5 ms·

What they actually found is that Gigabyte's motherboard software auto-updates over HTTP, which makes it vulnerable to a MitM. [EDIT: since it's not checking for

What they actually found is that Gigabyte's motherboard software auto-updates over HTTP, which makes it vulnerable to a MitM. [EDIT: since it's not checking for any signature] The rest of the article is just ranting that if you enable the option in the BIOS to install Gigabyte's software it will end up being installed.

jchw 3y ago
Isn't this enabled by default? I just recently set up a new computer with someone and ran into it.
- devmor 3y ago
  Yes, it is. It also force-installs certain driver packages and will re-install them on every boot no matter how many times you remove them. When I built my newest system I ended up reinstalling Windows 3 times before I figured out I had to disable it to get rid of the horrible audio software that kept getting force installed for my chipset and screwing up my settings.
rickdeckard 3y ago
...which actually is not a "Firmware backdoor" but the usual "crappy Windows companion app" malware...
kevin_nisbet 3y ago
> What they actually found is that Gigabyte's motherboard software auto-updates over HTTP, which makes it vulnerable to a MitM. So the next question probably should be, are we sure there is no other signing mechanism at play here? If the blob downloaded needs to pass some sort of signature verification to be loaded, the use/lack of HTTPs wouldn't be a big factor in the security model.
- deleted 3y ago
  [deleted]
jameshart 3y ago
Right - people who are upset that their motherboard can just drop arbitrary executables into their OS ZOMG would do well to consider the fact that their motherboard is literally handling executing their OS and managing all input and output. The issue here is not motherboard can execute arbitrary code. Motherboards are trusted hardware. You pass all your keystrokes, network traffic and memory transfers over it. The issue is motherboard uses its trusted status to run software that performs raw HTTP downloads for firmware. Which is probably bad but might alternatively just be futureproofing to avoid having to deal with expiring certs.
- tinus_hn 3y ago
  Don’t attribute to malice that which can be adequately explained by stupidity.
  - Forbo 3y ago
    When it comes to corporations, don't attribute to stupidity that which can be adequately explained by greed. This could easily be avoided by having proper security engineering, but that costs money! They're only about a decade late to the whole post-Snowden "maybe we shouldn't trust unverified code delivered over interceptable cleartext channels" explosion.
    - ikekkdcjkfke 3y ago
      This motherboard security stuff should get Linus tech tips level attention and absolutely roast them to the point of a reform
  - dustfinger 3y ago
    That is a cute quote, but people still need to be held accountable for compromising the ability of millions of devices to update firmware securely. Stupidity or malice, the end result is the same. Having said that, hopefully someone will investigate whether or not there was ill intent.
  - naruhodo 3y ago
NohatCoder 3y ago
HTTP, and no check of the executable signature. I'd say the latter is the worse offence, but the two flaws really come together to provide an excellent MitM vector.
- ajross 3y ago
  Is that part verified? The linked article doesn't say, and the Eclypsium blog post isn't really clear either. What they say is that the motherboard firmware is causing the resulting windows boot process to run code provided by the firmware (which is weird, but not insecure per se), and that this code is delivered over HTTP. They notably aren't saying that the firmware or loader is doing no validation on the executable. Most likely this has some sort of home grown signature on the blob, because if it didn't they instantly would have cooked up a MitM exploit to demonstrate. The fact that they didn't implies that it doesn't work. That's not to say this is a good design (it's clearly not) or that it can't be abused in non-malware ways (junkware, etc...). But it does seem like it's being spun as a clear security hole when my guess is that it isn't (it certainly hasn't been shown to be).
  - NohatCoder 3y ago
    >> What they say is that the motherboard firmware is causing the resulting windows boot process to run code provided by the firmware (which is weird, but not insecure per se), and that this code is delivered over HTTP. No, the firmware copies a program from itself to Windows, that program then downloads and executes another program from the internet, without verifying it correctly. Article says: "The firmware does not implement any cryptographic digital signature verification or any other validation over the executables." So unless that is downright wrong the MitM path is wide open. There is a signature check built into Windows, but way too much stuff has been signed to make that a meaningful barrier.
  - jeroenhd 3y ago
    The Eclypsium blog post does state the following: "The firmware does not implement any cryptographic digital signature verification or any other validation over the executables." Unless your Windows was configured to only run signed software or Gigabyte would apply the Mark of the Web to these files (which would make it harder for them to run their own update process), the executable file downloaded and run as a service doesn't seem to get checked. As far as I can make out from the blog post, a MitM attack during the motherboard update process would allow for the motherboard to be flashed with malicious software which in turn would indeed allow for dropping Windows executables onto the system. Luckily, barely anyone uses the built-in online updater for their motherboards. The https://software-nas/Swhttp/LiveUpdate4 https://software-nas/Swhttp/LiveUpdate4 URL is a pretty potential risk. You don't even need MitM to pretend to be that URL as it's not a FQDN. If there's any kind of HTTPS certificate validation that URL seems pretty useless in general. Maybe it's some kind of internal testing server that made it into production?
scns 3y ago
"Eclypsium says it found Gigabyte’s hidden firmware mechanism while scouring customers’ computers for firmware-based malicious code, an increasingly common tool employed by sophisticated hackers. In 2018, for instance, hackers working on behalf of Russia’s GRU military intelligence agency were discovered silently installing the firmware-based anti-theft software LoJack on victims’ machines as a spying tactic. Chinese state-sponsored hackers were spotted two years later repurposing a firmware-based spyware tool created by the hacker-for-hire firm Hacking Team to target the computers of diplomats and NGO staff in Africa, Asia, and Europe. Eclypsium’s researchers were surprised to see their automated detection scans flag Gigabyte’s updater mechanism for carrying out some of the same shady behavior as those state-sponsored hacking tools—hiding in firmware and silently installing a program that downloads code from the internet." > The rest of the article is just ranting I am puzzled by your conclusion. Edit: > enable the option in the BIOS to install Gigabyte's software it will end up being installed Am i blind? Zero snark intended but where in the article is that mentioned?
- AshamedCaptain 3y ago
  Yes, it is ranting. They don't actually present any exploit for it. They are just saying "someone once found a way to exploit the firmware, therefore all firmware is vulnerable!" which is very lousy. There is no hint for example that this can be converted into a "persistent hiding-in firmware" backdoor anymore than any other regular Windows install. The fact that the software is distributed via WPBT is almost orthogonal to the vulnerability itself.
Arrath 3y ago
In the past, I could just ignore the CD in the motherboard box with all the crapware. In the more recent past, I didn't have a CD drive to even put it into. Now, that junk is preloaded onto the motherboard? Argh. At least I can still opt not to install it, but jeez.

