Millions of PC Motherboards Were Sold With a Firmware Backdoor (wired.com) 77
Hidden code in hundreds of models of Gigabyte motherboards invisibly and insecurely downloads programs -- a feature ripe for abuse, researchers say. From a report: Hiding malicious programs in a computer's UEFI firmware, the deep-seated code that tells a PC how to load its operating system, has become an insidious trick in the toolkit of stealthy hackers. But when a motherboard manufacturer installs its own hidden backdoor in the firmware of millions of computers -- and doesn't even put a proper lock on that hidden back entrance -- they're practically doing hackers' work for them. Researchers at firmware-focused cybersecurity company Eclypsium revealed today that they've discovered a hidden mechanism in the firmware of motherboards sold by the Taiwanese manufacturer Gigabyte, whose components are commonly used in gaming PCs and other high-performance computers. Whenever a computer with the affected Gigabyte motherboard restarts, Eclypsium found, code within the motherboard's firmware invisibly initiates an updater program that runs on the computer and in turn downloads and executes another piece of software.
While Eclypsium says the hidden code is meant to be an innocuous tool to keep the motherboard's firmware updated, researchers found that it's implemented insecurely, potentially allowing the mechanism to be hijacked and used to install malware instead of Gigabyte's intended program. And because the updater program is triggered from the computer's firmware, outside its operating system, it's tough for users to remove or even discover. "If you have one of these machines, you have to worry about the fact that it's basically grabbing something from the internet and running it without you being involved, and hasn't done any of this securely," says John Loucaides, who leads strategy and research at Eclypsium. "The concept of going underneath the end user and taking over their machine doesn't sit well with most people."
While Eclypsium says the hidden code is meant to be an innocuous tool to keep the motherboard's firmware updated, researchers found that it's implemented insecurely, potentially allowing the mechanism to be hijacked and used to install malware instead of Gigabyte's intended program. And because the updater program is triggered from the computer's firmware, outside its operating system, it's tough for users to remove or even discover. "If you have one of these machines, you have to worry about the fact that it's basically grabbing something from the internet and running it without you being involved, and hasn't done any of this securely," says John Loucaides, who leads strategy and research at Eclypsium. "The concept of going underneath the end user and taking over their machine doesn't sit well with most people."
Grounds for a factory recall (Score:4, Interesting)
This really should be grounds for a factory recall.
Re:Grounds for a factory recall (Score:4)
Re: (Score:2)
Presumably they could disable it in a normal BIOS update that the user downloaded, instead of forcing it. It's pretty easy, as they use @BIOS (or at least my 990FX-G1-Gaming did, and also the board I had before it, GA-MA770T-UD3P.
My G1 Gaming died and I just got what was cheap and convenient, now I have ASRock. Fingers crossed they turn out to be better than giga-byte.
Re: Grounds for a factory recall (Score:2, Informative)
Re: (Score:3, Informative)
The article says it uses UEFI not BIOS.
What'll blow your mind is that when you boot up the machine it says UEFI BIOS. Cookie?
Re: (Score:2)
The article says it uses UEFI not BIOS.
That it uses UEFI is not surprising. It's exactly the UEFI that makes such shenanigans viable and easy to implement.
Re: (Score:2)
BIOS defined the PC compatible platform. Without it, DOS and DOS compatible OS's couldn't exist because the interrupts supplied by the BIOS didn't exist. An X86-based platform could exist with its own firmware implementation that wasn't BIOS, but then we'd have the same issue of the 6500 series computer platform: a billi
Re: (Score:2)
Re: (Score:2)
The purpose was to simplify finding and installing drivers
For the paranoid, that excuse does not fly.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: Grounds for a factory recall (Score:2)
I'd bet we could have 10x or 100x as many recalls before everyone is like "screw this, we're doing coreboot".
Nonpaywall Link (Score:5, Informative)
Saw the story on Reddit earlier and someone shared that link.
List of affected models (Score:5, Informative)
This was shared as well
UEFI, the gift that keeps on giving (Score:1)
Luckily it's only "hackers" that might use this gift, and there's not too many of them around, so we're safe, right? Right?!?
Re: (Score:2)
Use coreboot (Score:5, Informative)
Re: Use coreboot (Score:2)
It takes a lot of work to make a motherboard support coreboot. Maybe their development cycle will speed up with more interested users and more tools like AI assisted coding/hacking GPIO stuff/etc.
