11 ms·
Some models of Gigabyte motherboards download firmware updates insecurely
- Double_a_92 3y agoIntel Management Engine ?
- agloe_dreams 3y agoI'm guessing Gigabyte Control Center.
- AshamedCaptain 3y agoWhat they actually found is that Gigabyte's motherboard software auto-updates over HTTP, which makes it vulnerable to a MitM. [EDIT: since it's not checking for any signature] The rest of the article is just ranting that if you enable the option in the BIOS to install Gigabyte's software it will end up being installed.
- jchw 3y agoIsn't this enabled by default? I just recently set up a new computer with someone and ran into it.
- devmor 3y agoYes, it is. It also force-installs certain driver packages and will re-install them on every boot no matter how many times you remove them. When I built my newest system I ended up reinstalling Windows 3 times before I figured out I had to disable it to get rid of the horrible audio software that kept getting force installed for my chipset and screwing up my settings.
- rickdeckard 3y ago...which actually is not a "Firmware backdoor" but the usual "crappy Windows companion app" malware...
- kevin_nisbet 3y ago> What they actually found is that Gigabyte's motherboard software auto-updates over HTTP, which makes it vulnerable to a MitM. So the next question probably should be, are we sure there is no other signing mechanism at play here? If the blob downloaded needs to pass some sort of signature verification to be loaded, the use/lack of HTTPs wouldn't be a big factor in the security model.
- deleted 3y ago[deleted]
- jameshart 3y agoRight - people who are upset that their motherboard can just drop arbitrary executables into their OS ZOMG would do well to consider the fact that their motherboard is literally handling executing their OS and managing all input and output. The issue here is not motherboard can execute arbitrary code. Motherboards are trusted hardware. You pass all your keystrokes, network traffic and memory transfers over it. The issue is motherboard uses its trusted status to run software that performs raw HTTP downloads for firmware. Which is probably bad but might alternatively just be futureproofing to avoid having to deal with expiring certs.
- tinus_hn 3y agoDon’t attribute to malice that which can be adequately explained by stupidity.
- Forbo 3y agoWhen it comes to corporations, don't attribute to stupidity that which can be adequately explained by greed. This could easily be avoided by having proper security engineering, but that costs money! They're only about a decade late to the whole post-Snowden "maybe we shouldn't trust unverified code delivered over interceptable cleartext channels" explosion.
- ikekkdcjkfke 3y agoThis motherboard security stuff should get Linus tech tips level attention and absolutely roast them to the point of a reform
- dustfinger 3y agoThat is a cute quote, but people still need to be held accountable for compromising the ability of millions of devices to update firmware securely. Stupidity or malice, the end result is the same. Having said that, hopefully someone will investigate whether or not there was ill intent.
- naruhodo 3y ago
- NohatCoder 3y agoHTTP, and no check of the executable signature. I'd say the latter is the worse offence, but the two flaws really come together to provide an excellent MitM vector.
- ajross 3y agoIs that part verified? The linked article doesn't say, and the Eclypsium blog post isn't really clear either. What they say is that the motherboard firmware is causing the resulting windows boot process to run code provided by the firmware (which is weird, but not insecure per se), and that this code is delivered over HTTP. They notably aren't saying that the firmware or loader is doing no validation on the executable. Most likely this has some sort of home grown signature on the blob, because if it didn't they instantly would have cooked up a MitM exploit to demonstrate. The fact that they didn't implies that it doesn't work. That's not to say this is a good design (it's clearly not) or that it can't be abused in non-malware ways (junkware, etc...). But it does seem like it's being spun as a clear security hole when my guess is that it isn't (it certainly hasn't been shown to be).
- NohatCoder 3y ago>> What they say is that the motherboard firmware is causing the resulting windows boot process to run code provided by the firmware (which is weird, but not insecure per se), and that this code is delivered over HTTP. No, the firmware copies a program from itself to Windows, that program then downloads and executes another program from the internet, without verifying it correctly. Article says: "The firmware does not implement any cryptographic digital signature verification or any other validation over the executables." So unless that is downright wrong the MitM path is wide open. There is a signature check built into Windows, but way too much stuff has been signed to make that a meaningful barrier.