jchw 3y ago

Isn't this enabled by default? I just recently set up a new computer with someone and ran into it.

devmor 3y ago
Yes, it is. It also force-installs certain driver packages and will re-install them on every boot no matter how many times you remove them. When I built my newest system I ended up reinstalling Windows 3 times before I figured out I had to disable it to get rid of the horrible audio software that kept getting force installed for my chipset and screwing up my settings.

rickdeckard 3y ago

...which actually is not a "Firmware backdoor" but the usual "crappy Windows companion app" malware...

kevin_nisbet 3y ago

> What they actually found is that Gigabyte's motherboard software auto-updates over HTTP, which makes it vulnerable to a MitM. So the next question probably should be, are we sure there is no other signing mechanism at play here? If the blob downloaded needs to pass some sort of signature verification to be loaded, the use/lack of HTTPs wouldn't be a big factor in the security model.

deleted 3y ago
[deleted]

jameshart 3y ago

Right - people who are upset that their motherboard can just drop arbitrary executables into their OS ZOMG would do well to consider the fact that their motherboard is literally handling executing their OS and managing all input and output. The issue here is not motherboard can execute arbitrary code. Motherboards are trusted hardware. You pass all your keystrokes, network traffic and memory transfers over it. The issue is motherboard uses its trusted status to run software that performs raw HTTP downloads for firmware. Which is probably bad but might alternatively just be futureproofing to avoid having to deal with expiring certs.

tinus_hn 3y ago
Don’t attribute to malice that which can be adequately explained by stupidity.
- Forbo 3y ago
  When it comes to corporations, don't attribute to stupidity that which can be adequately explained by greed. This could easily be avoided by having proper security engineering, but that costs money! They're only about a decade late to the whole post-Snowden "maybe we shouldn't trust unverified code delivered over interceptable cleartext channels" explosion.
  - ikekkdcjkfke 3y ago
    This motherboard security stuff should get Linus tech tips level attention and absolutely roast them to the point of a reform
- dustfinger 3y ago
  That is a cute quote, but people still need to be held accountable for compromising the ability of millions of devices to update firmware securely. Stupidity or malice, the end result is the same. Having said that, hopefully someone will investigate whether or not there was ill intent.
- naruhodo 3y ago

