4 ms·

From the blog post referenced [0]: > Eclypsium automated heuristics detected firmware on Gigabyte systems that drops an executable Windows binary that is execu

by uticus 3y ago

From the blog post referenced [0]: > Eclypsium automated heuristics detected firmware on Gigabyte systems that drops an executable Windows binary that is executed during the Windows startup process. ...Windows startup process allows for executing "dropped binaries"? Would this be via replacing legit startup binary, or another vector? [0] https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/ https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-a...

uticus 3y ago
nm, didn't read far enough: > During the Driver Execution Environment (DXE) phase of the UEFI firmware boot process, the “WpbtDxe.efi” firmware module uses the above GUID to load the embedded Windows executable file into memory...
AshamedCaptain 3y ago
It's called WPBT. The answer is yes. This "backdoor" is Windows performing exactly as designed. It's a documented feature. Even if a vendor doesn't use WPBT because the reputation of WPBT its a bit iffy these days, they'll just create a fake ACPI node that triggers WIndows Update to download a specific driver from the vendor, which is basically the same thing. MSI uses this second option for the almost identically named option in the BIOS, and it will also download as much "potentially unwanted applications" as Gigabyte's (was that the Windows Defender euphemism for vendor malware again?) . Like Gigabyte, it's an option which is disabled by default, but tends to "get enabled" a lot. They don't really have to sneak it in -- even power users enable it since they see the motherboard crapware as a benefit (e.g. temperature sensing, color LED strips and related crap)
- dist-epoch 3y ago
  How does WPBT interact with SecureBoot? Given it's an official Windows feature, I guess it passes through with no warnings?
  - wmf 3y ago
    Secure boot doesn't apply to apps and that's what this is.
- xmodem 3y ago
  I've noticed that simply plugging a Logitech USB dongle into a Windows machine with no other interaction is enough to trigger it to download and install Logitech's crapware.
  - 0cf8612b2e1e 3y ago
    This is so aggravating! Especially on my locked down corporate laptop. Logitech startup process was able to install itself without my approval, but requires admin privileges to uninstall. So, now it’s just there, forever. Hardware industry has an impeccable security record, so I’m sure it is fine.
    - actionfromafar 3y ago
      Yes, they would never install for instance a proxy which forwards all traffic to them. cough Lenovo
      - hutzlibu 3y ago
        Sorry for cynism, but in my opinion, the main problem is still, that most people understand allmost nothing about computers, except following procedure x to get it roughly do, what they want. And this is usually problematic enough, so they have 0 bandwith for all the shit that is going on underneath. They cannot understand, what is necessary behavior and what is abusive. That would be probably our job, to raise awareness. But it's exhausting and the result is bloat, crap and spyware as default. Understanding users would never consent to this. But the majority simply doesn't and I get pragmatic and find solutions, that work for me. Like WindowsDebloat and Linux. And avoiding touching normal peoples computers, unless with the permission to clean up a bit before using. Not much else one can do.
    - codedokode 3y ago
      You have given an approval to do anything with your laptop when you chose to install Windows.
  - actionfromafar 3y ago
- ComodoHacker 3y ago
  To be frank, MSI's "crap" provides battery life optimized charging, while Windows doesn't (and probably can't).
  - AshamedCaptain 3y ago
    Oh I don't disagree that it is useful. E.g., If you bought blikenlights, I'm sure you'd like to see them working. But it doesn't excuse the fact that most motherboard software is crap. Don't get me wrong, it doesn't apply only to MSI. HP's update software ("Support Assistant") for example is spyware by any definition.
- Hizonner 3y ago
  > This "backdoor" is Windows performing exactly as designed. It's a documented feature. You say "documented feature", I say "attractive nuisance". Although firmware always can tamper with the operating system, it's not a good idea. By formalizing a way to do it, thus making it much easier and more reliable, Microsoft encourages motherboard vendors to do it... which is (1) pretty much guaranteed to lead to them at least sometimes doing things like injecting security holes, and (2) pretty much guaranteed to cause problems that even experienced sysadmins have trouble debugging when it goes wrong in whatever way. It also further entrenches Windows, of course...

by uticus 3y ago

uticus 3y ago

nm, didn't read far enough: > During the Driver Execution Environment (DXE) phase of the UEFI firmware boot process, the “WpbtDxe.efi” firmware module uses the above GUID to load the embedded Windows executable file into memory...