- jeroenhd 3y agoThe Eclypsium blog post does state the following: "The firmware does not implement any cryptographic digital signature verification or any other validation over the executables." Unless your Windows was configured to only run signed software or Gigabyte would apply the Mark of the Web to these files (which would make it harder for them to run their own update process), the executable file downloaded and run as a service doesn't seem to get checked. As far as I can make out from the blog post, a MitM attack during the motherboard update process would allow for the motherboard to be flashed with malicious software which in turn would indeed allow for dropping Windows executables onto the system. Luckily, barely anyone uses the built-in online updater for their motherboards. The https://software-nas/Swhttp/LiveUpdate4 https://software-nas/Swhttp/LiveUpdate4 URL is a pretty potential risk. You don't even need MitM to pretend to be that URL as it's not a FQDN. If there's any kind of HTTPS certificate validation that URL seems pretty useless in general. Maybe it's some kind of internal testing server that made it into production?
- scns 3y ago"Eclypsium says it found Gigabyte’s hidden firmware mechanism while scouring customers’ computers for firmware-based malicious code, an increasingly common tool employed by sophisticated hackers. In 2018, for instance, hackers working on behalf of Russia’s GRU military intelligence agency were discovered silently installing the firmware-based anti-theft software LoJack on victims’ machines as a spying tactic. Chinese state-sponsored hackers were spotted two years later repurposing a firmware-based spyware tool created by the hacker-for-hire firm Hacking Team to target the computers of diplomats and NGO staff in Africa, Asia, and Europe. Eclypsium’s researchers were surprised to see their automated detection scans flag Gigabyte’s updater mechanism for carrying out some of the same shady behavior as those state-sponsored hacking tools—hiding in firmware and silently installing a program that downloads code from the internet." > The rest of the article is just ranting I am puzzled by your conclusion. Edit: > enable the option in the BIOS to install Gigabyte's software it will end up being installed Am i blind? Zero snark intended but where in the article is that mentioned?
- AshamedCaptain 3y agoYes, it is ranting. They don't actually present any exploit for it. They are just saying "someone once found a way to exploit the firmware, therefore all firmware is vulnerable!" which is very lousy. There is no hint for example that this can be converted into a "persistent hiding-in firmware" backdoor anymore than any other regular Windows install. The fact that the software is distributed via WPBT is almost orthogonal to the vulnerability itself.
- Arrath 3y agoIn the past, I could just ignore the CD in the motherboard box with all the crapware. In the more recent past, I didn't have a CD drive to even put it into. Now, that junk is preloaded onto the motherboard? Argh. At least I can still opt not to install it, but jeez.
- eb0la 3y agoThat was the subject of a 1993 comic book: The Hacker Files #5 (published by DC Comics) https://www.comics.org/issue/216963/ https://www.comics.org/issue/216963/
- alexjplant 3y agoRelated question: do they still sell motherboards with master admin passwords like they did in the 90s? I remember finding a list of them someplace online then trying one on my friend's Award BIOS and being astounded that it worked. Seems unthinkable in this day and age but it was definitely a thing.
- DaSHacka 3y agoNowadays they make them dependant on the serial number of the device, the idea being if you get locked out of your own device you can contact the manufacturer with the serial number and recieve the override code. Quite predictably however, some motivated individuals have reverse-engineered how these codes are generated and made online tools that can generate them as well(1). [1] https://bios-pw.org/ https://bios-pw.org/
- jeroenhd 3y agoI used this to make a Dell laptop sold without password usable again. There was a setting to disable the override password, but that was left disabled. I do wonder what the point of this secure password is if you leave a backdoor password enabled anyway.
- kevin_nisbet 3y agoThe Huawei modem my ISP uses has a hardcoded admin password that can't be changed. It's actually higher privileges than the login you're supposed to use. So I ended up building a separate firewall to isolate myself from that thing.
- KingOfCoders 3y agoHow is this done with an encrypted drive?
- richij 3y agovia WPBT/DXE
- KingOfCoders 3y agoThanks (Medium I know) https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c https://grzegorztworek.medium.com/using-uefi-to-inject-execu...
- froglets 3y agoI wonder if printers do the same thing, since they all automatically update now to stop people from using generic toner.
