news.volyx.in

One-Click RCE in Asus's Preinstalled Driver Software (mrbruh.com)

523 points by MrBruh · 447 days ago · 242 comments on HN

Article summary

A security researcher discovered a one-click remote code execution (RCE) vulnerability in Asus's preinstalled driver software, DriverHub. The vulnerability was reported to Asus, which patched the software, but did not offer a bug bounty. The researcher was instead offered a place in Asus's 'hall of fame'. The vulnerability was found to be exploitable due to a flawed origin check and a lack of proper validation of executable signatures.

Main themes

  • Asus security vulnerability
  • bug bounty programs
  • customer support
  • tech industry accountability
  • remote code execution
  • software security
  • company responsibility

What commenters say

  • Asus's lack of a bug bounty program is unacceptable and may lead to exploits being sold on the black market.
  • The company's handling of the vulnerability report was inadequate, with the researcher not being informed that the issue had already been reported by someone else.
  • Asus's software and customer support are notoriously poor, and this incident is just another example of the company's neglect of security and customer needs.
  • The absence of a bug bounty program may pressure companies to take security more seriously, as the alternative is to have exploits publicly disclosed or sold.
  • Some commenters are calling for a boycott of Asus products due to the company's handling of the vulnerability and its general attitude towards security and customer support.
  • Others are discussing the difficulties of finding suitable alternatives to Asus products, with some mentioning the importance of features like headphone jacks and the problems with USB-C adapters.
  • There is a perception that Asus is not taking responsibility for its actions, including lying about providing a way to unlock the bootloader of certain phones.
  • The incident has sparked a discussion about the importance of security and customer support in the tech industry, with some commenters sharing their own negative experiences with Asus and other companies.