Gigabyte Firmware Exposes Millions Of Motherboards To Backdoor Hacking Threat
We say that because security platform Eclypsium announced that it had detected "backdoor-like behavior" in Gigabyte systems. The specific behavior is that affected motherboards run internet-connected Windows software dropped from the system firmware to then update said firmware from the internet. The software in question is all completely legitimate in theory, but of course that's where all kinds of trouble starts.
Because the application runs in the background, invisibly, there's no way for the user to be aware if the tool has been hijacked by a threat actor. Don't be confused; there's not necessarily any problem with your system if you have a Gigabyte motherboard. It's just that the update tool—which can be disabled from the UEFI setup but is enabled by default—performs very little in the way of security or safety checking.
For its part, Gigabyte has already released beta BIOS updates for all of its Intel LGA 1700 and AMD Socket AM4 motherboards that are vulnerable to this exploit. The company says that it has "implemented stricter security checks" on the tools, including signature verification and privilege access limitations, both of which should help keep bad guys from getting into your firmware. Updates for other systems, including Intel 400/500-series and AMD's Socket AM5 motherboards, should be available soon.
Top image: Eclypsium