- fallat 3y agoLet's just go back to Amigas
- jalk 3y agoYes because those disk we copied from friends, never contained any viruses...oh wait.
- primeradical 3y agoI have a Gigabyte B550 board, my particular board isn't listed but I know many of the boards on there share nearly identical components as well as the updater software. Probably safe to assume it's affected too?
- WirelessGigabit 3y agoTake a Linux device with 2 network ports. Bridge the network ports. Install WireShark. Port 1 to router, port 2 to motherboard. Boot computer and see what goes over the bridge?
- taylorbuley 3y agoAndy Greenberg is a great journalist! Read him, read everything he does.
- sylware 3y agoIt's the other way around: Which computer has no backdoors or "convenient bugs"?
- wmf 3y agoThis is not quite as bad as Lenovo Superfish, but maybe Microsoft should have learned a lesson from that and locked down WPBT. Maybe WHQL should extend beyond drivers to other pre-installed crapware.
- Havoc 3y agoConsumer board updating processes are so sketchy anyway I'm not sure it matters. Like here is a mystery zip file with a binary blob and no patch notes off some ftp server in asia. Frequently with a different binary for mainland china for unspecified reasons.
- boringuser2 3y agoI like how you have people waxing poetic about "consumer" equipment while probably having supermicro devices in a rack with a direct line to Beijing. Also, the mainland binaries are usually the ones with the backdoor.
- deleted 3y ago[deleted]
- vore 3y agoThis is just total FUD: https://hackaday.com/2019/05/14/what-happened-with-supermicro/ https://hackaday.com/2019/05/14/what-happened-with-supermicr... If you're going to make these claims, back them up.
- boringuser2 3y agoImagine thinking that actual people are emotionally invested in a brand. You don't use devices that reputable sources have directly indicated as having backdoors in a secure environment. Period.
- solarkraft 3y agoI'd like to see the reputable source. It surely can't be Bloomberg, which has provided no evidence.
- CTDOCodebases 3y agoThere are a multitude of ways that the boards they received could have been tampered with or even switched out and replaced with exact replicas without Supermicros knowledge or assistance. As it says in the audit that Supermicro themselves performed "A representative sample of our motherboards were tested..." which basically means nothing since they didn't examine the boards in question. Lest we forget[0]. I doubt the NSA are the only ones engaging in this type of behaviour. So as the Bitcoin people like to say "don't trust verify". [0] - https://www.schneier.com/blog/archives/2015/03/cisco_shipping_.html https://www.schneier.com/blog/archives/2015/03/cisco_shippin...
- ndneighbor 3y agoI think that these update systems aren't intentional backdoors but rather the product of a software team that was put under the gun so to speak. Many products nowadays just leak consumer data (like Toyota's teletronics for their cars) because PMs just demand more and more connected features. Still grossly irresponsible on Gigabyte's part...
- Animats 3y agoDoes this happen for data center motherboards, too?
- yrro 3y agoWhy don't _all_ models of Gigabyte motherboard have firmware upgradable with a simple 'fwupdmgr update'? https://fwupd.org/ https://fwupd.org/ Let the people who actaully know how to implement secure software repositories and tools for fetching content from them do their jobs. Motherboard manufacturers should stick to what _they're_ good at and just produce timely firmware updates throughout the life of the product.
- deleted 3y ago[deleted]
- wmf 3y agoThis wouldn't help 99% of Gigabyte customers.
- wtfishackernews 3y agoWhile fwupd does have a windows client, the obvious mechanism to use would be windows update, but anything is better than custom software for each vendor.
- yrro 3y agofwupd and Windows Update both use the same underlying packaging mechanism for shipping firmware updates. All my comments apply equally to https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/windows-uefi-firmware-update-platform https://learn.microsoft.com/en-us/windows-hardware/drivers/b... :)
- WirelessGigabit 3y agoFor many pieces of software you NEED Windows to run the firmware upgrade application. Example the WD SN 850x.
- yrro 3y agoYes and it's DISGUSTING
- boringuser2 3y agoNot even a *competent* junior developer would make this mistake.
