As many as 1 million users of computers made by AsusTek Computer Inc. may have been infected with malware after hackers infiltrated the company and planted it in an automatic security update.

First detected and revealed today by security researchers at Kaspersky Lab, the hack — described as one of the biggest supply-chain incidents ever — involved unknown hackers modifying the ASUS Live Update Utility to insert Trojan malware that allowed them to gain access to any infected ASUS computer.

“The trojanized utility was signed with a legitimate certificate and was hosted on the official ASUS server dedicated to updates, and that allowed it to stay undetected for a long time,” the researchers noted. “The criminals even made sure the file size of the malicious utility stayed the same as that of the original one.”

The malware affected ASUS users between June and November 2018 who had enabled the ASUS Live Update utility on their systems. The update software is installed on ASUS computers as standard but is not always turned on.

According to data from Statistica, ASUS ships about 4 million computers per quarter, meaning that an infection number of about 1 million users is relatively low.

Mike Jordan, senior director at The Shared Assessments Program told SiliconANGLE that supply-chain cybersecurity threats from software update mechanisms can be particularly devastating.

“This is a very similar method that the NotPetya malware used to cause over a billion dollars in costs and counting by hacking a third party’s software,” Jordan said. “It’s becoming increasingly important that companies add reviews of their third-party software vendors’ software update mechanisms as part of their due diligence procedures.”

Jordan added that the program’s members are discussing how to best address these threats in our working groups, especially operational technology risks to the plant floors of manufacturing, utility and energy companies. “We’ve found that the best way to address these kinds of third-party risks is by working together with all parties, including the purchasers, the vendors and the service providers that service and secure them,” he said.

Photo: Kaspersky