(Reuters) - Hackers targeted "hundreds of thousands" of Asustek computer owners by pushing a backdoor update software tool from the computer maker's own servers, cyber security firm Kaspersky Lab said
here on Monday.
Kaspersky said the attack, which took place between June and November 2018, is possibly affecting over a million users all over the world.
Cyber security firm Symantec’s spokeswoman Jennifer Duffourg also confirmed the software supply chain attack against Asustek users.
“Based on our analysis, trojanized updates via URIs were deployed by ASUS’ live update server between June and late October 2018. These updates were digitally signed using two certificates from ASUS,” Duffourg said.
The
hackers were targeting an unknown pool of users, who were identified by their network adapters’ MAC addresses, Kaspersky said.
More than 57,000 Kaspersky users installed the backdoor version of ASUS Live Update, the report said.
Kaspersky said they informed Asustek about the attack on Jan. 31, 2019. Asustek did not immediately respond to Reuters request for comment.
Hackers at convention test voting systems for bugs
Earlier, Def Con, one of the world’s largest security conventions, served as a laboratory for breaking into voting machines , extending its efforts to identify potential security flaws in technology that may be used in the November US elections.
Hackers will continue to probe the systems over the weekend in a bid to discover new vulnerabilities, which could be turned over to voting machine makers to fix.
The three-day Las Vegas-based “Voting Village” also aimed to expose security issues in digital poll books and memory-card readers.
“We see a lot of value in doing things like this. We think it’s important,” said Jeanette Manfra, assistant secretary of cybersecurity and communications at the US Department of Homeland Security, in an interview.
“The idea is, when we find things here, how do we connect them with the actual vendors and make sure that we are closing this loop back to a coordinated vulnerability disclosure process.”
Def Con held its first voting village last year after US intelligence agencies concluded the Russian government used hacking in its attempt to support Donald Trump’s 2016 candidacy for president. Moscow has denied the allegations.
Organizers have returned ahead of the November elections, in which Democrats hope to take control of the US House of Representatives. Trump’s national security team last week warned that Russia had launched “pervasive” efforts to interfere in the elections.
