Gigabyte Rolls Out BIOS Updates to Remove Backdoor from Motherboards

June 5, 2023

Gigabyte has released BIOS updates for a number of its motherboards to remove a backdoor that could have been used to gain unauthorized access to the devices.
Users are advised to update their BIOS as soon as possible to protect their systems from the backdoor.

Gigabyte, the Taiwanese computer components manufacturer, has released BIOS updates for a number of its motherboards to remove a backdoor that could have been used to gain unauthorized access to the devices. The backdoor was discovered by security researchers at Eclypsium, who found that it was present in the firmware of Gigabyte motherboards dating back to 2017.

The backdoor issue was brought to light last week by Eclypsium, a firmware and hardware security company. According to the company, the firmware of over 270 Gigabyte motherboards contained a Windows binary that, upon boot-up, would fetch and execute a payload from Gigabyte’s servers.

Upon making its findings public, Eclypsium stated that it was unclear whether the backdoor was the result of a malicious insider, a compromise of Gigabyte’s servers, or a supply chain attack. Shortly after the publication of Eclypsium’s report, Gigabyte announced the release of BIOS updates that address the vulnerability.

“Gigabyte engineers have already mitigated potential risks and uploaded the Intel 700/600 and AMD 500/400 series Beta BIOS to the official website after conducting thorough testing and validation of the new BIOS on Gigabyte motherboards,” the company stated last week.

The BIOS updates implement stricter security checks during system boot, including enhanced validation for files downloaded from remote servers and standard verification of remote server certificates. These security enhancements aim to prevent attackers from inserting malicious code during boot and to ensure that any files downloaded during this process originate from servers with valid and trusted certificates.

This backdoor vulnerability exposes enterprises to a variety of threats and potential attack situations.

Exploitation of an OEM backdoor by cybercriminals – In the past, threat actors have capitalized on legitimate but weak or vulnerable OEM backdoor software incorporated into PC firmware. A notable case involved the Sednit group (APT28, FancyBear), which exploited Computrace LoJack, masquerading it as a valid laptop theft prevention feature.

Man-in-the-Middle Attacks on Firmware and Software Update Features – Furthermore, the unsecure nature of the update process leaves room for Man-in-the-Middle (MITM) techniques via a compromised router, a breached device on the same network segment, DNS poisoning, or other forms of network manipulation.

Persistent Risk Due to Unwanted Behavior within Official Firmware – UEFI or other firmware-embedded backdoors can pose a challenge to eliminate. Even if the backdoor executable is removed, the firmware is programmed to redrop it upon the next system reboot. This issue was demonstrated in past attempts to remove Computrace LoJack and is linked to vulnerabilities in Lenovo’s Service Engine on notebooks and desktops.

Here’s the full list of affected motherboards:

