Researcher warned ASUS of hacking risks two months ago, after finding ASUS staff published passwords to GitHub repos; some passwords were public for over a year
Context & Ripple Effects
This lands days after ASUS confirmed its software update tool was hit by Advanced Persistent Threat attacks and released a checker for affected devices, following Kaspersky's finding that roughly 500K Windows machines received a malicious backdoor through that compromised tool. Now a researcher reports ASUS staff had passwords sitting in public GitHub repos — some for over a year — and warned the company about it two months ago.
The pairing matters because both failures sit on the same seam: the credentials and code paths that let ASUS push trusted software to customers. An update channel already shown to be attacker-compromised, run by a team whose secrets were publicly exposed, is a compounded operational-security problem rather than two isolated incidents.
First-order effects
- ASUS is now handling a second active disclosure in one week: it must rotate any credentials exposed in those GitHub repos and audit what those passwords could reach, while still triaging the update-tool compromise it only confirmed yesterday.
- The researcher's two-month-old warning becomes evidence against ASUS's disclosure timeline — the company sat on a known credential exposure even as attackers were exploiting its update infrastructure.
Second-order effects
- Rival PC makers face forced audits of their own developers' code-hosting hygiene, since the ASUS case shows vendor secrets leaking through the same GitHub accounts used for legitimate firmware and driver work.
- Enterprise buyers weighing ASUS hardware get fresh ammunition for procurement demands around software supply-chain controls, pressuring vendors to prove who can sign and push updates.
Third-order effects
- If the pattern holds — ASUS's compromised update tool alongside the long-running backdoor later found in Huawei's HiSilicon chips — hardware vendors' build-and-update pipelines become a regulated audit surface rather than a private engineering matter.
- Developer credential leakage on public code platforms shifts from an individual slip-up to a board-level vendor risk, pushing manufacturers toward secret-scanning and mandatory rotation as standard practice.
The trend: PC and device makers are being judged less on product vulnerabilities than on whether their software supply chains — signing keys, update servers, and developer credentials — can be trusted at all.