> What they actually found is that Gigabyte's motherboard software auto-updates over HTTP, which makes it vulnerable to a MitM. So the next question probably s

> What they actually found is that Gigabyte's motherboard software auto-updates over HTTP, which makes it vulnerable to a MitM. So the next question probably should be, are we sure there is no other signing mechanism at play here? If the blob downloaded needs to pass some sort of signature verification to be loaded, the use/lack of HTTPs wouldn't be a big factor in the security model.