NohatCoder 3y ago

HTTP, and no check of the executable signature. I'd say the latter is the worse offence, but the two flaws really come together to provide an excellent MitM vector.

ajross 3y ago
Is that part verified? The linked article doesn't say, and the Eclypsium blog post isn't really clear either. What they say is that the motherboard firmware is causing the resulting windows boot process to run code provided by the firmware (which is weird, but not insecure per se), and that this code is delivered over HTTP. They notably aren't saying that the firmware or loader is doing no validation on the executable. Most likely this has some sort of home grown signature on the blob, because if it didn't they instantly would have cooked up a MitM exploit to demonstrate. The fact that they didn't implies that it doesn't work. That's not to say this is a good design (it's clearly not) or that it can't be abused in non-malware ways (junkware, etc...). But it does seem like it's being spun as a clear security hole when my guess is that it isn't (it certainly hasn't been shown to be).
- NohatCoder 3y ago
  >> What they say is that the motherboard firmware is causing the resulting windows boot process to run code provided by the firmware (which is weird, but not insecure per se), and that this code is delivered over HTTP. No, the firmware copies a program from itself to Windows, that program then downloads and executes another program from the internet, without verifying it correctly. Article says: "The firmware does not implement any cryptographic digital signature verification or any other validation over the executables." So unless that is downright wrong the MitM path is wide open. There is a signature check built into Windows, but way too much stuff has been signed to make that a meaningful barrier.
- jeroenhd 3y ago
  The Eclypsium blog post does state the following: "The firmware does not implement any cryptographic digital signature verification or any other validation over the executables." Unless your Windows was configured to only run signed software or Gigabyte would apply the Mark of the Web to these files (which would make it harder for them to run their own update process), the executable file downloaded and run as a service doesn't seem to get checked. As far as I can make out from the blog post, a MitM attack during the motherboard update process would allow for the motherboard to be flashed with malicious software which in turn would indeed allow for dropping Windows executables onto the system. Luckily, barely anyone uses the built-in online updater for their motherboards. The https://software-nas/Swhttp/LiveUpdate4 https://software-nas/Swhttp/LiveUpdate4 URL is a pretty potential risk. You don't even need MitM to pretend to be that URL as it's not a FQDN. If there's any kind of HTTPS certificate validation that URL seems pretty useless in general. Maybe it's some kind of internal testing server that made it into production?

scns 3y ago

"Eclypsium says it found Gigabyte’s hidden firmware mechanism while scouring customers’ computers for firmware-based malicious code, an increasingly common tool employed by sophisticated hackers. In 2018, for instance, hackers working on behalf of Russia’s GRU military intelligence agency were discovered silently installing the firmware-based anti-theft software LoJack on victims’ machines as a spying tactic. Chinese state-sponsored hackers were spotted two years later repurposing a firmware-based spyware tool created by the hacker-for-hire firm Hacking Team to target the computers of diplomats and NGO staff in Africa, Asia, and Europe. Eclypsium’s researchers were surprised to see their automated detection scans flag Gigabyte’s updater mechanism for carrying out some of the same shady behavior as those state-sponsored hacking tools—hiding in firmware and silently installing a program that downloads code from the internet." > The rest of the article is just ranting I am puzzled by your conclusion. Edit: > enable the option in the BIOS to install Gigabyte's software it will end up being installed Am i blind? Zero snark intended but where in the article is that mentioned?

AshamedCaptain 3y ago
Yes, it is ranting. They don't actually present any exploit for it. They are just saying "someone once found a way to exploit the firmware, therefore all firmware is vulnerable!" which is very lousy. There is no hint for example that this can be converted into a "persistent hiding-in firmware" backdoor anymore than any other regular Windows install. The fact that the software is distributed via WPBT is almost orthogonal to the vulnerability itself.

Arrath 3y ago

In the past, I could just ignore the CD in the motherboard box with all the crapware. In the more recent past, I didn't have a CD drive to even put it into. Now, that junk is preloaded onto the motherboard? Argh. At least I can still opt not to install it, but jeez.