Critical vulnerability in Gigabyte motherboard firmware: millions of PCs at risk

Millions of PC motherboards have been sold with a backdoor in the firmware, recent studies have revealed. This poses a significant security risk, as it makes the work of cybercriminals easier. In fact, the ability to hide malicious programs in the computer's UEFI firmware, which governs the loading of the operating system, has become a popular tactic used by hackers. The problem arises when motherboard manufacturers, such as Gigabyte, insert a hidden backdoor into the firmware, without adequate protection.

Discoveries and revelations of Eclypsium

Researchers at Eclypsium, a cybersecurity company specializing in firmware, have discovered that Taiwanese manufacturer Gigabyte has embedded a hidden mechanism in the firmware of many of its motherboards, commonly used in gaming PCs and high-performance computers. They found that every time a PC with one of these motherboards restarts, a code within the firmware launches an invisible updater, which in turn downloads and runs other software. According to Eclypsium, the hidden code is only meant to be a useful tool for keeping firmware up-to-date, but it's implemented insecurely, making it susceptible to being used to install malware.

Gigabyte's answer and expert opinion

Gigabyte said it is working to resolve the issues reported by Eclypsium. However, the company did not respond to numerous requests for comment on the matter. Some experts, including Rich Smith, head of security at Crash Override, a supply chain-focused cybersecurity startup, likened the situation to Sony's rootkit scandal of the 2000s. Sony had hidden digital rights management code on CDs that installed itself invisibly on users' computers, creating a vulnerability that was then exploited by cybercriminals.

Possible repercussions and risks

While Gigabyte may have had good intentions in creating this tool hidden in the firmware, the presence of security vulnerabilities in the invisible code that underpins the operating system of many computers undermines a fundamental level of trust that users should have in their devices. This finding is concerning, especially considering the millions of potentially affected devices. Rich Smith stated, "There's no malice in that, just negligence. But I don't want someone careless writing my firmware. If you don't have faith in your firmware, you're building your house on sand."