Some models of Gigabyte motherboards download firmware updates insecurely

https://www.wired.com/story/gigabyte-motherboard-firmware-backdoor/

by mdhb • 3 years ago

230 126 3 years ago

wired.com

LegitShady• 3 years ago

https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-a...

programmarchy• 3 years ago

List of affected models:

https://eclypsium.com/wp-content/uploads/Gigabyte-Affected-M...

creshal3• 3 years ago

Ah, the joys of using obsolete hardware, looks like I missed the issue by one hardware generation.

flyinghamster• 3 years ago

I was just about to post links. I'm not sure why Wired couldn't be bothered to actually link to the report in question. They're certainly happy to link to their own content. I guess it's another example of the "can't let anyone leave our silo" mentality.

Simulacra• 3 years ago

motherboards sold by the Taiwanese manufacturer Gigabyte, whose components are commonly used in gaming PCs and other high-performance computers.

mschuster91• 3 years ago

It's been a few years, but didn't Windows include a feature back in the BIOS area to execute stuff from a BIOS area, IIRC to install drivers?

Edit: Found it, it's called WPBT and was a thing at least in 2015 [1], with ASUS using it in 2018 to deploy an upgrade tool [2] and an APT group to deploy a rootkit named as "Lojax" [3].

[1] https://michlstechblog.info/blog/windows-identify-a-wpbt-bin...

[2] https://www.heise.de/hintergrund/Asus-verankert-Update-Tool-...

[3] https://www.heise.de/news/Lojax-Der-Spion-der-aus-dem-BIOS-k...

creshal3• 3 years ago

Yeah, both for drivers and for anti-theft tools like Intel's.

londons_explore• 3 years ago

In the Windows 9x era, it was common for the BIOS to hotpatch the windows kernel to install various bits of 'security' software.

Even today, I think this is how the Dell Computrace anti-theft mechanism works. If you format the disk and install windows afresh, the computrace agent will install itself on the first bootup and ping the internet to see if the system is marked stolen. If you run Linux on your stolen machine, it works fine.

Obviously there are (stolen) "Linux" machines on ebay which work fine, unless you install windows even once, and then they become computrace locked.

miffe• 3 years ago

https://archive.is/LHMFT

jxi• 3 years ago

Is there any way to protect yourself from this type of attack?

jesprenj2• 3 years ago

By not using Windows or somehow instructing your Windows not to run this file at startup.

PretzelPirate• 3 years ago

By not using Windows

I'm not sure that is a real solution. The motherboard manufacturer could target other OSes as well, so unless you use a Mac where the hardware is fully controlled by Apple, you'll end up at risk.

In any OS, you'd proba ly have to maintain an explicit "allow list" for any executables that you are OK running on your machine, and make sure that you don't accept any updates without explicitly checking the source yourself.

creshal3• 3 years ago

This is an intended feature of EFI/Windows, used to implement device drivers and theft protection.

So short of "don't use EFI" or "don't use Windows", there's not much you can do. There shouldn't be an easy way to disable this, as it'll brick devices when it shouldn't (missing drivers), or doesn't brick devices when it should (bypassing theft protection).

AshamedCaptain6• 3 years ago

There's a literal option in the BIOS setup to disable it. You then uninstall/disable the Gigabyte auto-updater and that's it.

rjsw• 3 years ago

Not using the built-in networking hardware would probably help.

I add an Intel ethernet card to systems that I build as they will offload more work than the typical Realtek controller on a motherboard.

uticus2• 3 years ago

From the blog post referenced [0]:

Eclypsium automated heuristics detected firmware on Gigabyte systems that drops an executable Windows binary that is executed during the Windows startup process.

...Windows startup process allows for executing "dropped binaries"? Would this be via replacing legit startup binary, or another vector?

[0] https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-a...

uticus2• 3 years ago

nm, didn't read far enough:

During the Driver Execution Environment (DXE) phase of the UEFI firmware boot process, the “WpbtDxe.efi” firmware module uses the above GUID to load the embedded Windows executable file into memory...

AshamedCaptain6• 3 years ago

It's called WPBT. The answer is yes. This "backdoor" is Windows performing exactly as designed. It's a documented feature.

Even if a vendor doesn't use WPBT because the reputation of WPBT its a bit iffy these days, they'll just create a fake ACPI node that triggers WIndows Update to download a specific driver from the vendor, which is basically the same thing.

MSI uses this second option for the almost identically named option in the BIOS, and it will also download as much "potentially unwanted applications" as Gigabyte's (was that the Windows Defender euphemism for vendor malware again?) .

