Asus.com Compromised With Exploit Code

Juha-Matti Laurio writes in with news that the Web site of ASUSTeK Computer (asus.com) has been compromised to spread exploit code. The original report from Kaspersky Lab claimed that the compromise lead to code exploiting the recently patched Microsoft Windows Animated Cursor (.ANI) 0-day vulnerability, but sans.org found no evidence of this. Apparently a malicious iframe was added to one of the machines in asus.com's DNS round-robin.

Re:DNS needs improvment...

[The MAZZTer]

You DO know that www. is just another subdomain, right? The only reason it's special is because most/all websites mirror <hostname> onto www.<hostname>. But it doesn't HAVE to be like that. Slashdot doesn't do it like that, for instance.

It doesn't matter if the DNS entry has www. on it or not, the address is still owned by the same person and will get directed to a machine they specified (or nowhere).

Re:I heard rumors

[bmo]

"that Investor Village was spreading some "updater.exe" the other day (via ads), so this might have been a bit larger than just the one site?"

It's spyware from an ad service. It's like those "Your computer is infected" ads on a Yahoo page.

The real carrier of the evil is dropspam.com, which pretends to be a spam filtering service. I fired up VMware and installed upgrade.exe out of morbid curiosity. The results are here:

Msg: 26529 of 26688 4/6/2007 6:57:44 AM Recs: 26 Sentiment: Not Disclosed
By: Boyle M. Owl Send PM Profile Ignore Add To Favorites
Posted as a reply to msg 26470 by sco_source_scam

Re: IV advertising malware? Dropspam.com

The tiny program is a downloader and installer. I have run it inside of VMware, the only way to run Windows...

It may be legitimate, but read on, and grok the implications of the license....

3. Licensee's Covenants
(a) The Licensee has read all information pertaining to the operation of the Software and expressly agrees that the Licensor shall be permitted to make any modifications, alterations and re-configurations to the Licensee's computer hardware and software including its email inbox and outbox as required for the normal operation of the Software, including but not limited to the re-routing of emails to the Licensor's server for the purposes of screening emails for spam and viruses and attaching a brief message promoting the Software to all out-going emails of the Licensee.

The licensor can kindly stay the fuck out of my computer, tyvm.

(b) The Licensee further agrees that the Licensor shall be permitted to send emails (Authentication Emails) on behalf of the Licensee to those email addresses which have been stored in the Licensee's computer or which appear as senders in incoming emails, for the purposes of authenticating these email addresses and providing the recipients with an opportunity to update the Licensor with additional authentic email addresses.

"We're going to examine your drive for email addresses, and then we're going to spam the shit out of your friends."

(c) If the Licensee wishes to delete or remove the Software for any reason, such deletion or removal must be carried out using either the program or software removal tool inherent in the Licensee's computer operating system including the Add/Remove tool provided by Microsoft® Windows, or such other similar program or software provided by the Licensor, which will be available to the Licensee through the Licensor's website. The Licensee acknowledges that if the deletion or removal of the Software is carried out by any other manner or by using any program or software other than those described above, the Licensee's email software or system may not be restored fully and/or may fail to start up and function properly, and as a result the Licensee may not be able to receive or send emails.

"Yeah, ya see, our program so severely fucks your system that if you try to remove us with something that might work, we'll break your smtp and pop3 server pointers."

As I wrote this, several other popups came up and want me to install shit. Ahahahah, I'm going to install all this and then I'm going to run a friend's malware scanner to see what it really does.

Ghod...this is what being a windows user is like?! I have forgotten!

--
BMO

Msg: 26531 of 26688 4/6/2007 7:18:35 AM Recs: 25 Sentiment: Not Disclosed
By: Boyle M. Owl Send PM Profile Ignore Add To Favorites
Posted as a reply to msg 26529 by Boyle M. Owl
Re: IV advertising malware? Dropspam.com

I do this shit so you don't have to...

Up until I installed upgrade.exe, the system was pristine except for an installation of OpenOffice and Opera....

BTW, this is just a _part_ of the log that goes on forever...

Checking system programs...

Checking Windows directory contents...
c:\windows\appupdate.exe: Version info not found (Suspicious)
c:\windows\ewwsetup.exe:

not the least bit surprised

[Indy1]

Most of the motherboard oem's use IIS for their web sites. They tend to be incredibly slow, go down all the time, and often render poorly (or not at all) on anything other then IE.

All signs of poor admins.

Re:not the least bit surprised

[GeRM_007]

I was on their site last weekend, looking for a new BIOS and drivers. Their support web server was completely down. I called up to complain, and their tech support told me that they are aware of it, and have been having problems with it for a couple weeks now as they are changing their infrastructure. A couple weeks!!! Even their tech support couldn't access it, or even tell me what the BIOS version number was. This compromise is probably a result of an incorrectly configured server, which is a result of incompetent admins. All this results in them losing me as a customer. Good riddance Asus.

Re:I heard rumors

[bmo]

"You should put the virtual disk under version control."

VMware does that. To clean the virtual machine, you can pick any of the older images. I was asked if I tried uninstalling using the spyware company uninstaller and I said no. I picked the April 1 image out of a perverted sense of humor.
--
BMO

Re:Asus Site Is Always A Mess Anyway

[madclicker]

I second that. They use M$ ftp servers with download speeds of 7MB per second. They have an issue since 2000 and never been able to fix their website. What a shame for a company that deals with technology. The funny thing is on their download site they have four locations like: Global, USA, China, Europe, Japan, but all are coming of the same subnet. Morons.

It's not a DNS error-- it's a html page error

[postbigbang]

The Kapersky source material is poorly written. Dig was used to compare DNS servers, but the actual problem was a round-robin home page with outreaching code with little presents inside. At first glance, it sounded like a DNS exploit but it's not-- it's a good old fashion page re-write. DNS has nothing to do with it.

Re:Advice

[Anonymous Coward]

"The script at the time we looked at it was obfuscated and leads to a VBscript"

so only IE users need to worry.

SANS DID find evidence of an ANI exploit:

[I)_MaLaClYpSe_(I]

From isc.sans.org [sans.org]:

UPDATE #2: That second javascript referred in the vbscript above didn't decode, it seems it's just not encoded right, but when decoding the string with a plain base64 routine, it does decode to what leads to an ANI exploit. You never know what a buggy script and a buggy browser do together.

Re:Advice

[Plutonite]

If you visited their website using IE then yes (and insert a lot of jeering here for using IE) be very concerned. Firefox is immune because it's the IE rendering engine that is exploited.

That said, your file explorer on windows also uses the said engine, so any files you download are a threat as soon as you browse to their location. If you have put these files somewhere you know of, try using the windows shell to move them into a directory you don't like to go to very often. Then wait until spyware/anti-virus removers get updated and you are "safe".

Re:I'm shocked... SHOCKED!

[Flendon]

Asus is known for their site being down for days at a time, having horrendous javascript, and often breaking in firefox. They are also known for having an unresponsive customer service. The most common answer you get is "look at our forums", yet their own forums indicate the problem is known and unresolved. To pick just one issue I've had with them as an example, due to their buggy firmware my DVD+-RW was recognized as a CD-R for over a year before they finally fixed it, with hundreds of people claiming the same problem. And, even then the firmware update could only be installed using a floppy drive (in 2006!) and required a third party bios flasher. No, this is par for the course with Asus and I laughed when I received my ISC newsletter.