31–40 of 200 posts
This means I can basically go to a Starbucks and pwn the Asus there, right? I have an Asus now but installed Ubuntu first thing when I got it. If I couldn't use Ubuntu I'd use Mac. I see the problem has two sides, Windows for allowing for malware preinstalled and OEM for installing it.
Things wouldn't be much different if they shipped Ubuntu preinstalled.
I hope this incident will push them towards https for all their http offerings. There really is no excuse anymore, its can be gratis and automated.
Worst-case, they might have implemented this like this:
DownloadNewUpdatesIntoUpdateDirectory();
ProcessWhateverYouFindInTheUpdateDirectory();
Out of curiosity, how would an attacker exploit this to run a code s/he wants? Try to direct the DNS requests to their own server instead of the LiveUpdate one? If so, how? Also, would we be a better design? Hard-code IP addresses to prevent the DNS trick? Use HTTPS and hardcode the public key of the server on every machine? (Only asking out of curiosity, clearly.. Seems like a good case study for designing things ri…
I fear that, as a bonus, there is a race condition where a local attacker can replace any update with its own 'update' between download and installation. Worst-case, they might have implemented this like this: DownloadNewUpdatesIntoUpdateDirectory(); ProcessWhateverYouFindInTheUpdateDirectory(); If that's the case, you would only need to copy a payload to that directory.
Damn ASUS that's a real shame, because that Royal Blue Zenbook 3 is god damn sexy https://www.asus.com/Notebooks/ASUS-ZenBook-3-UX390UA/
Doesn't it affect only those who run Windows with this ASUS LiveUpdate thing installed? But perhaps you meant that you must now, as a protest, shun ASUS products. I can sympathise with that.
I fear that, as a bonus, there is a race condition where a local attacker can replace any update with its own 'update' between download and installation. Worst-case, they might have implemented this like this: DownloadNewUpdatesIntoUpdateDirectory(); ProcessWhateverYouFindInTheUpdateDirectory(); If that's the case, you would only need to copy a payload to that directory.
Earlier quoted context omitted.
It's hard to make a case for long term support of commodity hardware sold into the consumer market because the most shiny things at the lowest first tends to drive purchases. It's as true for laptops as it is for Android phones. BestBuy doesn't care if it stocks ASUS or not. It cares about sales and margins. If there's an extra dollar putting Gateway on the shelf instead of ASUS they will. And their customers won't c…
True but it creates business for ThinkPad and I'm loyal to them. They fupped too though
Earlier quoted context omitted.
Things wouldn't be much different if they shipped Ubuntu preinstalled.
How so? It's not my distro of choice, but I'm pretty sure there aren't any known remote root code execution exploits.