Like Gigabyte, it's an option which is disabled by default, but tends to "get enabled" a lot. They don't really have to sneak it in -- even power users enable it since they see the motherboard crapware as a benefit (e.g. temperature sensing, color LED strips and related crap)

dist-epoch• 3 years ago

How does WPBT interact with SecureBoot? Given it's an official Windows feature, I guess it passes through with no warnings?

xmodem• 3 years ago

I've noticed that simply plugging a Logitech USB dongle into a Windows machine with no other interaction is enough to trigger it to download and install Logitech's crapware.

ComodoHacker• 3 years ago

To be frank, MSI's "crap" provides battery life optimized charging, while Windows doesn't (and probably can't).

Hizonner• 3 years ago

This "backdoor" is Windows performing exactly as designed. It's a documented feature.

You say "documented feature", I say "attractive nuisance".

Although firmware always can tamper with the operating system, it's not a good idea. By formalizing a way to do it, thus making it much easier and more reliable, Microsoft encourages motherboard vendors to do it... which is (1) pretty much guaranteed to lead to them at least sometimes doing things like injecting security holes, and (2) pretty much guaranteed to cause problems that even experienced sysadmins have trouble debugging when it goes wrong in whatever way.

It also further entrenches Windows, of course...

jesprenj2• 3 years ago

As far as I understand, this only affects Windows installations. The update process is executed from Windows and not from motherboard's code itself. The motherboard's code only installs a Windows executable on your hard drive.

boomboomsubban3• 3 years ago

I don't see what would stop it from downloading and running an update that would work with Linux, it's that Gigabyte has little financial incentive to create a Linux updater. A malicious actor may, though probably doesn't given Gigabyte's target market.

hiciu• 3 years ago

WPBT is explicitly not supported by Linux kernel. On windows side it is handled by (I may be mistaken, haven't verified that) `wpbbin.exe` binary.

https://docs.kernel.org/arm64/acpi_object_usage.html says:

Microsoft only table, will not be supported.

(I know, it's for arm64, but there seems to be no other docs)

But, you can use your Linux kernel to see what's inside your motherboard. Check /sys/firmware/acpi/tables/WPBT, if you have one.

source: https://michlstechblog.info/blog/windows-identify-a-wpbt-bin...

AshamedCaptain6• 3 years ago

What they actually found is that Gigabyte's motherboard software auto-updates over HTTP, which makes it vulnerable to a MitM. [EDIT: since it's not checking for any signature]

The rest of the article is just ranting that if you enable the option in the BIOS to install Gigabyte's software it will end up being installed.

jchw• 3 years ago

Isn't this enabled by default? I just recently set up a new computer with someone and ran into it.

devmor• 3 years ago

Yes, it is. It also force-installs certain driver packages and will re-install them on every boot no matter how many times you remove them. When I built my newest system I ended up reinstalling Windows 3 times before I figured out I had to disable it to get rid of the horrible audio software that kept getting force installed for my chipset and screwing up my settings.

rickdeckard• 3 years ago

...which actually is not a "Firmware backdoor" but the usual "crappy Windows companion app" malware...

kevin_nisbet3• 3 years ago

What they actually found is that Gigabyte's motherboard software auto-updates over HTTP, which makes it vulnerable to a MitM.

So the next question probably should be, are we sure there is no other signing mechanism at play here? If the blob downloaded needs to pass some sort of signature verification to be loaded, the use/lack of HTTPs wouldn't be a big factor in the security model.

jameshart2• 3 years ago

Right - people who are upset that their motherboard can just drop arbitrary executables into their OS ZOMG would do well to consider the fact that their motherboard is literally handling executing their OS and managing all input and output.

The issue here is not motherboard can execute arbitrary code. Motherboards are trusted hardware. You pass all your keystrokes, network traffic and memory transfers over it.

The issue is motherboard uses its trusted status to run software that performs raw HTTP downloads for firmware. Which is probably bad but might alternatively just be futureproofing to avoid having to deal with expiring certs.

tinus_hn• 3 years ago

Don’t attribute to malice that which can be adequately explained by stupidity.

NohatCoder6• 3 years ago

Certificates do not have to expire. This is all firmware handling 101, you put a public key in the software update function, and the updater checks any alleged update against that key, no dates involved.

user67232• 3 years ago

Indeed they would be well to but they won't be considering shit beyond a room temp IQ they just wanna play their gaymz

NohatCoder6• 3 years ago

HTTP, and no check of the executable signature. I'd say the latter is the worse offence, but the two flaws really come together to provide an excellent MitM vector.

ajross• 3 years ago

Is that part verified? The linked article doesn't say, and the Eclypsium blog post isn't really clear either. What they say is that the motherboard firmware is causing the resulting windows boot process to run code provided by the firmware (which is weird, but not insecure per se), and that this code is delivered over HTTP.