- jonnycomputer 3y agoI'm curious whether this is the same thing as the Gigabit Utilities Downloader enable/disable option i see in bios
- Ralith 3y agoDisabling that option makes the `%SystemRoot%\system32\GigabyteUpdateService.exe` binary mentioned by the original article stop appearing, so it seems so.
- jonnycomputer 3y agoThank you for letting me know!
- slowhand09 3y agohttps://archive.is/ybixP https://archive.is/ybixP non-paywall link
- user6723 3y agoThere should be laws in place prohibiting closed source code from being distributed with silicon. inb4 intellectual property, UEFI software aren't special, they are trash
- nottorp 3y agoLovely how the article from Wired never mentions how the bios option to disable this is called. At least they linked the original article, but even that only mentions its name way down below near the end of the article, after telling you in 15 ways how the sky is falling.
- WirelessGigabit 3y agoThe Windows documentation is actually hard to find. I can only find it through a search engine: https://download.microsoft.com/download/8/A/2/8A2FB72D-9B96-4E2D-A559-4A27CF905A80/windows-platform-binary-table.docx https://download.microsoft.com/download/8/A/2/8A2FB72D-9B96-... But what is happening here is that Gigabyte actually downloads an application at startup and places _THAT_ one into the WPBT to be executed. Are they signed? Does Windows allow the execution of an exe from WPBT that is not signed, or self-signed? In my opinion Microsoft should release a patch that blocks WPBT execution on Gigabyte until they've proven that they're secure. That is what I expect from the OS.
- miffe 3y agohttps://archive.is/LHMFT https://archive.is/LHMFT
- LegitShady 3y agohttps://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/ https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-a...
- flyinghamster 3y agoI was just about to post links. I'm not sure why Wired couldn't be bothered to actually link to the report in question. They're certainly happy to link to their own content. I guess it's another example of the "can't let anyone leave our silo" mentality.
- programmarchy 3y agoList of affected models: https://eclypsium.com/wp-content/uploads/Gigabyte-Affected-Models.pdf https://eclypsium.com/wp-content/uploads/Gigabyte-Affected-M...
- creshal 3y agoAh, the joys of using obsolete hardware, looks like I missed the issue by one hardware generation.
- SketchySeaBeast 3y agoYeah, I was freaking. Good ol' Z390, too old to be worth hacking.
- pnemonic 3y agocries in Z170
- Simulacra 3y agomotherboards sold by the Taiwanese manufacturer Gigabyte, whose components are commonly used in gaming PCs and other high-performance computers.
- mschuster91 3y agoIt's been a few years, but didn't Windows include a feature back in the BIOS area to execute stuff from a BIOS area, IIRC to install drivers? Edit: Found it, it's called WPBT and was a thing at least in 2015 [1], with ASUS using it in 2018 to deploy an upgrade tool [2] and an APT group to deploy a rootkit named as "Lojax" [3]. [1] https://michlstechblog.info/blog/windows-identify-a-wpbt-binary-in-biosuefi/ https://michlstechblog.info/blog/windows-identify-a-wpbt-bin... [2] https://www.heise.de/hintergrund/Asus-verankert-Update-Tool-im-Mainboard-BIOS-4202621.html https://www.heise.de/hintergrund/Asus-verankert-Update-Tool-... [3] https://www.heise.de/news/Lojax-Der-Spion-der-aus-dem-BIOS-kam-4175535.html https://www.heise.de/news/Lojax-Der-Spion-der-aus-dem-BIOS-k...
- creshal 3y agoYeah, both for drivers and for anti-theft tools like Intel's.
- londons_explore 3y agoIn the Windows 9x era, it was common for the BIOS to hotpatch the windows kernel to install various bits of 'security' software. Even today, I think this is how the Dell Computrace anti-theft mechanism works. If you format the disk and install windows afresh, the computrace agent will install itself on the first bootup and ping the internet to see if the system is marked stolen. If you run Linux on your stolen machine, it works fine. Obviously there are (stolen) "Linux" machines on ebay which work fine, unless you install windows even once, and then they become computrace locked.
- jxi 3y agoIs there any way to protect yourself from this type of attack?
- rjsw 3y agoNot using the built-in networking hardware would probably help. I add an Intel ethernet card to systems that I build as they will offload more work than the typical Realtek controller on a motherboard.
