Quote:These files could not have come from either our Windows image or the network, leaving the motherboard's 16-megabyte UEFI BIOS as the only suspect. The files themselves, which total around 3.6 MB in size, appear harmless, and belong to an ASUS-made program called "ASUS Armoury Crate." This program fetches the latest drivers for your hardware from ASUS servers, and installs them for you in an automated process with little user-intervention. This is a very useful feature, as it establishes a method to install network driver and other drivers easily, without the need for a physical driver disc (in times where nobody has an optical drive anymore). After digging around in the UEFI BIOS, we managed to find a fairly nondescript option "Download and Install ARMOURY CRATE app", which of course defaults to "on"; and it's not easy to find, being located in the "Tool" section of the BIOS setup.
...
By default, the ASUS UEFI setup program for our motherboard has the "Download and Install Armoury Crate App" option enabled. Unsuspecting users who glossed over their UEFI setup configuration before installing their OS for the first time, will see the Armoury Crate pop-up even if their machines are not configured to access the Internet. This would do wonders for increasing the user-base of ASUS' software, but are you comfortable with something like this? Given NAND flash pricing, what stops motherboard vendors from embedding a flash-based USB mass-storage device directly onto their motherboards that installs a host of driver software and sponsored bloatware automatically?

If you put aside the privacy concerns for a moment, there are both advantages and disadvantages for what ASUS is trying to accomplish. Since it's enabled by default, this method makes installing drivers and system software easier than ever, since it also gets the network controller to work. It's particularly useful given that motherboard vendors continue to ship drivers on a DVD, and optical disc drives are on the decline, leaving people with little option but to copy their drivers onto a USB flash drive, just to get the NIC working. The application also fetches the very latest (most stable) versions of drivers found on ASUS website. The most obvious disadvantage is cybersecurity. If any of ASUS' on-chip code has security vulnerabilities that can be exploited, there is little way to fix it but with BIOS updates from ASUS.

ASUS needs to make a few changes and release UEFI BIOS updates, on the double. One option could be to disable the Armour Create option in BIOS by default, so unsuspecting users don't get these files. It could be advertised in the home-screen of the UEFI setup instead. Another option could be to properly clean up the installed files if the users chooses to not use Armoury Crate and not install them again on next reboot. Also required is a GPDR-compliant license agreement, that clarifies which data is collected, how it is processed, and whether it is shared with third parties. While this probably won't happen, some kind of ASUS warranty to include liability for any future malware that exploits WPBT to survive OS reinstalls, would go a long way.

We're sure that as a market-leading motherboard vendor, the intentions behind this couldn't have been bad. It only needs a bit of polish, and a lot of transparency with the user.