ASUSpicious Flaw – Users' Information Exposed Since 2022
mrbruh.com

・

73 points

・

MrBruh

・

13 days ago

12 comments

Ciantic ・ 9 days ago

In Windows, hardware vendors have a bad habit of installing useless stuff. Latest trick is that the motherboard contains the payload that gets automatically installed when installing Windows. I had no idea it was even possible. This 'feature' can apparently be disabled from bios, but it needs to be done before installing Windows.

I happen to have both of those DLLs, but I had already disabled all ASUS-related services. I use this script to disable all services starting with "Asus" on startup. [1]

To disable the MyASUS auto-installer in BIOS go to Advanced, there is an option to disable auto-downloading of MyAsus in Windows. [2]

[1]: https://gist.github.com/Ciantic/76ade5f2731cbe87b70d17ff2898...

[2]: https://github.com/sammilucia/ASUS-G14-Debloating/blob/main/...

  • Technetium ・ 8 days ago

    Unfun fact: that setting is often re-enabled after updates.

  • m463 ・ 8 days ago

    is it myasus now? It used to be armorycrate.

    • kuylar ・ 8 days ago

      AFAIK, both of them coexist at the same time. I remember hearing about MyASUS before Armory Crate. I assume AC is used for their more gaming-related products while MyASUS is for general users

kmfrk ・ 9 days ago

I think MyASUS was the piece of software that automagically installed itself on my computer a few weeks ago. I still have no idea how it got there; I just uninstalled it as soon as I saw.

Hopefully it happened to make sure people had the updated version, but I'm gonna keep uninstalling bloatware as much as possible for the reasons outlined in the blog post.

nixosbestos ・ 8 days ago

Between ASUS's incompetence, refusal to support LVFS, refusal to publish BIOS updates for USB4 or for basic security/UEFI issues, their garbage software on Windows, and the amateurish/rude behavior from Asus-Linux folks... I have lost all will to buy anything ASUS again. And it's a shame, this G14 is my absolute favorite computing device of all time.

Once again, I do not believe that these HW manufacturers understand how much good-will they squander by being cheap arses on the software. If only there were an established company here showing how things could be done....

ta988 ・ 8 days ago

No bug bounty? Major hardware company? Disaster in 3 .... 2.... 1...

  • AlexErrant ・ 8 days ago

    Heh, I recently reported a bug to a pretty big healthcare company where I could simply increment the integer ID in the URL and see other patients' info.

    Didn't get so much as a "thank you". At least they fixed it. But I'm sure they have other vulns given how stupid this one was...

    • pixl97 ・ 8 days ago

      Hell, you're probably lucky they didn't send the cops after you.

pixl97 ・ 8 days ago

Asus is absolutely horrible when it comes to security and always has been. If people keep looking around I'm sure they'll find plenty more. They company doesn't learn and doesn't care.