- jesprenj 3y agoBy not using Windows or somehow instructing your Windows not to run this file at startup.
- PretzelPirate 3y ago> By not using Windows I'm not sure that is a real solution. The motherboard manufacturer could target other OSes as well, so unless you use a Mac where the hardware is fully controlled by Apple, you'll end up at risk. In any OS, you'd proba ly have to maintain an explicit "allow list" for any executables that you are OK running on your machine, and make sure that you don't accept any updates without explicitly checking the source yourself.
- creshal 3y agoThis is an intended feature of EFI/Windows, used to implement device drivers and theft protection. So short of "don't use EFI" or "don't use Windows", there's not much you can do. There shouldn't be an easy way to disable this, as it'll brick devices when it shouldn't (missing drivers), or doesn't brick devices when it should (bypassing theft protection).
- AshamedCaptain 3y agoThere's a literal option in the BIOS setup to disable it. You then uninstall/disable the Gigabyte auto-updater and that's it.
- uticus 3y agoFrom the blog post referenced [0]: > Eclypsium automated heuristics detected firmware on Gigabyte systems that drops an executable Windows binary that is executed during the Windows startup process. ...Windows startup process allows for executing "dropped binaries"? Would this be via replacing legit startup binary, or another vector? [0] https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/ https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-a...
- uticus 3y agonm, didn't read far enough: > During the Driver Execution Environment (DXE) phase of the UEFI firmware boot process, the “WpbtDxe.efi” firmware module uses the above GUID to load the embedded Windows executable file into memory...
- AshamedCaptain 3y agoIt's called WPBT. The answer is yes. This "backdoor" is Windows performing exactly as designed. It's a documented feature. Even if a vendor doesn't use WPBT because the reputation of WPBT its a bit iffy these days, they'll just create a fake ACPI node that triggers WIndows Update to download a specific driver from the vendor, which is basically the same thing. MSI uses this second option for the almost identically named option in the BIOS, and it will also download as much "potentially unwanted applications" as Gigabyte's (was that the Windows Defender euphemism for vendor malware again?) . Like Gigabyte, it's an option which is disabled by default, but tends to "get enabled" a lot. They don't really have to sneak it in -- even power users enable it since they see the motherboard crapware as a benefit (e.g. temperature sensing, color LED strips and related crap)
- dist-epoch 3y agoHow does WPBT interact with SecureBoot? Given it's an official Windows feature, I guess it passes through with no warnings?
- wmf 3y agoSecure boot doesn't apply to apps and that's what this is.
- jesprenj 3y agoAs far as I understand, this only affects Windows installations. The update process is executed from Windows and not from motherboard's code itself. The motherboard's code only installs a Windows executable on your hard drive.
- deleted 3y ago[deleted]
- boomboomsubban 3y agoI don't see what would stop it from downloading and running an update that would work with Linux, it's that Gigabyte has little financial incentive to create a Linux updater. A malicious actor may, though probably doesn't given Gigabyte's target market.
- hiciu 3y agoWPBT is explicitly not supported by Linux kernel. On windows side it is handled by (I may be mistaken, haven't verified that) `wpbbin.exe` binary. https://docs.kernel.org/arm64/acpi_object_usage.html https://docs.kernel.org/arm64/acpi_object_usage.html says: > Microsoft only table, will not be supported. (I know, it's for arm64, but there seems to be no other docs) But, you can use your Linux kernel to see what's inside your motherboard. Check /sys/firmware/acpi/tables/WPBT, if you have one. source: https://michlstechblog.info/blog/windows-identify-a-wpbt-binary-in-biosuefi/ https://michlstechblog.info/blog/windows-identify-a-wpbt-bin...
- boomboomsubban 3y agoSure, but if it's arbitrarily throwing things into the ESP and having them be run on boot, they presumably could do the same thing with Linux. Maybe secure boot would stop it, otherwise I don't see why it couldn't add another initrd to your boot config.
- Nextgrid 3y agoIt isn't touching your disk at all. It's just providing an executable in a specific ACPI table that Windows explicitly supports running code from for the purpose of installing OEM-provided software.