Eclypsium, a firmware-focused cybersecurity company, has shared a list of 271 motherboards sold by GIGABYTE that, according to researchers, include a hidden backdoor in the firmware that could be used by attackers to install malware onto a system. “Our […] analysis discovered that firmware in Gigabyte systems is dropping and executing a Windows native executable during the system startup process, and this executable then downloads and executes additional payloads insecurely,” Eclypsium explained in a blog post dated today that details the company’s key findings, including the level of impact and what organizations with the affected motherboards can do to minimize risk. Eclypsium says it’s working with GIGABYTE to address the issue, which appears to stem from the App Center feature.
From an Eclypsium post:
This backdoor appears to be implementing intentional functionality and would require a firmware update to completely remove it from affected systems. While our ongoing investigation has not confirmed exploitation by a specific threat actor, an active widespread backdoor that is difficult to remove poses a supply chain risk for organizations with Gigabyte systems.
The firmware does not implement any cryptographic digital signature verification or any other validation over the executables. The dropped executable and the normally-downloaded Gigabyte tools do have a Gigabyte cryptographic signature that satisfies the code signing requirements of Microsoft Windows, but this does little to offset malicious use, especially if exploited using Living-off-the-Land techniques (like in the recent alert regarding Volt Typhoon attackers). As a result, any threat actor can use this to persistently infect vulnerable systems either via MITM or compromised infrastructure.
Discussion (17 replies)
Join Discussion →Oh wow... nice. that's no fun.
Not being a security specialist, and not seeing the name(s) in various places I decided to do a search on "Living-off-the-Land techniques (like in the recent alert regarding Volt Typhoon attackers)" and came up with this which I find a whole lot more scary. The worst part is that the following is from last week.
[URL unfurl="true"]https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/[/URL]
Well... shit.
Gigabyte pushes Trojans, MSI changes the warranty at will, and Asus will damage your hardware. Who's left? Does EVGA still make motherboards?
(Not Asrock for me, although some folks have had good luck there)
They make power supplies, and have seemingly no interest in selling custom connectors for the HPV.. HVP... whatever the new connectors are called. I've tried...
That EVGA legendary support is lacking.
Yeah, I hate to say it and I am a huge fan of them but I'm just waiting for the day when we hear that they're closing up shop. I'm still on their email list and get the semi-weekly sales flyers but I don't see much of anything new and wonder how they're staying afloat. It saddens me to no end.
Part of me hopes they are simply awaiting an end of exclusivity deal with Nvidia to start making AMD and Intel boards.
That. . . .would be awesome! It's been so long since their announcement in September that I'd forgotten about that possibility. A lot of us were hoping for that. Not that I have any contacts but I'll try to shoot them an email inquiring about the possibility.
I can't say that I blame them. No one wants HPV.
It took me a while to remember it and if it wasn't for writing here I wouldn't remember either.
12VHPWR (12 volt high power)
Yeah, a round of immunizations for the rig after an HPV infection can be rough.
At first I tried to memorize the acronym itself instead of the meaning behind it, and that didn't work out. I was straight-up just calling it "twelve V H P W R". When I started actually saying "12-volt high power" that's when I was able to remember the acronym.
Yep, same for me. I figured someone would get that as well and why I put it in that reply. Once you say it, it sticks, but until then its just another one of the unending acronyms we're constantly getting flooded with. I've been joking since college that there needs to be a moratorium/ban on them for a bit.
I still have my EVGA Z690 Classified here. Been an awesome board. If I ever decide to go make to a more traditional non white themed set up I'll use it again.
Is it just me or has the whole industry kind of forgot about Quality Control as of late? I was in QC for over twenty years and this just screams of bad QC for all of the above.
I've seen some great sales for the Dark Kingpin versions of it and I think, maybe, the 790 as well. I almost jumped on one but not really want to go that route right now. However, haven't really heard of any new motherboards since or at least I'm not noticing any in their flyers which is why I'm doubting their current state.
Yeah once their GPU manufacturing stopped they have stayed in a Dark state..yes pun was intended.