Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One-Click RCE in Asus's Preinstalled Driver Software

mrbruh.com

Post reply on HN
Print view View original

61–70 of 253 posts

Re: One-Click RCE in Asus's Preinstalled Driver Software

#61

Post by SahAssar »

technion wrote: post #56
stavros wrote: post #36

Earlier quoted context omitted.

I make software. If you discover a vulnerability, why would you put my tens of thousands of users at risk, instead of emailing me and have the vulnerability fixed in an hour before disclosing? I get that companies sit on vulnerabilities, but isn't fair warning... fair?

The problem with a fair warning is that once I email you such a warning, I'll never be able to anonymously publish it no matter how much you ignore the report. Then the fair thing becomes I never go public I'm confident you'll call lawyers.

So can't you disclose it anonymously? I'm pretty sure most people who are savvy enough to find zero-days know how to get an email address anonymously.

Re: One-Click RCE in Asus's Preinstalled Driver Software

#62

Post by encom »

jeffparsons wrote: post #59
sigmaisaletter wrote: post #18

Obligatory "Scumbag Asus" video link: Invidious https://inv.nadeko.net/watch?v=cbGfc-JBxlY YouTube https://youtube.com/watch?v=cbGfc-JBxlY "ASUS emailed us last week (...) and asked if they could fly out to our office this week to meet with us about the issues and speak "openly." We told them we'd be down for it but that we'd have to record the conversation. They did say they wanted to speak openly, after all. They h…

So are there any "basically respectable" motherboard manufacturers? Or is there a similar story about each of the big players? Asking for a friend who is thinking about building a new PC soon.

All the consumer brands are pozzed. My last build (i7-14700K) used an MSI board. Their secureboot is still broken. The BIOS setup is complete mess, and all the settings are reset after a BIOS update. I have to unplug and replug my USB keyboard after a poweroff, or it doesn't work. But I insisted on a board without RGB lights, and that limited the selection. Computers are over.

Re: One-Click RCE in Asus's Preinstalled Driver Software

#63

Post by technion »

SahAssar wrote: post #61
technion wrote: post #56

Earlier quoted context omitted.

The problem with a fair warning is that once I email you such a warning, I'll never be able to anonymously publish it no matter how much you ignore the report. Then the fair thing becomes I never go public I'm confident you'll call lawyers.

So can't you disclose it anonymously? I'm pretty sure most people who are savvy enough to find zero-days know how to get an email address anonymously.

All ill say is: try it in practice. You'll quick find it dismissed as "not professional" and people will quickly claim its "irresponsible" for that reason.

Re: One-Click RCE in Asus's Preinstalled Driver Software

#64

Post by IlikeKitties »

curiousgal wrote: post #58
IlikeKitties wrote: post #17

Responsible Disclosures and their consequences have been a disaster for the human race. Companies need to feel a lot more pain a lot more often in order for them to take the security of their customers a lot more serious. If you just give them month to fix an issue and spoon-feed them the solution it's just another ticket in their Backlog. But if every other security issue becomes enough news online that their CEOs a…

> a disaster for the human race. This is a prime example where a hyperbole completely obliterates the point one is trying to make.

> This is a prime example where a hyperbole completely obliterates the point one is trying to make.

This is a prime example of someone not getting the joke everyone else got. [0] [0] https://www.washingtonpost.com/wp-srv/national/longterm/unab...

Re: One-Click RCE in Asus's Preinstalled Driver Software

#65

Post by dijit »

stavros wrote: post #52
chii wrote: post #48

Earlier quoted context omitted.

what if the vulnerability cannot be easily fixed within the week, even if the company stops all work and focus completely on the problem? If the reason for responsible disclosure is to ensure that no members of the public is harmed as a result of said disclosure, should it not be a conversation between the security researcher and the company? The security researcher should have an approx. idea of how or what to do to…

If the vulnerability can't be fixed within the week, maybe the company should be SOL. This will incentivize companies to build their software better, as they'll know that any vulnerability that is hard to fix will mean consequences. Maybe the mitigation is for the company to take its service down while it works on the problem. Again, a good incentive to avoid that in the first place. Also an incentive to not waste an…

I hear what you're saying and I agree, but it's perhaps too black and white.

Let's take one of the most disastrous bugs in recent history: meltdown.

Speculative execution attacks inside the CPU. This required (in Paul Turners words): putting a warehouse of trampolines around an overly energetic 7-year old.

This, understandably took a lot of time, both for microcode and OS vendors.. it took even longer to fix it in silicone.