They notably aren't saying that the firmware or loader is doing no validation on the executable. Most likely this has some sort of home grown signature on the blob, because if it didn't they instantly would have cooked up a MitM exploit to demonstrate. The fact that they didn't implies that it doesn't work.

That's not to say this is a good design (it's clearly not) or that it can't be abused in non-malware ways (junkware, etc...). But it does seem like it's being spun as a clear security hole when my guess is that it isn't (it certainly hasn't been shown to be).

scns• 3 years ago

"Eclypsium says it found Gigabyte’s hidden firmware mechanism while scouring customers’ computers for firmware-based malicious code, an increasingly common tool employed by sophisticated hackers. In 2018, for instance, hackers working on behalf of Russia’s GRU military intelligence agency were discovered silently installing the firmware-based anti-theft software LoJack on victims’ machines as a spying tactic. Chinese state-sponsored hackers were spotted two years later repurposing a firmware-based spyware tool created by the hacker-for-hire firm Hacking Team to target the computers of diplomats and NGO staff in Africa, Asia, and Europe. Eclypsium’s researchers were surprised to see their automated detection scans flag Gigabyte’s updater mechanism for carrying out some of the same shady behavior as those state-sponsored hacking tools—hiding in firmware and silently installing a program that downloads code from the internet."

The rest of the article is just ranting

I am puzzled by your conclusion.

Edit:

enable the option in the BIOS to install Gigabyte's software it will end up being installed

Am i blind? Zero snark intended but where in the article is that mentioned?

AshamedCaptain6• 3 years ago

Yes, it is ranting. They don't actually present any exploit for it. They are just saying "someone once found a way to exploit the firmware, therefore all firmware is vulnerable!" which is very lousy. There is no hint for example that this can be converted into a "persistent hiding-in firmware" backdoor anymore than any other regular Windows install. The fact that the software is distributed via WPBT is almost orthogonal to the vulnerability itself.

Arrath• 3 years ago

In the past, I could just ignore the CD in the motherboard box with all the crapware. In the more recent past, I didn't have a CD drive to even put it into.

Now, that junk is preloaded onto the motherboard? Argh.

At least I can still opt not to install it, but jeez.

Double_a_92• 3 years ago

Intel Management Engine ?

agloe_dreams• 3 years ago

I'm guessing Gigabyte Control Center.

eb0la• 3 years ago

That was the subject of a 1993 comic book: The Hacker Files #5 (published by DC Comics) https://www.comics.org/issue/216963/

alexjplant• 3 years ago

Related question: do they still sell motherboards with master admin passwords like they did in the 90s? I remember finding a list of them someplace online then trying one on my friend's Award BIOS and being astounded that it worked. Seems unthinkable in this day and age but it was definitely a thing.

DaSHacka• 3 years ago

Nowadays they make them dependant on the serial number of the device, the idea being if you get locked out of your own device you can contact the manufacturer with the serial number and recieve the override code.

Quite predictably however, some motivated individuals have reverse-engineered how these codes are generated and made online tools that can generate them as well(1).

[1] https://bios-pw.org/

jeroenhd3• 3 years ago

I used this to make a Dell laptop sold without password usable again.

There was a setting to disable the override password, but that was left disabled. I do wonder what the point of this secure password is if you leave a backdoor password enabled anyway.

kevin_nisbet3• 3 years ago

The Huawei modem my ISP uses has a hardcoded admin password that can't be changed. It's actually higher privileges than the login you're supposed to use.

So I ended up building a separate firewall to isolate myself from that thing.

hef198983• 3 years ago

The router from my ISP lives, with his own firewall, seperated by another, purely WiFi router with his own firewall from the home LAN. I guess he lives a happy life there. His separate WiFi comes in handy so sometimes.

nekoashide• 3 years ago

In the past OEMs would put passwords on motherboard BIOS, they were usually default codes but kept customers people from pushing F1 on boot and getting in to do bad things easily.

weinzierl• 3 years ago

'lkwpeter' was a popular one I still remember. Also this is still a thing. For Dell you can generate a BIOS password from the serial and this even allows you to circumvent hardware based SSD encryption.

