One-Click RCE in Asus's Preinstalled Driver Software

Post by bayindirh » Mon, May 12, 2025, 10:16 AM UTC

ycombinatrix wrote: post #195

jeroenhd wrote: post #100

Earlier quoted context omitted.

I think ASUS' turnaround time on this was quite good, I don't see the problem here. ASUS didn't deny the bug, didn't threaten to prosecute anyone for reverse engineering their software, and quickly patched their software. I have no doubt that before the days of responsible disclosure, this process would've taken months and might have involved the police. Normal people don't care about vulnerabilities. They use phones…

>They say “This issue is limited to motherboards and does not affect laptops, desktop computers”, however this affects any computer including desktops/laptops that have DriverHub installed >instead of them saying it allows for arbitrary/remote code execution they say it “may allow untrusted sources to affect system behaviour”. Sounds like Asus did in fact deny the bug.

Post by jeroenhd » Mon, May 12, 2025, 10:36 AM UTC

buzer wrote: post #165

jeroenhd wrote: post #100

Earlier quoted context omitted.

I think ASUS' turnaround time on this was quite good, I don't see the problem here. ASUS didn't deny the bug, didn't threaten to prosecute anyone for reverse engineering their software, and quickly patched their software. I have no doubt that before the days of responsible disclosure, this process would've taken months and might have involved the police. Normal people don't care about vulnerabilities. They use phones…

> Stores are not permitted to sell products with known vulnerabilities under new cybersecurity regulations. What are the specifics on that? Like does the vulnerability need to be public or is it enough if just the vendor knows about it? Does everyone need to stop selling it right away if new vulnerability is discovered or do they some time patch it? I'm pretty sure software like Windows almost definitely has some unf…

    ‘vulnerability’ means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat;
    ‘cyber threat’ means a cyber threat as defined in Article 2, point (8), of Regulation (EU) 2019/881;
    ‘cybersecurity risk’ means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident;

Post by holowoodman » Mon, May 12, 2025, 11:31 AM UTC

chii wrote: post #219

holowoodman wrote: post #199

Earlier quoted context omitted.

Spectre/Meltdown is the perfect example of a vendor, Intel and AMD, deflecting blame onto the OS and software producers, successfully avoiding a recall, avoiding refunds for decreased performance and avoiding most of the blame. What actually should have happened there is a full recall of all affected hardware. Microcode fixes and payments for lost performance in the mean time, until the new hardware arrives. Meltdown…

There is no world in which a recall (and/or a refund) is ever possible. Until it is demonstrated that such flaws are a life and death fault, no regulation is possible for such flaws (unlike cars - which do have such recalls for faults that have life and death implications).

Post by jillyboel » Mon, May 12, 2025, 11:42 AM UTC

jeroenhd wrote: post #100

IlikeKitties wrote: post #17

Responsible Disclosures and their consequences have been a disaster for the human race. Companies need to feel a lot more pain a lot more often in order for them to take the security of their customers a lot more serious. If you just give them month to fix an issue and spoon-feed them the solution it's just another ticket in their Backlog. But if every other security issue becomes enough news online that their CEOs a…

I think ASUS' turnaround time on this was quite good, I don't see the problem here. ASUS didn't deny the bug, didn't threaten to prosecute anyone for reverse engineering their software, and quickly patched their software. I have no doubt that before the days of responsible disclosure, this process would've taken months and might have involved the police. Normal people don't care about vulnerabilities. They use phones…

Post by MrBuddyCasino » Mon, May 12, 2025, 11:55 AM UTC

jeroenhd wrote: post #234

Polizeiposaune wrote: post #203

Earlier quoted context omitted.

"Stores are not permitted to sell products with known vulnerabilities under new cybersecurity regulations." Do stores have to patch known vulnerabilities before releasing the product to customers or can customers install the patch?

I believe it's okay to let customers install the patch. The regulation itself can be found here: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML Basically, the manufacturer has to issue a patch, and the distributor has to ensure that the patch is available before selling the vulnerable devices. Without secure software, the product is essentially CE-incompliant, which means it practically isn't allowed to be sold.…