Beta

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Asus.com Compromised With Exploit Code

kdawson posted more than 7 years ago | from the be-careful-out-there dept.

Security 117

Juha-Matti Laurio writes in with news that the Web site of ASUSTeK Computer (asus.com) has been compromised to spread exploit code. The original report from Kaspersky Lab claimed that the compromise lead to code exploiting the recently patched Microsoft Windows Animated Cursor (.ANI) 0-day vulnerability, but sans.org found no evidence of this. Apparently a malicious iframe was added to one of the machines in asus.com's DNS round-robin.

cancel ×

117 comments

Sorry! There are no comments related to the filter you selected.

Ouch (0, Redundant)

Virgil Tibbs (999791) | more than 7 years ago | (#18651085)

Thats a publicity disaster for ASUS...

Re:Ouch (-1, Troll)

TheRealMindChild (743925) | more than 7 years ago | (#18651099)

DO you know why you only have "good" karma and only get a "1" score on your initial post? It is because your post was more pointless than a beach ball

Re:Ouch (1, Funny)

zmilo (815667) | more than 7 years ago | (#18651181)

Clearly you haven't played "Sonic Volleyball," sir.

Re:Ouch (0)

Anonymous Coward | more than 7 years ago | (#18651409)

well u sir have just lost ur karma...u evil troll

Re:Ouch (0)

Anonymous Coward | more than 7 years ago | (#18652463)

u mispelled 'ebil'.

ur welcme. :)

Re:Ouch (0)

Anonymous Coward | more than 7 years ago | (#18651233)

i-hab-been-haxored-by-asus.com

DNS needs improvment... (0, Offtopic)

B5_geek (638928) | more than 7 years ago | (#18651095)

Perhaps now they will finally fix the missing www. entry in their DNS server. I have always hated that they didn't have that patched.

Re:DNS needs improvment... (4, Informative)

The MAZZTer (911996) | more than 7 years ago | (#18651125)

You DO know that www. is just another subdomain, right? The only reason it's special is because most/all websites mirror <hostname> onto www.<hostname>. But it doesn't HAVE to be like that. Slashdot doesn't do it like that, for instance.

It doesn't matter if the DNS entry has www. on it or not, the address is still owned by the same person and will get directed to a machine they specified (or nowhere).

Re:DNS needs improvment... (1)

IgnoramusMaximus (692000) | more than 7 years ago | (#18651333)

Err, but this will not work if the web server on that host is using virtual website configuration, that is it has multiple sites tied to one (or group of) IP addresses. In many such cases the virtual sites are associated with the a full URL, such as "www.asus.com". So by going to "asus.com" you are not only not guaranteed to get the same site but even if you do the first link on that site might turn out to be an absolute one. And back you go to the broken "www" subdomain.

Re:DNS needs improvment... (1)

Professor_UNIX (867045) | more than 7 years ago | (#18651627)

Look up the Apache ServerAlias directive. You can alias as many alternate names as you want under the virtual host without creating a separate virtual host definition for that hostname. Technically either way would work, but it's just a lot less work.

Re:DNS needs improvment... (1)

IgnoramusMaximus (692000) | more than 7 years ago | (#18652263)

That does not matter in this case.

The GP is insinuating that one can "always" go to the 2nd level domain instead to its "www" sub-domain and get to the website. I merely pointed out that in many configurations (specially large, multi-lingual sites) that is not true. If you alias the virtual sites you still haven't avoided the problem because only one of those can be aliased to "mydomain.com" (which in case of such large sites usually goes to the "Wold-wide" site which then asks you to select your country and then redirects onto "uk.mydomain.com" or what not).

All of this is further complicated by use of JavaScript on such sites which accesses all sorts of back-end URLs.

Re:DNS needs improvment... (0)

Anonymous Coward | more than 7 years ago | (#18651355)

Uh, yes it does.

----

The request:
GET / HTTP/1.1

Host: www.slashdot.org
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 4.0)
HTTP/1.x 301 Moved Permanently

The redirect:
Date: Sun, 08 Apr 2007 00:15:50 GMT
Server: Apache/1.3.37 (Unix) mod_perl/1.29
Location: http://slashdot.org/ [slashdot.org]

----

note: I mask my user agent :P

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.3) Gecko/20070310 Iceweasel/2.0.0.3 (Debian-2.0.0.3-1)

is a bit more information than I'd like to volunteer to most websites.

Re:DNS needs improvment... (2, Insightful)

nuintari (47926) | more than 7 years ago | (#18651489)

This is a whole lot different than what most sites do. Notice how you type www.slashdot.org in, but end up at slashdot.org? Yeah, the line "HTTP/1.x 301 Moved Permanently" means they redirect you away from the www, probably because a lot of us think the www is stupid.

Most sites are configured to accept either the www.domain, or just the domain. Slashdot is not one of them.

Re:DNS needs improvment... (1)

Zarel (900479) | more than 7 years ago | (#18658425)

That's not as much because they think WWW is stupid as just because of where "Slashdot" comes from: "http colon slash slash slashdot dot org" is supposed to be intentionally confusing, and adding the "www" detracts from the confusion.

Re:DNS needs improvment... (1)

StikyPad (445176) | more than 7 years ago | (#18658823)

they redirect you away from the www, probably because a lot of us think the www is stupid.

Or because "slash-slash-slash-dot-dot-org" is more amusing/confusing than the www-prefixed alternative.

Re:DNS needs improvment... (1)

nevali (942731) | more than 7 years ago | (#18651519)

Congratulations on being one of the hoards of people who artificially inflate IE6's market share stats (even if there are better methods than user-agent sniffing out there, they don't necessarily get used...)

