by injecting a backdoor into it - at least between June and November 2018. These supply chain attacks are described as among the most dangerous and effective infection vectors, increasingly exploited in advanced operations over the last few years – as seen with ShadowPad or CCleaner. It targets specific weaknesses in the interconnected systems of human, organisational, material, and intellectual resources involved in the product life cycle: from initial development stage through to the end user. While a vendor’s infrastructure can be secure, there could be vulnerabilities in its providers’ facilities that would sabotage the supply chain, leading to a devastating and unexpected data breach.
The actors behind ShadowHammer targeted the ASUS Live Update Utility as the initial source of infection, a pre-installed utility in most new ASUS computers, for automatic BIOS, UEFI, drivers and applications updates. Kaspersky Lab researchers explain in a press statement: "Using stolen digital certificates used by ASUS to sign legitimate binaries, the attackers have tampered older versions of ASUS software, injecting their own malicious code. Trojanised versions of the utility were signed with legitimate certificates and were hosted on and distributed from official ASUS update servers – which made them mostly invisible to the vast majority of protection solutions.
"While this means that potentially every user of the affected software could have become a victim, actors behind ShadowHammer were focused on gaining access to several hundreds of users, which they had prior knowledge about. Each backdoor code contained a table of hardcoded MAC addresses – the unique identifier of network adapters used to connect a computer to a network. Once running on a victim’s device, the backdoor verified its MAC address against this table. If the MAC address matched one of the entries, the malware downloaded the next stage of malicious code. Otherwise, the infiltrated updater did not show any network activity, which is why it remained undiscovered for such a long time."
Security experts identified more than 600 MAC addresses, and these were targeted by over 230 unique backdoored samples with different shellcodes. A modular approach and extra precautions taken when executing code, to prevent accidental code or data leakage, indicate that it was very important for the actors behind this sophisticated attack to remain undetected, while hitting some very specific targets with surgical precision explains Kaspersky Lab. Deep technical analysis is reported to shows that the attackers are very advanced with a very high level of development within the group.
Software from three other vendors in Asia are also reported to be backdoored with very similar methods and techniques. In a press statement, Vitaly Kamluk, director of global research and analysis team, APAC, at Kaspersky Lab, adds: "The selected vendors are extremely attractive targets for APT groups that might want to take advantage of their vast customer base. It is not yet very clear what the ultimate goal of the attackers was and we are still researching who was behind the attack. However, techniques used to achieve unauthorised code execution, as well as other discovered artefacts suggest that ShadowHammer is probably related to the BARIUM APT, which was previously linked to the ShadowPad and CCleaner incidents, among others. This new campaign is yet another example of how sophisticated and dangerous a smart supply chain attack can be nowadays,"
To avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky Lab researchers recommend implementing the following measures:
In addition to adopting must-have endpoint protection, implement a corporate grade security solution which detects advanced threats on the network level at an early stage;
For endpoint level detection, investigation and timely remediation of incidents, we recommend implementing EDR solutions or contacting a professional incident response team;
Integrate Threat Intelligence feeds into your SIEM and other security controls to get access to the most relevant and up-to-date threat data and prepare for future attacks.
Dr Darren Williams, CEO and founder of cyber-security firm, BlackFog emailed SC Media UK to comment: "The ASUS malware attack clearly demonstrates that the threat landscape we see today is infinitely more sophisticated than just a few years ago, with trusted vendors becoming unwitting perpetrators. Cyber-attacks are increasingly using fileless based techniques that leave no trace on the device. That’s why organisations need a multi-layered strategy to prevent data loss and unauthorised data collection and profiling.
"Rather than trying to identify attackers by their fingerprints, companies need to look at multiple characteristics of an attack - analysing network traffic to detect unusual behaviour and eliminating these threats before they wreak havoc within an organisation."
Kevin Bocek, VP security strategy and threat intelligence at Venafi, adds: "Code signing certificates are used to establish which updates and machines should be trusted, and they are in the applications that power cars, laptops, planes and more. Nearly every operating system is dependent on code signing, and we will see many more certificates in the near future due to the rise of mobile apps, DevOps and IoT devices.
"However, cyber-criminals see code signing certificates as a valuable target due to their extreme power. With a code signing certificate, attackers can make their malware seem trustworthy and evade threat protection systems. Unfortunately, in many organisations the protection of code signing processes falls mostly to developers who are not prepared to defend these assets. In fact, most security teams aren’t even aware if their developers are using code signing or who may have access to the code signing process. It’s imperative for organisations to know what code-signing certificates they have in use and where, especially as it’s likely we’ll see similar attacks in the future."
Kaspersky Lab says it will present full findings on Operation ShadowHammer at its Security Analyst Summit 2019, in Singapore, 9-11 April.