AI
The String Contains Bug: How ASUS DriverHub Validated Origins
ASUS DriverHub runs a local web server that accepts commands from driverhub.asus.com. The server checked the Origin header using a string contains function. Any domain containing “asus.com” passed the check. An attacker could host a page on a subdomain like attacker.asus.com and send a fetch request to the local server. The reboot endpoint worked with any such origin. The update app endpoint downloaded and executed a PE file. The server only verified that the PE’s properties contained “ASUS tech computer inc” – not the actual signature. A tool cloned those properties from a valid binary. The result: one-click remote code execution from a browser.
Missing Verification in MSI Center’s Execute Task
MSI Center runs a privileged TCP service that accepts binary commands. One command, auto update SDK, copies a target executable to a temp folder, verifies its signature, then runs it as SYSTEM via a scheduled task. The verification and execution were not bound together. A race condition could swap the verified file with an unsigned payload. A second command in a different DLL had its own execute task implementation with zero verification. It accepted any target and ran it as SYSTEM immediately. The exploit became four lines of code: connect to the TCP socket, send the command bytes, and get local privilege escalation.
Named Pipe with File All Access: Remote Code Execution and LPE
Acer Control Center uses a named pipe between a .NET client and a native service running as SYSTEM. The pipe was created with FILE_ALL_ACCESS, meaning any user on the network could connect. The client’s send command function took a target path and an integer argument. The service ran the target via CreateProcessAsUser. With argument 113, the process ran as the connecting user. Changing it to 114 made the process run at a higher integrity level (SYSTEM). Because the pipe permissions were open, this worked remotely. An attacker on the same network could connect to the pipe, send command 114 with a payload path, and execute code as SYSTEM on the victim machine.
Razer Elevation Service: COM Object and Patched DLL
Razer Synapse 4 includes a Razer Elevation Service running as SYSTEM. It exposes a COM object with a LaunchProcess method. The client side used a node-FFI library to call a native DLL (SimpleService.dll) that performed code signing checks. By patching out the certificate validation in that DLL, any executable could be launched. The payload also needed a UAC manifest to run elevated. A colleague later showed that the COM object could be called directly from PowerShell in one line: New-Object -ComObject "Razer.ElevationService" then LaunchProcess("payload.exe"). No patching required. The one-liner gave local privilege escalation on any unpatched Razer Synapse 4 installation.
Disclosure Lessons and the Pone Triad
ASUS’s disclosure page had a WAF that blocked the researcher’s payload submissions, causing delays. A research collision occurred: another researcher reported the same origin bypass two months later, but ASUS credited only the first reporter. MSI responded fastest with clear communication and the first fix. Razer used a bug bounty program that fronted the security team, but internal ticket routing created unnecessary delays. Jacobs proposed the “Pone Triad”: find a privileged service with an RPC mechanism (named pipe, COM, TCP), check for authentication or validation issues, and you will find a vulnerability. He noted that products in 2025 still ship with silly RPC implementations that should not exist.
Notable Quotes
I’m really just showing you how to reboot your friend’s computer. Leon “leonjza” Jacobs · ▶ 9:09
It’s such a silly like connect to the name pipe pass a target run thing. Leon “leonjza” Jacobs · ▶ 25:21
I couldn’t believe how many tickets on an internal system ended up in my mailbox as they’re sort of pushing this around. Leon “leonjza” Jacobs · ▶ 38:41
If you find a privileged service that has an RPC mechanism, be it a name pipe, com object, TCP, whatever you think you’re having, check if there’s an authentication or a validation issue, which there probably is. Leon “leonjza” Jacobs · ▶ 38:53
Key Takeaways
- ASUS DriverHub’s origin validation used string contains, allowing any domain with “asus.com” in it.
- MSI Center’s auto-update SDK command lacked binding between verification and execution, enabling a race condition.
- Acer Control Center’s named pipe had FILE_ALL_ACCESS, allowing remote code execution and LPE by changing an argument from 113 to 114.
About the Speaker(s)
Leon “leonjza” Jacobs is the CTO of Orange Cyberdefense’s SensePost Team. With over two decades in IT and 15 years in cybersecurity, his career spans Tier 1 ISP, private investment banking, and full-time consulting. He researches and hacks enterprise networks, web, and mobile applications, and regularly contributes tools and insights to the InfoSec community.