Re:DNS needs improvment... (-1, Flamebait)

Anonymous Coward | more than 7 years ago | (#18651941)

Ehh, normally I wouldn't feed a troll, but I just have to ask... What the Hell does www. or not have to do with IE6?? .. Also, it's 'hordes' to indicate a large group, a 'hoard' is a stash or cache of materials, not a group of people.

Re:DNS needs improvment... (-1, Troll)

Anonymous Coward | more than 7 years ago | (#18652243)

Hey dipshit he was talking about the user-agent string.

Reading is fundamental or didn't your daddy teach you that while he was laying on your sister?

Re:DNS needs improvment... (-1, Troll)

Anonymous Coward | more than 7 years ago | (#18656663)

Nope, sorry I missed teaching him that - you were right though, I *was* laying his sister, but it was a threesome with her and your mom. Your mom loves the cock btw - and that thing she does... mmmm

Re:DNS needs improvment... (1)

sulfur (1008327) | more than 7 years ago | (#18653249)

I don't think that there really are too many people who change their User-Agent to significantly affect global statistics. I, too, tried to strip off my Referer to enhance privacy and masquerade my User-Agent as Googlebot/2.1, however, there are just too many poorly written sites that are broken by design and rely on those headers. Once my list of exceptions sites grew beyond 10, I thought, "heck with it, it's easier just to leave it as it is."

Re:DNS needs improvment... (-1, Troll)

Anonymous Coward | more than 7 years ago | (#18651521)

hey nigger,
http://asus.com/ [asus.com]
Bad Request (Invalid Hostname)

USE YOUR SMALL FIELD MONKEY BRAIN

Re:DNS needs improvment... (0)

Anonymous Coward | more than 7 years ago | (#18651675)

Shouldn't you be picking fights with people over whose coding style is superior, or who knows more about Star Trek?

Re:DNS needs improvment... (1)

cheater512 (783349) | more than 7 years ago | (#18653639)

Yeah but quite a few sites dont have a DNS entry for domain.com. They only have one for www.domain.com.
Pain in the ass.

Re: www as subdomain, Huh? (1)

Douglas Goodall (992917) | more than 7 years ago | (#18659257)

www is a host name within a domain zone, not a subdomain. It COULD be done that way, but the domain zone data would be very different...

Re:DNS needs improvment... (3, Interesting)

JWSmythe (446288) | more than 7 years ago | (#18651427)


    The one that always annoyed me was Promise. That is, when I was still using their hardware. :)

    http://promise.com/ [promise.com] goes to a blank index page.

    http://www.promise.com/ [promise.com] goes to their real content page.

   

Re:DNS needs improvment... (4, Funny)

ez76 (322080) | more than 7 years ago | (#18651879)

This is intentional and symbolizes the company's value proposition, the Empty Promise (TM).

Re:DNS needs improvment... (-1, Flamebait)

Anonymous Coward | more than 7 years ago | (#18652839)

1) you're a fucking moron
2) By design you retard

host promise.com
promise.com has address 207.155.248.44
promise.com has address 207.155.248.59
promise.com has address 207.155.248.75
promise.com has address 207.155.252.73

host www.promise.com
www.promise.com has address 208.36.127.69
www.promise.com mail is handled by 10 diligence.xo.com.
www.promise.com mail is handled by 20 invincible.xo.com.
www.promise.com mail is handled by 30 tremendous.xo.com.
www.promise.com mail is handled by 40 vigilant.xo.com.
www.promise.com mail is handled by 50 irresistable.xo.com.
www.promise.com mail is handled by 60 indefatigable.xo.com.
www.promise.com mail is handled by 70 hood.xo.com.
www.promise.com mail is handled by 80 brilliant.xo.com.

DUH! Why? perhaps they use some type of VPN, terminal services, or some other means of access which requires them to separate the root domain from the www subdomain.

Please, get a clue for the future. *whack*

Re:DNS needs improvment... (1)

totally bogus dude (1040246) | more than 7 years ago | (#18654473)

Then why don't they put an HTTP redirect on the server which hosts "promise.com"? They already have a web server there, after all.

I reckon it's that empty promise thing. Very deep.

no-www.org (0)

Anonymous Coward | more than 7 years ago | (#18653177)

Thought [no-www.org] you might appreciate this.

Re:DNS needs improvment... (1)

deviceb (958415) | more than 7 years ago | (#18653647)

ha.... it's nice to see somebody else wondering why a company like Asus can not set DNS right..

Re:DNS needs improvment... (1)

Dersaidin (954402) | more than 7 years ago | (#18653975)

DNS is not the problem here. Servers just need to be configured more friendly.

Further evidence that ... (5, Interesting)

Aminion (896851) | more than 7 years ago | (#18651123)

... you don't have to visit porn, warez or shady sites to get your computer infected with all sorts of nastiness; "trusted" sites will just do.

Windows is unfit for business uses. (2, Insightful)

Anonymous Coward | more than 7 years ago | (#18651347)

What this actually shows is that Windows is unfit for business uses. Even when using their top-end Windows Server products, it's obviously a very poor choice. Between the great expense, the low quality and the numerous security problems, there's no good reason to be using it.

I can think of one reason why a company would go with Windows-based systems: ignorance. This includes ignorance on the part of the network designers and administrators, who do not stand up and demand to use Solaris, Linux, HP-UX, AiX, FreeBSD, Mac OS X or some other system. This also includes ignorance on the part of the management team that is authorizing the purchase and use of such software.

Re:Windows is unfit for business uses. (2, Interesting)

toadlife (301863) | more than 7 years ago | (#18652357)

So what exploit in IIS6 do you think let this hack happen?

