Virtual number service for receiving SMS is a GSM server with Ukrainian numbers to which you can receive SMS messages to confirm any Internet accounts.
Kaspersky first noticed that something was wrong after a recent acquaintance with its own software, adding a function that detects attacks like this one. Kaspersky software detected an unexpected code run in the ASUS update application on client computers. The company estimates that up to 500,000 cars could be affected.
This code went unnoticed because it was signed with a real ASUS certificate. This is enough to convince many anti-malware tools to look the other way. The motherboard reports that even Google’s multi-core VirusTotal scanner skipped this specific malware.
The certificate was not the only one that allowed the attack to go unnoticed. Whoever was behind hacking the server, he was not interested in conducting a large-scale attack. According to Kaspersky, hackers have chosen 600 specific systems. They were identified by their MAC addresses, a unique identifier associated with network adapters.
If the MAC address of the system was not listed, the software did not function, making it difficult to detect. Antivirus software cannot always detect previously unknown malware if it does nothing.
Other things that usually raise red flags do not immediately raise suspicion. One VirusTotal downloader noted grammar and spelling errors, but they were easily rejected. ASUS fixed applications contained similar errors.
How hackers gained access to the ASUS server remains a mystery. Kaspersky Lab considered one possibility: another hacking case could serve as a starting point.
A similar supply chain attack compromised the update servers for the CCleaner application. One of the main targets of CCleaner attacks was ASUS. It could be more than a coincidence.
