This video critically examines a series of significant security vulnerabilities found across ASUS's software and hardware, highlighting the company's problematic practices. Key issues discussed include hardcoded administrative credentials in the MyASUS RMA system, a remote code execution flaw in DriverHub allowing arbitrary file installation, and an active botnet exploitation campaign ("Ace Hush") targeting ASUS routers that bypasses standard firmware updates. The presenter also reiterates long-standing concerns about Armory Crate, describing its self-propagating, motherboard-level integration as malware-like behavior that persists despite user attempts to disable it and recent patches for kernel driver vulnerabilities. The video criticizes ASUS's unrewarding engagement with security researchers and its continued push for bloatware that introduces unnecessary and widespread security risks for its vast user base.
ASUS Security Vulnerabilities: A Deep Dive into Software and Hardware Flaws
0:00 Introduction to ASUS Vulnerabilities: The video outlines several major security flaws discovered in ASUS software and hardware, including Armory Crate, DriverHub, the MyASUS RMA system, and ASUS routers.
0:40 Active Router Exploit ("Ace Hush"): An ongoing campaign is exploiting ASUS routers to build a botnet. Attackers leverage legitimate router features to gain permanent remote access, with vulnerabilities even found within ASUS's "AI Protection." These backdoors persist in non-volatile memory (NVRAM) and are not removed by firmware updates, necessitating proactive firmware updates before compromise.
0:53 MyASUS RMA System Data Exposure: A critical flaw in the MyASUS RMA (Return Merchandise Authorization) system was found to contain hardcoded administrator credentials. This vulnerability could have exposed millions of customer records, including full names, dates of birth, phone numbers, and addresses.
1:47 "Code Smell" of ASUS Software: The presenter describes a pervasive "code smell" in ASUS software, particularly Armory Crate, due to its aggressive, unprompted installation (even offline) and its ability to survive system reformats, behaving like a "subsurface vulnerability" beneath the operating system.
2:46 Criticism of Bloatware Practices: ASUS is heavily criticized for persistently integrating bloatware that acts like malware, a practice that is unfortunately being adopted by competitors like Gigabyte and ASRock.
5:57 DriverHub Remote Code Execution (RCE): A "zero-click RCE" vulnerability in ASUS DriverHub software allowed an attacker to download and execute arbitrary files as an administrator. This was achieved by exploiting how the local service handles URL validation, allowing a malicious site containing "driverhub.asus.com" in its URL to trigger a silent installation of malware. The issue was patched on May 9th.
10:57 Recommendation: Uninstall DriverHub: Users are strongly advised to uninstall DriverHub, as manually updating drivers is simple and removes a permanent system liability.
11:31 Disincentives for Security Researchers: ASUS's response to vulnerability disclosures is criticized for being underwhelming, offering only a "thank you email" and decontextualized credit, which discourages researchers from reporting future findings.
12:35 MyASUS / RMA System Vulnerability Details: The "Ace Suspicious" vulnerability affected users with an ASUS account, particularly those who used the RMA system. The hardcoded credentials allowed access to sensitive personal data. This issue was patched by May 12th.
16:51 Unreasonable Demands on Researchers: ASUS requested researchers to test their fixes and allow preview of blog posts without compensation, which is deemed an unfair burden on those who disclosed vulnerabilities for free.
17:58 Ace Hush - Router Botnet Details: Grey Noise's report detailed the ongoing exploitation of ASUS routers, where attackers enable legitimate features for persistent remote access. The vulnerabilities include those within ASUS's "AI Protection" feature. Crucially, the backdoors are in NVRAM, making compromised routers difficult to clean even with firmware updates. Users must proactively update firmware and consider factory resets.
20:31 Persistent Armory Crate Issues: Armory Crate continues to be problematic due to its self-propagating nature. Its BIOS toggle, which enables its reinstallation, is often reset by future BIOS or even Windows updates, forcing users to repeatedly disable it.
21:24 Armory Crate Kernel Driver Vulnerabilities: Recent patches for Armory Crate address critical vulnerabilities (CVE2025-2027 and CVE2024-12957) in its ASIO3.sys kernel driver. These include buffer overflows and authorization bypasses via Windows hardlinks, which could grant kernel-level arbitrary code execution.
24:08 Other Recent ASUS Patches: Minor updates addressed a MyASUS service crash vulnerability and an Armory Crate flaw allowing arbitrary file deletion.
24:53 Overarching Critique of ASUS Practices: The presenter argues that while all vendors have vulnerabilities, ASUS is distinct in its deliberate introduction of additional risks through bloatware that users often don't want. Given ASUS's massive size and resources, these practices create widespread, unnecessary security liabilities, potentially exposing millions of customer records.
26:57 Final Recommendations: Users are advised to uninstall unnecessary ASUS software and maintain up-to-date router firmware to mitigate the risks introduced by these practices.