Re:Windows is unfit for business uses. (0)

Anonymous Coward | more than 7 years ago | (#18653731)

Re:Windows is unfit for business uses. (1)

earthforce_1 (454968) | more than 7 years ago | (#18652445)

Unfortunately, it becomes a chicken vs. egg problem - critical apps that only run under windows, ergo they need windows. And they need windows because all of their customers are using windows, so.....

Convincing your CEO or CIO to switch to FOSS (even if they would dearly love to) is like convincing a hard core gamer to drop microsoft. They will do it the day WOW or Everquest or runs flawlessly under Linux.

Re:Windows is unfit for business uses. (2, Insightful)

PPH (736903) | more than 7 years ago | (#18652543)

What sort of Windows-speific app do you think Asus has to run on their web servers? All they are doing is distributing divers, technical specs and product literature. From the point of view of a Unix/Linux/Solaris system, these are just binaries and the web servers could care less about the contents.


This is one of the problems I've seen repeatedly with CIOs who have been brought up drinking the Microsoft Kool-Aide. They've never bothered to question the 'one size fits all' sales pitches.

Re:Further evidence that ... (2, Funny)

plague*star (731804) | more than 7 years ago | (#18651689)

... you don't have to visit porn, warez or shady sites to get your computer infected with all sorts of nastiness; "trusted" sites will just do.

I suspect the actual plan was to infect all the people mis-typing "anus.com"

P*S

I heard rumors (0)

Anonymous Coward | more than 7 years ago | (#18651143)

that Investor Village was spreading some "updater.exe" the other day (via ads), so this might have been a bit larger than just the one site?

Re:I heard rumors (5, Informative)

bmo (77928) | more than 7 years ago | (#18651213)

"that Investor Village was spreading some "updater.exe" the other day (via ads), so this might have been a bit larger than just the one site?"

It's spyware from an ad service. It's like those "Your computer is infected" ads on a Yahoo page.

The real carrier of the evil is dropspam.com, which pretends to be a spam filtering service. I fired up VMware and installed upgrade.exe out of morbid curiosity. The results are here:

Msg: 26529 of 26688 4/6/2007 6:57:44 AM Recs: 26 Sentiment: Not Disclosed
By: Boyle M. Owl Send PM Profile Ignore Add To Favorites
Posted as a reply to msg 26470 by sco_source_scam

Re: IV advertising malware? Dropspam.com

The tiny program is a downloader and installer. I have run it inside of VMware, the only way to run Windows...

It may be legitimate, but read on, and grok the implications of the license....

3. Licensee's Covenants
(a) The Licensee has read all information pertaining to the operation of the Software and expressly agrees that the Licensor shall be permitted to make any modifications, alterations and re-configurations to the Licensee's computer hardware and software including its email inbox and outbox as required for the normal operation of the Software, including but not limited to the re-routing of emails to the Licensor's server for the purposes of screening emails for spam and viruses and attaching a brief message promoting the Software to all out-going emails of the Licensee.

The licensor can kindly stay the fuck out of my computer, tyvm.

(b) The Licensee further agrees that the Licensor shall be permitted to send emails (Authentication Emails) on behalf of the Licensee to those email addresses which have been stored in the Licensee's computer or which appear as senders in incoming emails, for the purposes of authenticating these email addresses and providing the recipients with an opportunity to update the Licensor with additional authentic email addresses.

"We're going to examine your drive for email addresses, and then we're going to spam the shit out of your friends."

(c) If the Licensee wishes to delete or remove the Software for any reason, such deletion or removal must be carried out using either the program or software removal tool inherent in the Licensee's computer operating system including the Add/Remove tool provided by Microsoft® Windows, or such other similar program or software provided by the Licensor, which will be available to the Licensee through the Licensor's website. The Licensee acknowledges that if the deletion or removal of the Software is carried out by any other manner or by using any program or software other than those described above, the Licensee's email software or system may not be restored fully and/or may fail to start up and function properly, and as a result the Licensee may not be able to receive or send emails.

"Yeah, ya see, our program so severely fucks your system that if you try to remove us with something that might work, we'll break your smtp and pop3 server pointers."

As I wrote this, several other popups came up and want me to install shit. Ahahahah, I'm going to install all this and then I'm going to run a friend's malware scanner to see what it really does.

Ghod...this is what being a windows user is like?! I have forgotten!

--
BMO

Msg: 26531 of 26688 4/6/2007 7:18:35 AM Recs: 25 Sentiment: Not Disclosed
By: Boyle M. Owl Send PM Profile Ignore Add To Favorites
Posted as a reply to msg 26529 by Boyle M. Owl
Re: IV advertising malware? Dropspam.com

I do this shit so you don't have to...

Up until I installed upgrade.exe, the system was pristine except for an installation of OpenOffice and Opera....

BTW, this is just a _part_ of the log that goes on forever...

Checking system programs...

