One-Click RCE in Asus's Preinstalled Driver Software

Post by Arnavion » Mon, May 12, 2025, 5:27 AM UTC

oynqr wrote: post #220

Arnavion wrote: post #172

Earlier quoted context omitted.

Asrock (sub-brand of Asus but seemingly independent in the product and dev side) has been fine for me over the ~10 years I've bought their mobos. There was the thing a few months ago with X870 mobos that were apparently frying CPUs, but I think that was not sufficiently proven to be their fault? That said, in their X670 / B650 they have the same setting as what this article is about, and it could be equally as broken…

Asus and AsRock are separate since 2010.

Post by aspenmayer » Mon, May 12, 2025, 6:43 AM UTC

Polizeiposaune wrote: post #203

jeroenhd wrote: post #100

Earlier quoted context omitted.

I think ASUS' turnaround time on this was quite good, I don't see the problem here. ASUS didn't deny the bug, didn't threaten to prosecute anyone for reverse engineering their software, and quickly patched their software. I have no doubt that before the days of responsible disclosure, this process would've taken months and might have involved the police. Normal people don't care about vulnerabilities. They use phones…

"Stores are not permitted to sell products with known vulnerabilities under new cybersecurity regulations." Do stores have to patch known vulnerabilities before releasing the product to customers or can customers install the patch?

Post by v3ss0n » Mon, May 12, 2025, 7:44 AM UTC

stavros wrote: post #36

holowoodman wrote: post #28

Earlier quoted context omitted.

"Responsible" disclosure is paradoxically named because actually it is completely irresponsible. The vast majority of corporations handle disclosures badly in that they do not fix in time (i.e. a week), do not attribute properly, do not inform their users and do not learn from their mistakes. Irresponsibly delayed limited disclosure reinforces those behaviors. The actually responsible thing to do is to disclose immed…

I make software. If you discover a vulnerability, why would you put my tens of thousands of users at risk, instead of emailing me and have the vulnerability fixed in an hour before disclosing? I get that companies sit on vulnerabilities, but isn't fair warning... fair?

Post by rendaw » Mon, May 12, 2025, 8:22 AM UTC

nubinetwork wrote: post #213

Gys wrote: post #4

> I asked ASUS if they offered bug bounties. They responded saying they do not, but they would instead put my name in their “hall of fame”. This is understandable since ASUS is just a small startup and likely does not have the capital to pay a bounty. :(

> Asus is just a small startup I'm not sure where they got that from, Asus have been making motherboards and other pc parts since at least the 90s...

Post by robertlagrant » Mon, May 12, 2025, 9:12 AM UTC

holowoodman wrote: post #164

ang_cire wrote: post #126

Earlier quoted context omitted.

Yep. People keep pushing this false dichotomy that it's either company-directed 'responsible disclosure', or it's "release full working POC and complete writeup publicly, immediately", and there's no middle ground. Yes, limited disclosure will make people start hunting for the vuln, but it's still more than enough time for me to revoke an API key, lock down an internet-facing service, turn off my Alexa (no, I don't/w…

Knowing a half-truth is as bad as knowing nothing. Half the time I will do useless mitigations because actually I would have been unaffected. The other half I will do the wrong thing because of incomplete reporting.