AshamedCaptain 3y ago

It's called WPBT. The answer is yes. This "backdoor" is Windows performing exactly as designed. It's a documented feature. Even if a vendor doesn't use WPBT because the reputation of WPBT its a bit iffy these days, they'll just create a fake ACPI node that triggers WIndows Update to download a specific driver from the vendor, which is basically the same thing. MSI uses this second option for the almost identically named option in the BIOS, and it will also download as much "potentially unwanted applications" as Gigabyte's (was that the Windows Defender euphemism for vendor malware again?) . Like Gigabyte, it's an option which is disabled by default, but tends to "get enabled" a lot. They don't really have to sneak it in -- even power users enable it since they see the motherboard crapware as a benefit (e.g. temperature sensing, color LED strips and related crap)

dist-epoch 3y ago
How does WPBT interact with SecureBoot? Given it's an official Windows feature, I guess it passes through with no warnings?
- wmf 3y ago
  Secure boot doesn't apply to apps and that's what this is.
xmodem 3y ago
I've noticed that simply plugging a Logitech USB dongle into a Windows machine with no other interaction is enough to trigger it to download and install Logitech's crapware.
- 0cf8612b2e1e 3y ago
  This is so aggravating! Especially on my locked down corporate laptop. Logitech startup process was able to install itself without my approval, but requires admin privileges to uninstall. So, now it’s just there, forever. Hardware industry has an impeccable security record, so I’m sure it is fine.
  - actionfromafar 3y ago
    Yes, they would never install for instance a proxy which forwards all traffic to them. cough Lenovo
    - hutzlibu 3y ago
      Sorry for cynism, but in my opinion, the main problem is still, that most people understand allmost nothing about computers, except following procedure x to get it roughly do, what they want. And this is usually problematic enough, so they have 0 bandwith for all the shit that is going on underneath. They cannot understand, what is necessary behavior and what is abusive. That would be probably our job, to raise awareness. But it's exhausting and the result is bloat, crap and spyware as default. Understanding users would never consent to this. But the majority simply doesn't and I get pragmatic and find solutions, that work for me. Like WindowsDebloat and Linux. And avoiding touching normal peoples computers, unless with the permission to clean up a bit before using. Not much else one can do.
  - codedokode 3y ago
    You have given an approval to do anything with your laptop when you chose to install Windows.
- actionfromafar 3y ago
ComodoHacker 3y ago
To be frank, MSI's "crap" provides battery life optimized charging, while Windows doesn't (and probably can't).
- AshamedCaptain 3y ago
  Oh I don't disagree that it is useful. E.g., If you bought blikenlights, I'm sure you'd like to see them working. But it doesn't excuse the fact that most motherboard software is crap. Don't get me wrong, it doesn't apply only to MSI. HP's update software ("Support Assistant") for example is spyware by any definition.
Hizonner 3y ago
> This "backdoor" is Windows performing exactly as designed. It's a documented feature. You say "documented feature", I say "attractive nuisance". Although firmware always can tamper with the operating system, it's not a good idea. By formalizing a way to do it, thus making it much easier and more reliable, Microsoft encourages motherboard vendors to do it... which is (1) pretty much guaranteed to lead to them at least sometimes doing things like injecting security holes, and (2) pretty much guaranteed to cause problems that even experienced sysadmins have trouble debugging when it goes wrong in whatever way. It also further entrenches Windows, of course...