Checking Windows directory contents...
c:\windows\appupdate.exe: Version info not found (Suspicious)
c:\windows\ewwsetup.exe: UPX compressed (Suspicious)
UPX: ewwsetup.exe, insize=62464 outsize=159493
c:\windows\id.exe: Version info not found (Suspicious)
c:\windows\id.exe: UPX compressed (Suspicious)
UPX: id.exe, insize=23552 outsize=50839
c:\windows\id.exe: iSearch (Hijacker)
c:\windows\id.exe: Trojan downloader (Malware)
c:\windows\nnbbmb6_38.exe: No company info (Suspicious)
c:\windows\nnbbmb6_38.exe: LSP library
c:\windows\nnbbmb6_38.exe: LSP installer
c:\windows\nnbbmb6_38.exe: Malware site (mail.com) (Spyware)
c:\windows\nnbbmb6_38.exe: New.net (Spyware)
c:\windows\qtfont.for: Disguised executable file (Suspicious)
c:\windows\sysoffermgr.exe: Unknown (sys*.exe)
c:\windows\tek52.exe: Version info not found (Suspicious)
c:\windows\ts.exe: No company info (Suspicious)
c:\windows\ts.exe: No product info (Suspicious)
c:\windows\ts.exe: UPX compressed (Suspicious)
c:\windows\ts.exe: PE executable size less than 16K (Suspicious)
UPX: ts.exe, insize=10752 outsize=34884
c:\windows\ts.exe: Trojan/malware downloader (Malware)
c:\windows\ts.exe: Registry manipulator
c:\windows\ts.exe: TargetSaver (Hijacker)
c:\windows\updrun.exe: Version info not found (Suspicious)
c:\windows\webbuying.exe: Version info not found (Suspicious)
c:\windows\yzd.exe: Version info not found (Suspicious)
c:\windows\yzd.exe: Nullsoft installer (Suspicious)
c:\windows\zigi.exe: No company info (Suspicious)
c:\windows\zigi.exe: No product info (Suspicious)
c:\windows\zigi.exe: Possible open network threat

Checking System directory contents...
c:\windows\system32\hgfs.dll: Version info not found (Suspicious)
c:\windows\system32\drivers\vmscsi.sys: Hybrid DOS/Windows program (Suspicious)
c:\windows\system32\drivers\vmxnet.sys: Hybrid DOS/Windows program (Suspicious)

Anyway, this has basically made the (virtual) computer useless and annoying.

It reminds me why I don't run Windows.

--
BMO

Re:I heard rumors (2, Insightful)

MichaelSmith (789609) | more than 7 years ago | (#18651273)

Anyway, this has basically made the (virtual) computer useless and annoying.

You should put the virtual disk under version control.

Re:I heard rumors (2, Informative)

bmo (77928) | more than 7 years ago | (#18651415)

"You should put the virtual disk under version control."

VMware does that. To clean the virtual machine, you can pick any of the older images. I was asked if I tried uninstalling using the spyware company uninstaller and I said no. I picked the April 1 image out of a perverted sense of humor.
--
BMO

Re:I heard rumors (insight please) (1)

lightversusdark (922292) | more than 7 years ago | (#18652957)

But to diff the directory tree?
Quickly?
There must be a tool that does this..

Re:I heard rumors (1)

quacking duck (607555) | more than 7 years ago | (#18653059)

The free VMWare Server only allows a single snapshot, so you can't "pick any of the older images," you can only take a snapshot before experimenting and revert if it fubars it somehow.

Not saying that bmo was necessarily using VMWare Server, of course.

Re:I heard rumors (1)

Architect_sasyr (938685) | more than 7 years ago | (#18654535)

Just FYI: VMWare workstation (only have a windows installer, don't know if it runs on Linux) allows for any number of snapshots.

jpeg or png? (3, Insightful)

MichaelSmith (789609) | more than 7 years ago | (#18651195)

TFA:

up to no good pointing to another obfuscated javascript and a executable cloaked as a jpg file

Then:

Name: next3.png

So is next3.png the real exploit and are they using "jpeg" to mean an image file? Or is there a jpeg file involved here?

Re:jpeg or png? (1)

LiquidCoooled (634315) | more than 7 years ago | (#18654181)

Does windows even care what the extension is?
It attempts to read a file (of whatever name) and uses the parser which appears to fit.
You can store jpeg data inside a file called *.png and vice versa.

not the least bit surprised (2, Informative)

Indy1 (99447) | more than 7 years ago | (#18651337)

Most of the motherboard oem's use IIS for their web sites. They tend to be incredibly slow, go down all the time, and often render poorly (or not at all) on anything other then IE.

All signs of poor admins.

Re:not the least bit surprised (4, Informative)

GeRM_007 (627791) | more than 7 years ago | (#18651411)

I was on their site last weekend, looking for a new BIOS and drivers. Their support web server was completely down. I called up to complain, and their tech support told me that they are aware of it, and have been having problems with it for a couple weeks now as they are changing their infrastructure. A couple weeks!!! Even their tech support couldn't access it, or even tell me what the BIOS version number was. This compromise is probably a result of an incorrectly configured server, which is a result of incompetent admins. All this results in them losing me as a customer. Good riddance Asus.

I'm shocked... SHOCKED! (5, Insightful)

Excelcia (906188) | more than 7 years ago | (#18651751)

How dare their web site go down when I need a driver? How dare anyone ever have a problem they don't know how to solve in sufficient time to deal with my selfish and entitled demands? Their tech support exists (solely, I might add) to tell me the bios version I need. So bye bye Asus, I consign you to the ash heap of history while I move along to a company that forces its developers to blog for me, whose support staff reads my every web site comment (including the ones on third party sites), and that spends every last dollar it has on server infrastucture. Of course, I don't particularly care that this company will be out of business in no time, because there are a constant influx of new companies who are willing to lose money for a year and fold.

And to top it all off... BAH HUMBUG!

Re:I'm shocked... SHOCKED! (1)

zippthorne (748122) | more than 7 years ago | (#18652223)

To be fair, he shouldn't have to wait three weeks to get a stupid tech support question answered or download a driver. They should have some kind of backup plans in place (or make a new one up, with a three week window, there's even time for that) in the event that the website is going to be down for that long. Especially if they know it's going to be down for that long.

Three weeks is a long time for a total tech support blackout.

Re:I'm shocked... SHOCKED! (1)

pipingguy (566974) | more than 7 years ago | (#18652803)

Not trying to be an asshole or anything, but DARPA invented the net so that there would be no un-recoverable points of failure.

