Some models of Gigabyte motherboards download firmware updates insecurely

Isn't this enabled by default? I just recently set up a new computer with someone and ran into it.

...which actually is not a "Firmware backdoor" but the usual "crappy Windows companion app" malware...

> What they actually found is that Gigabyte's motherboard software auto-updates over HTTP, which makes it vulnerable to a MitM.

So the next question probably should be, are we sure there is no other signing mechanism at play here? If the blob downloaded needs to pass some sort of signature verification to be loaded, the use/lack of HTTPs wouldn't be a big factor in the security model.

Right - people who are upset that their motherboard can just drop arbitrary executables into their OS ZOMG would do well to consider the fact that their motherboard is literally handling executing their OS and managing all input and output.

The issue here is not motherboard can execute arbitrary code. Motherboards are trusted hardware. You pass all your keystrokes, network traffic and memory transfers over it.

The issue is motherboard uses its trusted status to run software that performs raw HTTP downloads for firmware. Which is probably bad but might alternatively just be futureproofing to avoid having to deal with expiring certs.

HTTP, and no check of the executable signature. I'd say the latter is the worse offence, but the two flaws really come together to provide an excellent MitM vector.

"Eclypsium says it found Gigabyte’s hidden firmware mechanism while scouring customers’ computers for firmware-based malicious code, an increasingly common tool employed by sophisticated hackers. In 2018, for instance, hackers working on behalf of Russia’s GRU military intelligence agency were discovered silently installing the firmware-based anti-theft software LoJack on victims’ machines as a spying tactic. Chinese state-sponsored hackers were spotted two years later repurposing a firmware-based spyware tool created by the hacker-for-hire firm Hacking Team to target the computers of diplomats and NGO staff in Africa, Asia, and Europe. Eclypsium’s researchers were surprised to see their automated detection scans flag Gigabyte’s updater mechanism for carrying out some of the same shady behavior as those state-sponsored hacking tools—hiding in firmware and silently installing a program that downloads code from the internet."

> The rest of the article is just ranting

I am puzzled by your conclusion.

Edit:

> enable the option in the BIOS to install Gigabyte's software it will end up being installed

Am i blind? Zero snark intended but where in the article is that mentioned?

In the past, I could just ignore the CD in the motherboard box with all the crapware. In the more recent past, I didn't have a CD drive to even put it into.

Now, that junk is preloaded onto the motherboard? Argh.

At least I can still opt not to install it, but jeez.

I don't see what would stop it from downloading and running an update that would work with Linux, it's that Gigabyte has little financial incentive to create a Linux updater. A malicious actor may, though probably doesn't given Gigabyte's target market.

Yeah, both for drivers and for anti-theft tools like Intel's.

In the Windows 9x era, it was common for the BIOS to hotpatch the windows kernel to install various bits of 'security' software.

Even today, I think this is how the Dell Computrace anti-theft mechanism works. If you format the disk and install windows afresh, the computrace agent will install itself on the first bootup and ping the internet to see if the system is marked stolen. If you run Linux on your stolen machine, it works fine.

Obviously there are (stolen) "Linux" machines on ebay which work fine, unless you install windows even once, and then they become computrace locked.

nm, didn't read far enough:

> During the Driver Execution Environment (DXE) phase of the UEFI firmware boot process, the “WpbtDxe.efi” firmware module uses the above GUID to load the embedded Windows executable file into memory...

It's called WPBT. The answer is yes. This "backdoor" is Windows performing exactly as designed. It's a documented feature.

Even if a vendor doesn't use WPBT because the reputation of WPBT its a bit iffy these days, they'll just create a fake ACPI node that triggers WIndows Update to download a specific driver from the vendor, which is basically the same thing.

MSI uses this second option for the almost identically named option in the BIOS, and it will also download as much "potentially unwanted applications" as Gigabyte's (was that the Windows Defender euphemism for vendor malware again?) .

Like Gigabyte, it's an option which is disabled by default, but tends to "get enabled" a lot. They don't really have to sneak it in -- even power users enable it since they see the motherboard crapware as a benefit (e.g. temperature sensing, color LED strips and related crap)

I like how you have people waxing poetic about "consumer" equipment while probably having supermicro devices in a rack with a direct line to Beijing.

Also, the mainland binaries are usually the ones with the backdoor.

List of affected models:

https://eclypsium.com/wp-content/uploads/Gigabyte-Affected-M...

I was just about to post links. I'm not sure why Wired couldn't be bothered to actually link to the report in question. They're certainly happy to link to their own content. I guess it's another example of the "can't let anyone leave our silo" mentality.

This wouldn't help 99% of Gigabyte customers.

For many pieces of software you NEED Windows to run the firmware upgrade application. Example the WD SN 850x.

Nowadays they make them dependant on the serial number of the device, the idea being if you get locked out of your own device you can contact the manufacturer with the serial number and recieve the override code.

Quite predictably however, some motivated individuals have reverse-engineered how these codes are generated and made online tools that can generate them as well(1).

[1] https://bios-pw.org/

The Huawei modem my ISP uses has a hardcoded admin password that can't be changed. It's actually higher privileges than the login you're supposed to use.

So I ended up building a separate firewall to isolate myself from that thing.

In the past OEMs would put passwords on motherboard BIOS, they were usually default codes but kept customers people from pushing F1 on boot and getting in to do bad things easily.

Take a Linux device with 2 network ports.

Bridge the network ports.

Install WireShark.

Port 1 to router, port 2 to motherboard.

Boot computer and see what goes over the bridge?

By not using Windows or somehow instructing your Windows not to run this file at startup.

This is an intended feature of EFI/Windows, used to implement device drivers and theft protection.

So short of "don't use EFI" or "don't use Windows", there's not much you can do. There shouldn't be an easy way to disable this, as it'll brick devices when it shouldn't (missing drivers), or doesn't brick devices when it should (bypassing theft protection).

There's a literal option in the BIOS setup to disable it. You then uninstall/disable the Gigabyte auto-updater and that's it.

Not using the built-in networking hardware would probably help.

I add an Intel ethernet card to systems that I build as they will offload more work than the typical Realtek controller on a motherboard.

Disabling that option makes the `%SystemRoot%\system32\GigabyteUpdateService.exe` binary mentioned by the original article stop appearing, so it seems so.

via WPBT/DXE

Yes because those disk we copied from friends, never contained any viruses...oh wait.

I'm guessing Gigabyte Control Center.