Re: (Score:2)
Re: (Score:3)
Re: (Score:3)
AMD is headed in that direction, but it's gonna be a while.
Re: (Score:3)
One of my motherboards is from Gigabyte and is on that blacklist (BAD).
I read the FA and my understanding is that this silent update requires Windows to work. In my case GOOD because that system runs exclusively under Linux.
Re: (Score:2)
No idea where you got that "understanding" because I actually read TFA and it said nothing about that at all. The updater runs in UEFI in a feature called "APP Center Download & Install". It doesn't touch the OS, it downloads and updates the firmware entirely from UEFI code.
tl;dr Doesn't matter what OS you're running.
Re: (Score:2)
Say it isn't so (Score:1)
Re: (Score:3)
If you have anything AM4ish or newer on the AMD side, support for firmware updates without a CPU is a chipset feature. I won't touch an MSI board for unrelated reasons, but you should still be able to do it on at least one of the root hubs on the I/O backplate.
Bloody hell! (Score:3)
What kind of incredible idiot comes up with such an idea and what kind of absolute asshole signs off on it? Nobody can credibly claim today they were not aware of the extreme danger they expose their customers with that.
Re:Bloody hell! (Score:4, Informative)
Pretty much everyone, from incompetent diversity hire to an overzealous nerd who's told that users don't update their firmware enough.
Windows 10 taught a lot of people that their computer will just update random shit out of the blue with no user control over the entire process. This is simply an extestion of so many people having been forced to learn this.
(In before some brainlet screeching that you can defer updates).
Re: (Score:2)
"incompetent diversity hire"? In Taiwan? Take your woke mind-virus and sit on it.
Re: (Score:2)
Wait, you think coding work isn't outsourced to cheapest source that is still sufficiently ESG and SEL compliant to ensure that capital remains cheap?
Re: (Score:2)
So it's pretty normal nowadays that people don't read past the first paragraph. It's getting unfortunately somewhat common that people don't read past the first sentence.
You didn't even finish the first sentence before angrily typing out multiple sentences of angry bitching, all of which was in fact pre-emptively debunked in the... single sentence response you didn't finish reading.
Are you projecting the AI part?
Re: (Score:3)
Re: (Score:2)
Ah yes. I did see that "download something" option on my last non-gigabyte mainboard as well. Looked fishy to me, so I disabled it along with the UEFI network stack. I hope I will not have to start to firewall PCs until the OS runs. Can be done but would be a pain.
But seriously, with friend like these who needs enemies?
Re:Bloody hell! (Score:4, Interesting)
Re: (Score:2)
So Microsoft is supporting this crap? The mind boggles.
Re:Bloody hell! (Score:4, Informative)
Unfortunately some manufacturers use this mechanism to install random garbage that subverts the OS. (Windows also has it's own mechanism to update the firmware via UEFI capsules. The crap from TFS is apparently Gigabyte's version baked into the firmware and installed via the boot driver support.)
For fun, Here's a github project that installs crap into that firmware table. [github.com]
Re: (Score:2)
Incredible. Windows really has to be treated as somewhat benign malware these days.
Thanks for the link, very interesting.
Oh Jesus! The horror! (Score:3, Funny)
This would mean that someone other than microsoft, my ISP, the application developers, facebook, google, five eyes, china and russia could snoop my data!
Re:Oh Jesus! The horror! (Score:4, Insightful)
Re:Oh Jesus! The horror! (Score:4, Insightful)
Or that random asshole could use your computer to host his kiddie porn, and the FBI would like a word with you.
Feel like fixing it now?
Re: (Score:3)
So unless you have a log o
Re: (Score:2)
This kind of defense always turns into a you need to prove it happened as opposed to that it could have happened
Add to this that by the time you are asked for such proof, you are in a rather bad situation to prove anything at all about your computer. Indeed, you no longer have it. They typically take it away from you early on, after all.
So unless you have a log of all the network connections to your computer along with the payloads
That also presumes that the judge has a sufficient understanding about computers to not (willfully or not) misinterpret those logs.
Re: Oh Jesus! The horror! (Score:2)
Weird. You forgot Intel and AMD themselves. Or is that being too paranoid? Ahahaha. We really should audit all the things.
Re: Oh my, ... (Score:2)
I don't get what makes you think Apple can't have malicious employees hired/blackmailed into adding bugs/backdoors/whatever.