Learn how to do stuff without having to rely on computers.

Re:I'm shocked... SHOCKED! (2, Insightful)

Achromatic1978 (916097) | more than 7 years ago | (#18653817)

For the longest time, I loved my Asus notebook (A7Vc). Heavy fucker, but great. 1.86GHz Pentium M (It's 18 months old), 2GB RAM, 1440x900, ATI Mobility Radeon x700, integrated HDTV. Lots of nice stuff.

But it hasn't seen a driver update from Asus in coming up on a year. Not a single Vista driver? For a notebook that was one of your top-of-the-line models (yeah, yeah, I know time moves fast)? When there are HUNDREDS of posts on your forums about the integrated webcam breaking EVERY video input software under Vista, including but not limited to said webcam itself, HDTV tuner, Windows Media Player and Quicktime.

Fuck you, Asus. My employer gave me a Sony Vaio. It's nice. It's a lot newer, sure, but at least its manufacturer (for all their evils) have updated drivers in the LAST TEN MONTHS.

Re:I'm shocked... SHOCKED! (2, Informative)

Flendon (857337) | more than 7 years ago | (#18654521)

Asus is known for their site being down for days at a time, having horrendous javascript, and often breaking in firefox. They are also known for having an unresponsive customer service. The most common answer you get is "look at our forums", yet their own forums indicate the problem is known and unresolved. To pick just one issue I've had with them as an example, due to their buggy firmware my DVD+-RW was recognized as a CD-R for over a year before they finally fixed it, with hundreds of people claiming the same problem. And, even then the firmware update could only be installed using a floppy drive (in 2006!) and required a third party bios flasher. No, this is par for the course with Asus and I laughed when I received my ISC newsletter.

Re:I'm shocked... SHOCKED! (0)

Anonymous Coward | more than 7 years ago | (#18654545)

Their tech support exists to tell me the bios version I need. So bye bye Asus,

The customer is king. If a customer is not happy with the services provided by a company, the customer is right to say bye bye to the company. The customer does not have to ask politely for services from the company, the customer has paid for services. The company should politely ask what it can do for the customer. And again, if the company does not want to provide the services, do not be surprised when the customer walks away to another company who wants to.

FTP (1)

svallarian (43156) | more than 7 years ago | (#18655251)

remember when companies would just have an FTP site (sorted by product model) that you could get in and download the drivers you needed?

Progress, I tell ya, progress.

Re:not the least bit surprised (1)

jez9999 (618189) | more than 7 years ago | (#18658039)

Asus have a support department??

- Disgruntled Asus customer

It's not just the admins. (1, Funny)

Anonymous Coward | more than 7 years ago | (#18651421)

Yes, the admins are to blame. Even as Windows administrators, they should be advocating the use of Solaris, Linux, AiX, HP-UX, FreeBSD, Mac OS X, or some other non-Windows system. Why is that? Because those are secure, reliable, efficient, high-quality operating systems. If the admins don't advocate the use of such systems, and instead suggest Windows, then they are not performing their job correctly. They should be relieved of their duties.

But we can't blame just the admins. We also have to blame the network designers and integrators who actually put such systems into place. Again, if any of them recommends the use of Windows, then they are not performing their job correctly. They should be relieved of their duties.

Furthermore, we also have to blame the management that allows for the purchase and installation of those Windows systems. They should know by now that Windows is not the sort of system that should be used for any purpose whatsover. Again, any manager who in any way authorizes the use of Windows is not performing his or her job correctly. He or she should be relieved of his or her duties.

Re:It's not just the admins. (1)

sumdumass (711423) | more than 7 years ago | (#18651533)

lol. just because windows ships less secure then any of the others OSes doesn't mean that have to stay that way. I have some very secure windows systems that have been running trouble and update free for quite a while now (two years for one).

Now I'm just as much an open source fan as anyone here. A linux box probably would have been a better system to use the a windows one. But there is no technical reason that windows couldn't be used in this way and be just as secure overall.

Re:not the least bit surprised (1)

LordLucless (582312) | more than 7 years ago | (#18651719)

"and often render poorly (or not at all) on anything other then IE"

Because that has a whole lot to do with the admins, or the webserver they run...

Re:not the least bit surprised (1)

Beryllium Sphere(tm) (193358) | more than 7 years ago | (#18652269)

At least it's IIS 6, according to NetCraft.

Re:not the least bit surprised (1)

dillee1 (741792) | more than 7 years ago | (#18653925)

Besides from the shortcomings you have just mentioned, many of these chinese/taiwanese sites are infested with flash. Some put a flash page right as front page with no escape link. Some even have the whole site completely flashified and offers no html alternative.

I browse these sites to look for new product or support, not wasting my bandwidth watching stupid animation. Usually I exit right the way when seeing a site like this. I can't trust anyone's product if they can't even get their website right.

Asus Site Is Always A Mess Anyway (3, Insightful)

chromozone (847904) | more than 7 years ago | (#18651383)

Many people who like Asus products know the Asus website is awful. No problem on that site would come as any surprise to anyone who goes there for updates or information. I'm glad it's no big deal this specific problem but that is still one dodgey site that needs TLC quite desperately.

Re:Asus Site Is Always A Mess Anyway (5, Informative)

madclicker (827757) | more than 7 years ago | (#18651471)

I second that. They use M$ ftp servers with download speeds of 7MB per second. They have an issue since 2000 and never been able to fix their website. What a shame for a company that deals with technology. The funny thing is on their download site they have four locations like: Global, USA, China, Europe, Japan, but all are coming of the same subnet. Morons.

