Four UEFI Flaws in GIGABYTE Motherboards Expose 240+ Models to Persistent Bootkits

[Chaitanya]

Still wondering how long before we see Shitsus and their malware pushing Bioses get exposed.

 

[:D:D]

An attacker with administrator privileges

I don't get it. Doesn't that mean the attacker can already do what they want without resorting to some complex hack!

 

[Aretak]

I don't get it. Doesn't that mean the attacker can already do what they want without resorting to some complex hack!

Why settle for accessing a system once when you can quietly install a tool that gives you ongoing access to it forever?

 

[:D:D]

Yes, but what is stopping flashing rootkit firmware on not just Gigabyte boards but others too once you have admin rights?

 

[R-T-B]

Yes, but what is stopping flashing rootkit firmware on not just Gigabyte boards but others too once you have admin rights?

Secure Boot and secure flash signing technologies. Most uefis won't boot just any unsigned image anymore, in uefi or otherwise.

 

[[XC] Oj101]

Doomsday article that fails to mention that the issue was already patched, more than a month ago, for most boards? This is just like BIOS vulnerability from about two years ago, where hundreds of boards had been patched before it made the news. It comes across as an anti-Gigabyte agenda. The title neither mentions that it affects ancient boards, nor that it was patched for most boards LONG before publishing.

Were articles ever run about the revised, reinforced PCIe slot on 4090s, or the repositioned 12VHPWR connectors to reduce strain on cables?

 

[AleksandarK]

Doomsday article that fails to mention that the issue was already patched, more than a month ago, for most boards? This is just like BIOS vulnerability from about two years ago, where hundreds of boards had been patched before it made the news.

Users should visit GIGABYTE's support page to find and install the updated BIOS versions using the Q-Flash utility, and then re-enable Secure Boot. Devices that GIGABYTE has declared end of life may never see a patch. The company also claims only Intel-based boards are affected, leaving AMD boards untouched.

 

[:D:D]

Secure Boot and secure flash signing technologies. Most uefis won't boot just any unsigned image anymore, in uefi or otherwise.

I'm way behind with those with old hardware (10+ years) so know nothing about them now. Use to be a time you could disable secure boot from Windows, again with admin rights. Firmware is allowed to execute always under secure boot by default on this system too, do you know if that has changed now? Probably still a lot of old HW in the wild.

BIOS flashing by BIOS Setup had some secure flash protection on my HW but could be easily circumvented. Besides there were other softwares that could flash regardless. It's nice to be able to take some control of ones own HW but sad that some people use it to destroy lives for personal gain. Unfortunately that's the world we live in.

 

[R-T-B]

I'm way behind with those with old hardware (10+ years) so know nothing about them now. Use to be a time you could disable secure boot from Windows, again with admin rights. Firmware is allowed to execute always under secure boot by default on this system too, do you know if that has changed now? Probably still a lot of old HW in the wild.

BIOS flashing by BIOS Setup had some secure flash protection on my HW but could be easily circumvented. Besides there were other softwares that could flash regardless. It's nice to be able to take some control of ones own HW but sad that some people use it to destroy lives for personal gain. Unfortunately that's the world we live in.

As a former bios modder I very much feel your sentiment. Modding was nice, but people (malware writers) abused it, and now its mostly shut down. You can still toggle default config settings (even hidden ones) in an image but otherwise no, modding is dead. Malware writers are why we can't have nice things.

 

[remixedcat]

GA-B75M-D3H <<hubby has this board is it ok?

 

[Shrek]

Have a GIGABYTE motherboard with BIOS

• B460M DS3H AC-Y1

but it is a special 'Y1' version so isn't really kept up to date.


Risky, risky stuff but it can be moved to the standard

• B460M DS3H AC

version using the AMI Aptio V firmware update utility,
and now I can keep things up to date with this recent
fix.