Where is Gigabyte based? (Score:2)
They are Taiwanese company. Not Chinese. Therefore its more likely that the NSA got them to build this backdoor into their products! Unless... it was the Taiwanese themselves!!!111
Can we add something from this to Mitre ATT&CK? Its pretty sparse on American threat actors, or Taiwanese for that matter.
Re: (Score:2)
Second, don't attribute to malice what can be attributed to incompetence.
Remember when I predicted this? (Score:1)
yawn... it's starting to get cliche.
Re: (Score:2)
It is hard NOT to predict it. What are the "management engines" doing inside of CPUs? Waiting for a signal from the cell network? Ready to do what the key holder (not you!) wants? Over wireless comms?
The current situation is because real security doesn't matter to the manufacturers, not because the authorities needed a back door.
But Microsoft (Score:2)
"The concept of going underneath the end user and taking over their machine doesn't sit well with most people." - Microsoft has been doing this for over a decade now and people still use Windows. What are sheeple to do?
A feature (Score:2)
asus's "armory crate" (Score:2)
does something similar
it can be disabled in uefi though
are these two equivalent?
I have to wonder (Score:2)
Looks like it requires Windoze (Score:2)
and only does the HTTP part during the Windoze bring up. So not ever going to affect non-Windoze OSes, thankfully.
Also, they say it is disabled by default - "The âoeWpbtDxe.efiâ module checks if the âoeAPP Center Download & Installâ feature has been enabled in the BIOS/UEFI Setup before installing the executable into the WPBT ACPI table. Although this setting appears to be disabled by default, it was enabled on the system we examined."
Blacklist (Score:3)
http://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4
https://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4
https://software-nas/Swhttp/LiveUpdate4
I would also block them by both the DNS name as (like in a pihole) and via IP address (such as in an IP tables outgoing destination and incoming source drop). This only works if you are not connecting directly to the internet with that hardware and are going through some kind of router and/or DNS that you have control over.
Yeah but it's Gigabyte (Score:2)
Given their complete incompetence when it comes to actual firmware updates that are supposed to happen on purpose I I'm of a firm belief that not even the world greatest hacker could exploit this, or indeed get they firmware updated if they are sitting at the pc in question logged in as root.
Or maybe the NSA coded this. In which case thankfully we finally have a way of updating the firmware which may work.
Aargh (Score:2)
I just bought one of these boards. Figures. I agonized about what board to buy for months. I wanted an Asus board, but couldn't find one with what I wanted that was obtainable in my price range. (I refuse to pay $400 for a board when a $100 board will do just fine, I'm not a gamer.) It's in the process of becoming my primary system. I guess if it tries to inject crap into the system32 folder, it won't find it, since the only windows OS on it is in a VM. I'd imagine there's a way to turn it off, and if
Congress could fix this... (Score:2)
Congress could change the jurisdiction of the (US) Federal Courts so that anyone who is victimized by a back door can sue the people who put it in for $1 per byte of data that can not be proven to not be affected. That would be Trillion$ per PC hacked.
Congress could make it a "corporate felony" to distribute anything you put a back door into. When I say "corporate felony" I mean a new class of felony where every officer of that corporation and every owner of that corporation (including stock holders) all s
UEFI is not secure (Score:2)
I noticed this after a clean Win11 install. (Score:2)
Windows Feature (Score:2)
Windows does that, downloads and installs whatever executable for your hardware, which might be nice for some people.
For the TLDR (Score:2)
Gigabyte, welcome to ... (Score:2)
My Banned-For-Life list.
Re: (Score:2)
Seem to be two or three things one should do (Score:3)
Reading the comments and the piece, conclusions:
Seems that if you are not running windows (or only in a VM) you will be immune, is this right?
Then you should anyway immediately block the URLs, in your router, and find out what the IP address associated with them is, and block them too.
And check in the UEFI settings whether this feature is blocked - it is reported to be off by default, though the one they looked at had it on.
Will this fix it? Are you still exposed if only running Linux in bare metal mode?
I have a machine with an affected board just ready to be commissioned. Absolutely infuriating that they would do this.
Seems the urls are now offline? (Score:2)
Seems like the urls have been taken offline? I am getting 404.
Re: (Score:2)
The action is all (including all network accesses) in Windoze. The only thing the UEFI does is place a Windoze driver into a reserved EFI space for Windoze to later execute.
And it's disabled by default anyway.