Re:Asus Site Is Always A Mess Anyway (0)

Anonymous Coward | more than 7 years ago | (#18652993)

The funny thing is on their download site they have four locations like: Global, USA, China, Europe, Japan, but all are coming of the same subnet. Morons.

This has nothing to do with networking. These subdivisions serve different markets where the demand for each product is different.

Re:Asus Site Is Always A Mess Anyway (0)

Anonymous Coward | more than 7 years ago | (#18654561)

"they have four locations like: Global, USA, China, Europe, Japan,"

Maybe I counted wrong (preschool was a long time ago), but that looks like five.

Re:Asus Site Is Always A Mess Anyway (0)

Anonymous Coward | more than 7 years ago | (#18654847)

Uhm, maybe 'Global' not being location as in all of it? Whatever...

Re:Asus Site Is Always A Mess Anyway (1)

jandrese (485) | more than 7 years ago | (#18652289)

Yeah, their website is atrocious and they don't seem to care. That's unfortunately not uncommon among motherboard manufacturers.

Re:Asus Site Is Always A Mess Anyway (1)

Fred_A (10934) | more than 7 years ago | (#18655253)

That's actually how you can tell you've got the right website and not some kind of domain squatter's scam that was quickly setup on a Linux/Apache server on the Azus.com (or whatever misspelled motherboard maker) domain. I personally find it to be a convenient feature.

Advice (3, Interesting)

MindStalker (22827) | more than 7 years ago | (#18651401)

Ok, friday I reinstalled a Asus laptop. While applying updates I was downloading asus drivers. Should I be concerned that I visited their site without a fully patched system? I hate to do it all over again? Any suggestions in how I can tell if I was infected.

Just assume you're infected. (-1, Troll)

Anonymous Coward | more than 7 years ago | (#18651431)

If you're running Windows, then it's best to assume that you have been infected. When it comes to Windows, you can never be sure that your system is actually clean, even when you use a variety of different anti-malware software. So for the safety of your data and personal information, it's best that you reinstall Windows.

Or better yet, try to avoid Windows if you can. Ubuntu Linux [ubuntu.com] is a very secure and reliable system, often supporting all of your hardware by default. Furthermore, if you use WINE you can run virtually all of your existing Windows applications and games. Best of all, Ubuntu is free!

Re:Just assume you're infected. (3, Insightful)

Aladrin (926209) | more than 7 years ago | (#18651659)

As much as I hate to agree with a troll, he's partially right. It's best to assume you have been infected. Even if all the current anti-spyware doesn't find it, that doesn't mean it won't pop up soon. We don't know enough about this malware to identify what it is and if you have been affected, apparently.

On the other hand, the troll is pretty much wrong about everything else, including "Furthermore, if you use WINE you can run virtually all of your existing Windows applications and games." I have been trying to get windows-based games to run for quite some time, and with the exception of a few favored games (WoW) and some old ones that were really simple, not much works at all, let alone with hours of tweaks. (Actually, I don't even own WoW, so I could be wrong about how well it works as well.)

Re:Just assume you're infected. (1)

644bd346996 (1012333) | more than 7 years ago | (#18651827)

In other words, that AC was not a troll, just an AC preaching to the choir. Your description of your experience with WINE is not the norm these days. But we don't know the extent of your problems because you don't name any apps that don't work. WINE is an appropriate substitute for many people.

Re:Just assume you're infected. (0)

Anonymous Coward | more than 7 years ago | (#18651973)

I have been trying to get windows-based games to run for quite some time, and with the exception of a few favored games (WoW) and some old ones that were really simple, not much works at all, let alone with hours of tweaks.

What games aren't working for you? Remember, just because you can't get it working doesn't mean that it doesn't work just fine for other people. Instead of mislabelling me a "troll", perhaps we can work through your problems with WINE.

The first thing you should try is installing the latest version of WINE, which is currently 0.9.34 [winehq.com] . It would help if you gave more details about your system, as well. What version of X are you running? What OpenGL implementation do have installed? What version of GCC are you using? What distribution are you running?

Re:Just assume you're infected. (1)

Aladrin (926209) | more than 7 years ago | (#18654651)

I'm running 9.33, and 9.34 does solve one of my major issues. (The cursor for Guild Wars.) I'm running Kubuntu and I'm just waiting for the package to update so I can have that. It still has major sound issues, and locks up, though. (I tested with wine-git.)

Morrowind runs, but has no music because wine refuses to play the mp3 soundtrack. Playable, though, I admit, once you use a no-cd patch.

And there's my biggest complaint: You HAVE to use a crack on most games to even get them to start up. There's been patches offered to workaround safedisc, but they aren't even accepted so that people can help work out the bugs in them. They are just flat rejected.

Sid Meier's Alpha Centauri is the one I wanted to play so badly, but I went looking for my CD the other day and I've apparently lost it. I'm not going to purchase another for Windows because I have GameTap (which doesn't even -begin- to work with Wine) and it's in their library. And the Linux one is impossible to find, even on Ebay.

Other games: Rama (Which plays, except the video skips ahead quite often and you miss important information in videos), Pandora's Box, and Septerra Core. The last 2 don't play at all. I have apparently lost quite a bit of my game collection, so I can't test some of my other favorite games like Black & White and all the Quest for Glory games.