Not everyone is running SaaS that can deploy silently, or runs a patch cadence that can be triggered in minutes.

I work in AAA games and I'm biased, we have to pass special certifications to release patches, if your publisher has good relations, waiting for CERT by itself (after you have a validated fix) is 2 weeks.

Re: One-Click RCE in Asus's Preinstalled Driver Software

#66

Post by giantg2 »

holowoodman wrote: post #28
IlikeKitties wrote: post #17

Responsible Disclosures and their consequences have been a disaster for the human race. Companies need to feel a lot more pain a lot more often in order for them to take the security of their customers a lot more serious. If you just give them month to fix an issue and spoon-feed them the solution it's just another ticket in their Backlog. But if every other security issue becomes enough news online that their CEOs a…

"Responsible" disclosure is paradoxically named because actually it is completely irresponsible. The vast majority of corporations handle disclosures badly in that they do not fix in time (i.e. a week), do not attribute properly, do not inform their users and do not learn from their mistakes. Irresponsibly delayed limited disclosure reinforces those behaviors. The actually responsible thing to do is to disclose immed…

That's because nobody actually cares about security nor do they want to pay for it. I'm a security champion at my company and security related work gets pushed off as much as possible to focus on feature work. If we actually wanted security to be a priority, they would employ security champions who's only job was to work on security aspects of the system instead of trying to balance security and feature work, because feature work will always prevail.

Re: One-Click RCE in Asus's Preinstalled Driver Software

#67

Post by shakna »

thwaysec wrote: post #20
wonnage wrote: post #14

Earlier quoted context omitted.

Did you not see the PoC video?

Seems I was wrong. I am utterly surprised at the lack of security in modern browsers. Yes, that backend is misconfigured, but why this request is even allowed to take place in the first place is utterly mindblowing to me.

Where did the browser go wrong, here? They followed all security practices. The browser isn't what is running the payload.

Unless, you're suggesting that nobody should be able to download programs, unless blessed by some large company?

Re: One-Click RCE in Asus's Preinstalled Driver Software

#68

Post by immibis »

thwaysec wrote: post #20
wonnage wrote: post #14

Earlier quoted context omitted.

Did you not see the PoC video?

Seems I was wrong. I am utterly surprised at the lack of security in modern browsers. Yes, that backend is misconfigured, but why this request is even allowed to take place in the first place is utterly mindblowing to me.

Because the browser tells the backend exactly where the request came from, and the backend agrees to allow requests from there.

Re: One-Click RCE in Asus's Preinstalled Driver Software

#69

Post by ang_cire »

stavros wrote: post #36
holowoodman wrote: post #28

Earlier quoted context omitted.

"Responsible" disclosure is paradoxically named because actually it is completely irresponsible. The vast majority of corporations handle disclosures badly in that they do not fix in time (i.e. a week), do not attribute properly, do not inform their users and do not learn from their mistakes. Irresponsibly delayed limited disclosure reinforces those behaviors. The actually responsible thing to do is to disclose immed…

I make software. If you discover a vulnerability, why would you put my tens of thousands of users at risk, instead of emailing me and have the vulnerability fixed in an hour before disclosing? I get that companies sit on vulnerabilities, but isn't fair warning... fair?

> why would you put my tens of thousands of users at risk, instead of emailing me and have the vulnerability fixed in an hour before disclosing

You've got it backwards.

The vuln exists, so the users are already at risk; you don't know who else knows about the vuln, besides the people who reported it.

Disclosing as soon as known means your customers can decide for themselves what action they want to take. Maybe they wait for you, maybe they kill the service temporarily, maybe they kill it permanently. That's their choice to make.

Denying your customers information until you've had time to fix the vuln, is really just about taking away their agency in order to protect your company's bottom line, by not letting them know they're at risk until you can say, "but we fixed it already, so you don't need to stop using us to secure yourself, just update!"

Re: One-Click RCE in Asus's Preinstalled Driver Software

#70

Post by ang_cire »

eterm wrote: post #38
Gys wrote: post #4

> I asked ASUS if they offered bug bounties. They responded saying they do not, but they would instead put my name in their “hall of fame”. This is understandable since ASUS is just a small startup and likely does not have the capital to pay a bounty. :(

It's understandable for such small companies, like Cisco, that does the same for the myriad of online offerings they've acquired over the years. Cisco have gone even further, by forgetting about their security announcements page, so any recognition is now long lost into the void.

Cisco pays bounties, tho?

https://sec.cloudapps.cisco.com/security/center/resources/ci...

Post reply on HN