Supply Chain Risk from Gigabyte App Center Backdoor By: Eclypsium - May 31, 2023 https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/ Wired : Millions of PC Motherboards Were Sold With a Firmware Backdoor May 31, 2023 9:00 AM https://www.wired.com/story/gigabyte-motherboard-firmware-backdoor/ Read more at above links!!!
A list of affected Gigabyte models is available here: https://eclypsium.com/wp-content/uploads/Gigabyte-Affected-Models.pdf
Maybe a bit off topic: I don't understand why Eclypsium is calling this a "Supply Chain Risk". Maybe because it is the new "buzz word" (or whatever you want to call it)? As far as I understand "Supply Chain" is about: Company A --> Company B (etc), where A and B are not the same. But isn't it here all the fault of Gygabyte alone? Am I now wrong, do I don't understand it right? Maybe it is the way you look at it?
Maybe you just "compromise gigabyte" and then push an infected bios update so you can do everything you want on other company's pc's that are just unlucky to own a gigabyte mainboard. That would be my guess. I mean updates over an HTTP connection seem
Hi, Yes, I understood that. But I still would not call this a "Supply Chain" issue. OK, you can look at it this way: PC Builder A uses components (chips, mobos, etc.) from company B (or maybe some services from company C). That is a Supply Chain. But think a little bit further: That PC Builder A installs Windows from Microsoft. OK, also some Supply Chain in some way. But now we have hundreds of security and privacy issues over the years with Windows. Are we calling all those security and privacy issues now also a "Supply Chain" risk? We could. But if we do, those words "Supply Chain" mean nothing anymore: then those words "Supply Chain" are completely empty, just some bla-bla. Please note that I am not criticizing the report by Eclypsium, just only that "Supply Chain".
I think it refers to the application installation center that is in the bios and if you do not disable it, it starts with the system and downloads programs, drivers, etc. for the PC. I've never tested the app but I guess it must have some user interaction to download things other than the Gigabyte bios app. By the way the motherboard I have in my computer is listed. All the best.
Gigabyte Rolls Out Firmware Update to Mend Firmware Backdoor https://www.tomshardware.com/news/gigabyte-firmware-update-backdoor
GIGABYTE Fortifies System Security with Latest BIOS Updates and Enhanced Verification Jun 1, 2023 https://www.gigabyte.com/Press/News/2091
GIGABYTE releases new firmware to fix recently disclosed security flaws https://www.bleepingcomputer.com/ne...are-to-fix-recently-disclosed-security-flaws/