Re:Just assume you're infected. (1)

someone1234 (830754) | more than 7 years ago | (#18653337)

Yeah, wine cannot even run simple mfc applications correctly. It is good as an ad-hoc substitution, but not a real solution. An example: fixme:richedit:RichEditANSIWndProc WM_STYLECHANGING: stub fixme:richedit:RichEditANSIWndProc WM_STYLECHANGED: stub fixme:richedit:RichEditANSIWndProc WM_STYLECHANGING: stub fixme:richedit:RichEditANSIWndProc WM_STYLECHANGED: stub fixme:richedit:RichEditANSIWndProc ECO_AUTOWORDSELECTION not implemented yet! fixme:richedit:RichEditANSIWndProc ECO_NOHIDESEL not implemented yet! fixme:richedit:RichEditANSIWndProc ECO_WANTRETURN not implemented yet!

Re:Advice (2, Funny)

lavid (1020121) | more than 7 years ago | (#18651493)

Isn't "installing a laptop" just plugging in the power supply / battery?

Re:Advice (1, Informative)

Anonymous Coward | more than 7 years ago | (#18651745)

"The script at the time we looked at it was obfuscated and leads to a VBscript"

so only IE users need to worry.

Re:Advice (0, Troll)

miscz (888242) | more than 7 years ago | (#18651797)

Why should you be worried? Oh, you might be using Windows... then yes. But then again you should be worried the moment you plug in the ethernet cable. BTW, it's safe to turn off Security Center service, just memorize "your computer might not be safe", SC sometimes is wrong and says you're OK.

Yup, it's a troll, but I just can't resist having fun at expense of Windows users :)

Re:Advice (1, Funny)

Anonymous Coward | more than 7 years ago | (#18654239)

Did you check the digital signatures of the drivers that you downloaded?

Re:Advice (2, Informative)

Plutonite (999141) | more than 7 years ago | (#18654307)

If you visited their website using IE then yes (and insert a lot of jeering here for using IE) be very concerned. Firefox is immune because it's the IE rendering engine that is exploited.

That said, your file explorer on windows also uses the said engine, so any files you download are a threat as soon as you browse to their location. If you have put these files somewhere you know of, try using the windows shell to move them into a directory you don't like to go to very often. Then wait until spyware/anti-virus removers get updated and you are "safe".

Re:Advice (0)

Anonymous Coward | more than 7 years ago | (#18658361)

Some links about this ASUS bit:
writeup&discussion in french [siteduzero.com]
another writeup, this one's in english [pcper.com]
siteadvisor mention [siteadvisor.com]
dynamoo blog mention [dynamoo.com]
ithome-tw blog mention [ithome.com.tw]

Obviously, don't go to the URLs of the unsafe sites (which are mentioned on a few of these pages) from a vulnerable browser/platform. Be warned.
-os

I dont trust that website anyway (0)

Anonymous Coward | more than 7 years ago | (#18651457)

It is slow, poorly designed, and hard to navigate. I have seen recent software/firmware updates appear, then disappear later. These ghost software updates dont work at all or cause problems.

It's not a DNS error-- it's a html page error (2, Informative)

postbigbang (761081) | more than 7 years ago | (#18651483)

The Kapersky source material is poorly written. Dig was used to compare DNS servers, but the actual problem was a round-robin home page with outreaching code with little presents inside. At first glance, it sounded like a DNS exploit but it's not-- it's a good old fashion page re-write. DNS has nothing to do with it.

just a test (1)

sirius sam (963847) | more than 7 years ago | (#18651609)

am i still banned

Re:just a test (0)

Anonymous Coward | more than 7 years ago | (#18655371)

no but i wish you were you fucking cunt

SANS DID find evidence of an ANI exploit: (4, Informative)

I)_MaLaClYpSe_(I (447961) | more than 7 years ago | (#18651801)

From isc.sans.org [sans.org] :

UPDATE #2: That second javascript referred in the vbscript above didn't decode, it seems it's just not encoded right, but when decoding the string with a plain base64 routine, it does decode to what leads to an ANI exploit. You never know what a buggy script and a buggy browser do together.

Use the force? (0)

GFree (853379) | more than 7 years ago | (#18651825)

I'm running Linux right now. If I go to the ASUS site and view the hacked iframe or whatever, will it be like Yoda fighting whathisname where he absorbs the Force Lightning and throws it back at his opponent?

It'll be like: .ANI: Woah, wtf is this shit!
Linux: I ownz you d00d! .ANI: AHHHH!

ASUS.com gets knocked off-line.

That'd be righteous. Or I could lay off the rum.

Re:Use the force? (1)

guruevi (827432) | more than 7 years ago | (#18652845)

Have you ever used the ASUS website? Any of their websites (the US, the European or the Taiwanese one) is always down, or slowed down to a crawl. It's nigh impossible to get anything (let alone information or drivers) from there. I used to surf around for minutes searching other sites to download their shite and their page was still coming in at 1k/s and they seem to have a 3MB large page.

So yeah, it's already off-line, slashdotting it is not going to help a lot.

Don't worry! (1)

Cylix (55374) | more than 7 years ago | (#18651855)

Have you actually tried to use their servers?

They are so unbelievably slow and unresponsive you have to use the .tw version.

I don't remember always having those problems, but in the last few years it seems they have not grown to meet the demand.

I think this should guarantee safety for more then a few of us who gave up going back there.

Have you netcrafted them? (1)

SmallFurryCreature (593017) | more than 7 years ago | (#18653195)

They run Windows 2003. Just about says it all doesn't it?

On the other hand, I recently following some live changing events I had to work with three different machines in getting them back up and working. A HP kayak early P3 generation, a self built asus P3 (both dual) and a g3.

Can you guess from wich site I had the least problem getting info?

Yeah the apple site was fast, and constantly telling me about OS-X while the actuall bloody machine ran 8.6, HP had retired much of the data leaving only ASUS to still have all the relevant data simply online. Slow yes, but available without jumping through hoops.