KingOfCoders2• 3 years ago

How is this done with an encrypted drive?

richij• 3 years ago

via WPBT/DXE

KingOfCoders2• 3 years ago

Thanks

(Medium I know) https://grzegorztworek.medium.com/using-uefi-to-inject-execu...

froglets• 3 years ago

I wonder if printers do the same thing, since they all automatically update now to stop people from using generic toner.

fallat• 3 years ago

Let's just go back to Amigas

jalk• 3 years ago

Yes because those disk we copied from friends, never contained any viruses...oh wait.

primeradical• 3 years ago

I have a Gigabyte B550 board, my particular board isn't listed but I know many of the boards on there share nearly identical components as well as the updater software. Probably safe to assume it's affected too?

WirelessGigabit3• 3 years ago

Take a Linux device with 2 network ports.

Bridge the network ports.

Install WireShark.

Port 1 to router, port 2 to motherboard.

Boot computer and see what goes over the bridge?

taylorbuley• 3 years ago

Andy Greenberg is a great journalist! Read him, read everything he does.

sylware• 3 years ago

It's the other way around: Which computer has no backdoors or "convenient bugs"?

wmf3• 3 years ago

This is not quite as bad as Lenovo Superfish, but maybe Microsoft should have learned a lesson from that and locked down WPBT. Maybe WHQL should extend beyond drivers to other pre-installed crapware.

Havoc• 3 years ago

Consumer board updating processes are so sketchy anyway I'm not sure it matters.

Like here is a mystery zip file with a binary blob and no patch notes off some ftp server in asia. Frequently with a different binary for mainland china for unspecified reasons.

boringuser23• 3 years ago

I like how you have people waxing poetic about "consumer" equipment while probably having supermicro devices in a rack with a direct line to Beijing.

Also, the mainland binaries are usually the ones with the backdoor.

vore• 3 years ago

This is just total FUD: https://hackaday.com/2019/05/14/what-happened-with-supermicr...

If you're going to make these claims, back them up.

ndneighbor• 3 years ago

I think that these update systems aren't intentional backdoors but rather the product of a software team that was put under the gun so to speak. Many products nowadays just leak consumer data (like Toyota's teletronics for their cars) because PMs just demand more and more connected features.

Still grossly irresponsible on Gigabyte's part...

Animats• 3 years ago

Does this happen for data center motherboards, too?

yrro3• 3 years ago

Why don't _all_ models of Gigabyte motherboard have firmware upgradable with a simple 'fwupdmgr update'?

https://fwupd.org/

Let the people who actaully know how to implement secure software repositories and tools for fetching content from them do their jobs. Motherboard manufacturers should stick to what _they're_ good at and just produce timely firmware updates throughout the life of the product.

wmf3• 3 years ago

This wouldn't help 99% of Gigabyte customers.

wtfishackernews• 3 years ago

While fwupd does have a windows client, the obvious mechanism to use would be windows update, but anything is better than custom software for each vendor.

yrro3• 3 years ago

fwupd and Windows Update both use the same underlying packaging mechanism for shipping firmware updates. All my comments apply equally to https://learn.microsoft.com/en-us/windows-hardware/drivers/b... :)

WirelessGigabit3• 3 years ago

For many pieces of software you NEED Windows to run the firmware upgrade application. Example the WD SN 850x.

yrro3• 3 years ago

Yes and it's DISGUSTING

boringuser23• 3 years ago

Not even a *competent* junior developer would make this mistake.

jonnycomputer2• 3 years ago

I'm curious whether this is the same thing as the Gigabit Utilities Downloader enable/disable option i see in bios

Ralith• 3 years ago

Disabling that option makes the `%SystemRoot%\system32\GigabyteUpdateService.exe` binary mentioned by the original article stop appearing, so it seems so.

jonnycomputer2• 3 years ago

Thank you for letting me know!

slowhand09• 3 years ago

https://archive.is/ybixP non-paywall link

user67232• 3 years ago

There should be laws in place prohibiting closed source code from being distributed with silicon.

inb4 intellectual property, UEFI software aren't special, they are trash

nottorp• 3 years ago

Lovely how the article from Wired never mentions how the bios option to disable this is called. At least they linked the original article, but even that only mentions its name way down below near the end of the article, after telling you in 15 ways how the sky is falling.

WirelessGigabit3• 3 years ago

The Windows documentation is actually hard to find. I can only find it through a search engine:

https://download.microsoft.com/download/8/A/2/8A2FB72D-9B96-...

But what is happening here is that Gigabyte actually downloads an application at startup and places _THAT_ one into the WPBT to be executed.

Are they signed?

Does Windows allow the execution of an exe from WPBT that is not signed, or self-signed?

In my opinion Microsoft should release a patch that blocks WPBT execution on Gigabyte until they've proven that they're secure. That is what I expect from the OS.

Some models of Gigabyte motherboards download firmware updates insecurely

Related Stories