>> What they say is that the motherboard firmware is causing the resulting windows boot process to run code provided by the firmware (which is weird, but not in

>> What they say is that the motherboard firmware is causing the resulting windows boot process to run code provided by the firmware (which is weird, but not insecure per se), and that this code is delivered over HTTP. No, the firmware copies a program from itself to Windows, that program then downloads and executes another program from the internet, without verifying it correctly. Article says: "The firmware does not implement any cryptographic digital signature verification or any other validation over the executables." So unless that is downright wrong the MitM path is wide open. There is a signature check built into Windows, but way too much stuff has been signed to make that a meaningful barrier.