Asustek Admits PC Hack Attack, Disputes Kaspersky Estimate

(Bloomberg) -- Asustek Computer Inc. disputed a cybersecurity firm's estimate that a sophisticated attack last year may have infected more than a million users of its devices, saying only several hundred PCs were infiltrated.

Kaspersky Lab said in a report attackers used stolen digital certificates in 2018 to insert malicious code into the Taiwanese PC giant's live software-update system, which may then have installed back-doors on computers. Kaspersky said it discovered the infiltration in January, which it dubbed Operation Shadowhammer and possibly ran from June to November last year.

But Nick Wu, a spokesman for Asus, said the attacks impacted only several hundred devices. The company had since helped customers fix the problem, patched the vulnerability and updated their servers, Asus said in a separate statement.

It's unclear who the perpetrators were, or their motives. Cyber-attacks are on the rise globally as online information becomes increasingly valuable and connected devices proliferate. So-called supply-chain infiltration, in which attackers target the infrastructure of computer and device vendors, has become one of the most effective vectors for the spread of malware, Kaspersky said.

“The selected vendors are extremely attractive targets for APT groups that might want to take advantage of their vast customer base,” Vitaly Kamluk, director of global research and analysis team, APAC, said in the report, referring to hacking teams.

Asus is one of the world's largest makers of PCs and devices from motherboards to displays, and is favored especially by gamers. Its shares rose 0.9 percent Taipei, paring their decline in the past 12 months to 19 percent.

To contact the reporter on this story: Debby Wu in Taipei at dwu278@bloomberg.net

To contact the editors responsible for this story: Edwin Chan at echan273@bloomberg.net, Robert Fenner

©2019 Bloomberg L.P.