Asus website is a horror, let there be no mistake about that, BUT they do have a track record of keeping all data online and easily accesiable and not constantly trying to sell you something new when looking up info about old stuff.

Only website affected? (2, Interesting)

AndrewM1 (648443) | more than 7 years ago | (#18652025)

I'm surprised that whomever managed to crack into ASUS's servers only inserted malevolent HTML. Imagine the utter destruction they could have caused if they had *enhanced* the firmware downloads with some sort of (probably boot-sector) virus, or simply modified them to destroy the motherboard... *Shudder*

Why wouldn't they? Are the file images stored separately or otherwise better protected?

Re:Only website affected? (1)

Durzel (137902) | more than 7 years ago | (#18652441)

No money in it, for starters.

The people involved in doing things like this are more than likely part of groups who seek to make money by "selling" comprimised hosts to the various other nefarious computing industries like spammers, etc.

Not to mention of course that modifying binary code, especially BIOS firmware, etc to do the sort of thing you suggest and still actually function is very difficult indeed. Chances are the people who altered the Asus site could've easily used script-kiddy proof-of-concept exploits for both the ANI vulnerability and whatever it was that got them onto the webserver in the first place.

Re:Only website affected? (1)

m50d (797211) | more than 7 years ago | (#18654687)

Imagine the utter destruction they could have caused if they had *enhanced* the firmware downloads with some sort of (probably boot-sector) virus, or simply modified them to destroy the motherboard... *Shudder*


Why wouldn't they?

There's no money in utter destruction. They want the infected machines alive and well and sending out spam - and doing that from the bios code is too much effort.

My experience with Asus (1)

EkimAW (1085527) | more than 7 years ago | (#18652573)

I needed to reinstall windows on a box so I went to the Asus website to see if it felt like working today. It was slow as hell as usual but when I finally got to the page for my mobo the links to where the drivers were actually hosted were completely broken. I tired again the next day and still the same thing. I was kinda pissed because I've bought a lot of Asus mobo's as well as several Asus video cards and their website has always sucked but now it's totally non functional. I know all the stuff I need (realtek audio, marvel nic, intel chipset, and the RAID drivers) but it's a pain to track all that down separately and be sure your installing the right stuff. I'd have used the original CD but it was lost in a move. So I phoned Asus support (long distance, no toll-free or LD plan), waited on hold and politely explained the problem I was having with the website and that's it's a chronic problem. So he asked what drivers I needed and I said I needed drivers for my model number (which I gave him, can't remember it now). He then pretty much screamed at me which DRIVERS I needed (like I'm an idiot or something) so I said all of them. I thought it was understood that when reinstalling (which I had already said I was doing) it was implied that one needed the drivers for all the hardware on the board. So then a long pause (checking the website I assume) he started mumbling where I could get a some of the drivers (from non-Asus websites) and said I'd have to wait for such and such. He claimed the problems with the website were due to upgrading for Vista, yea right but I went along. I explained that it really wasn't acceptable to me to have to wait for drivers on my primary computer (my system was non-functional, almost) and asked if there was some other way he could provide me the drivers. I suggested FTP or email. He said he didn't have access to that so I asked if I could speak with a supervisor. After uttering the S-word I was quickly put on hold and then disconnected about 5 min later. All at my expense for long distance. So now I was really quite angry so I phoned back, waited all over again. I didn't raise my voice or curse (just as before) and was as polite as I could be to the next person I talked to. I explained I had just been hung up on by someone else and the person took my name and phone number. I'm not sure what for but I gave it anyway. Then after I explained the problem he gave me a email address I could contact and that they'd email me the drivers within 24 hours. I really needed my computer working so I didn't end up bothering and found the drivers elsewhere on the net. But anyways, my rants pretty much over and my main point is I'm not buying anymore Asus stuff until they fix their website. There's lots of other companies that make just as good mobo's AND are able to host drivers reliably. It really is an important part to the overall product offering and I can't see why a company the size of Asus can't pull off a website that works.

So let me summarize (1)

SmallFurryCreature (593017) | more than 7 years ago | (#18653215)

You bought a cutrate product and expect firstrate support.

Mmm, do you have any idea how much tech support costs? Do you have any idea for that matter just how little margin there is on products like this?

They just don't want to do personal tech support because it eats away their profits like you won't believe.

Oh, and if you know your device, you can easily find it on their site and then find all the drivers you need.

It is slow as hell, to be sure but you cannot fault them for you not being able to find the required drivers.

No you sound like the typical customer who buys a lada but expects a roll-royce style customer support.

Ain't going to happen, and Asus knows this. They have done it this way for long enough for people to know better and they are still in business, because people like me know and accept the trade-offs.

Re:So let me summarize (1)

brouski (827510) | more than 7 years ago | (#18657159)

That's interesting. I've always seen Asus as a high-end performance enthusiast mainboard manufacturer.

Re:My experience with Asus (1)

lintux (125434) | more than 7 years ago | (#18653365)

Do you also have an Asus keyboard?

Does it have an Enter key? ;-)

The iframe issue (1)

malkir (1031750) | more than 7 years ago | (#18653455)

I read another commenter talk about how Chinese hackers (given away by the characters) overlapped his entire companies web browsers with iframes and used clever java to capture every keystroke and input, could this be somewhat related? Sorry, didn't RTFA

What's Asus Doing to Notify Site Visitors? (0)

Anonymous Coward | more than 7 years ago | (#18655645)

I was just out on the Asus site and there are no warnings or notices about this event. What happened to corporate responsibility? They've potentialy distributed malicious code to thousands of people who are likely this minute getting their identities stolen and bank accounts drained without so much as a notice on their site.

Asus will never get my business, that's for sure!
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?
or Connect with...

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>