A520-AORUS-ELITE-rev-10
A520-AORUS-ELITE-rev-11
A520I-AC-rev-1x
A520M-DS3H-AC-rev-1x
A520M-DS3H-rev-1x
A520M-DS3H-V2-rev-10
A520M-H-rev-1x
A520M-K-rev-10
A520M-K-V2-rev-10
A520M-S2H-rev-1x
A620M-GAMING-X-AX-rev-10
A620M-GAMING-X-rev-10
B360M-DS3H-rev-10
B365-HD3-rev-10
B365M-DS3H-rev-10
B450-AORUS-Elite-V2-rev-1x
B450-AORUS-M-rev-1x
B450-Gaming-X-rev-1x
B450M-AORUS-ELITE-rev-1x
B450M-DS3H-rev-1x
B450M-DS3H-V2-rev-1x
B450M-DS3H-WIFI-rev-1x
B450M-GAMING-rev-1x
B450M-H-rev-1x
B450M-K-rev-10
B450M-S2H-rev-1x
B460-AORUS-PRO-AC-rev-10
B460-HD3-rev-10
B460M-AORUS-PRO-rev-10
B460M-D2V-rev-10
B460M-D3H-rev-10
B460M-DS3H-AC-rev-1x
B460M-DS3H-rev-10
B460M-GAMING-HD-rev-10
B460M-POWER-rev-10
B550-AORUS-ELITE-AX-rev-10
B550-AORUS-ELITE-AX-V2-rev-12
B550-AORUS-ELITE-AX-V2-rev-12-13
B550-AORUS-ELITE-rev-10
B550-AORUS-ELITE-V2-rev-12
B550-GAMING-X-V2-rev-10-11-12
B550-GAMING-X-V2-rev-13
B550-GAMING-X-V2-rev-14
B550-Gaming-X-V2-rev-1x
B550-UD-AC-rev-10-11
B550-UD-AC-rev-12
B550I-AORUS-PRO-AX-rev-10
B550I-AORUS-PRO-AX-rev-11
B550I-AORUS-PRO-AX-rev-12
B550M-AORUS-ELITE-AX-rev-13
B550M-AORUS-ELITE-rev-10-11-12
B550M-AORUS-ELITE-rev-13
B550M-AORUS-ELITE-rev-1x
B550M-AORUS-PRO-AX-rev-10
B550M-AORUS-PRO-AX-rev-11
B550M-AORUS-PRO-P-rev-10
B550M-AORUS-PRO-P-rev-11
B550M-AORUS-PRO-P-rev-12
B550M-AORUS-PRO-rev-10
B550M-DS3H-AC-rev-10-11-12-13
B550M-DS3H-AC-rev-10-11-12-13-14
B550M-DS3H-AC-rev-14
B550M-DS3H-AC-rev-15-16
B550M-DS3H-AC-rev-1x
B550M-DS3H-rev-10-11-12-13
B550M-DS3H-rev-14
B550M-DS3H-rev-15
B550M-DS3H-rev-1x
B550M-GAMING-rev-1x
B550M-K-rev-10
B550M-S2H-rev-1x
B560-AORUS-PRO-AX-rev-10
B560-HD3-rev-1x
B560I-AORUS-PRO-AX-rev-10
B560M-AORUS-ELITE-rev-1x
B560M-AORUS-PRO-AX-rev-1x
B560M-AORUS-PRO-rev-1x
B560M-D2V-rev-1x
B560M-D3H-rev-1x
B560M-DS3H-AC-rev-1x
B560M-DS3H-PLUS-rev-10
B560M-DS3H-V2-rev-10
B560M-GAMING-HD-rev-1x
B560M-H-rev-1x
B560M-H-V2-rev-10
B560M-POWER-rev-1x
B650-AERO-G-rev-10
B650-AORUS-ELITE-AX-rev-1x
B650-AORUS-ELITE-rev-10
B650-AORUS-PRO-AX-rev-1x
B650-GAMING-X-AX-rev-10-11
B650-GAMING-X-AX-rev-1x
B650-GAMING-X-rev-10
B650-GAMING-X-rev-10-11
B650E-AORUS-MASTER-rev-10
B650E-AORUS-TACHYON-rev-10
B650I-AORUS-ULTRA-rev-10
B650M-AORUS-ELITE-AX-rev-1x
B650M-AORUS-ELITE-rev-10
B650M-AORUS-PRO-AX-rev-1x
B650M-C-rev-10
B650M-DS3H-rev-10
B650M-GAMING-X-AX-rev-1x
B650M-K-rev-10
B660-AORUS-ELITE-AX-DDR4-rev-10
B660-AORUS-ELITE-DDR4-rev-10
B660-AORUS-MASTER-DDR4-rev-10
B660-AORUS-MASTER-DDR4-rev-1x
B660-AORUS-MASTER-rev-1x
B660-DS3H-AC-DDR4-rev-10
B660-DS3H-AC-DDR4-rev-10-12
B660-DS3H-AC-DDR4-rev-11
B660-DS3H-AC-rev-10
B660-DS3H-AX-DDR4-rev-10
B660-DS3H-AX-DDR4-rev-10-11
B660-DS3H-DDR4-rev-10
B660-DS3H-DDR4-rev-10-11
B660-GAMING-X-AX-DDR4-rev-10
B660-GAMING-X-DDR4-rev-10
B660-GAMING-X-rev-10
B660I-AORUS-PRO-DDR4-rev-1x
B660M-AORUS-ELITE-AX-DDR4-rev-10
B660M-AORUS-ELITE-AX-DDR4-rev1x
B660M-AORUS-ELITE-DDR4-rev-10
B660M-AORUS-ELITE-DDR4-rev-1x
B660M-AORUS-PRO-AX-DDR4-rev-1x
B660M-AORUS-PRO-AX-rev-1x
B660M-AORUS-PRO-DDR4-rev-10
B660M-AORUS-PRO-rev-10
B660M-D2H-DDR4-rev-10
B660M-D3H-DDR4-rev-10
B660M-DS3H-AX-DDR4-rev-1x
B660M-DS3H-DDR4-rev-10
B660M-GAMING-AC-DDR4-rev-10
B660M-GAMING-AC-DDR4-rev-1x
B660M-GAMING-AC-rev-10
B660M-GAMING-DDR4-rev-10
B660M-GAMING-X-AX-DDR4-rev-1x
B660M-GAMING-X-AX-rev-10
B660M-GAMING-X-DDR4-rev-10
B660M-GAMING-X-DDR4-rev-1x
B660M-GAMING-X-rev-10
B660M-POWER-DDR4-rev-10
B760-AORUS-ELITE-AX-DDR4-rev-10
B760-AORUS-ELITE-AX-rev-10
B760-AORUS-ELITE-DDR4-rev-10
B760-AORUS-ELITE-rev-10
B760-AORUS-MASTER-DDR4-rev-10
B760-DS3H-AC-DDR4-rev-10
B760-DS3H-AX-DDR4-rev-10
B760-DS3H-AX-rev-1x
B760-DS3H-DDR4-rev-10
B760-DS3H-rev-10
B760-GAMING-X-AX-DDR4-rev-10
B760-GAMING-X-AX-rev-10
B760-GAMING-X-DDR4-rev-10
B760-GAMING-X-rev-10
B760I-AORUS-PRO-DDR4-rev-10
B760I-AORUS-PRO-rev-10
B760M-AORUS-ELITE-AX-DDR4-rev-10
B760M-AORUS-ELITE-AX-rev-10
B760M-AORUS-ELITE-DDR4-rev-10
B760M-AORUS-ELITE-rev-10
B760M-AORUS-PRO-AX-DDR4-rev-10
B760M-AORUS-PRO-AX-rev-10
B760M-AORUS-PRO-DDR4-rev-10
B760M-AORUS-PRO-rev-10
B760M-C-rev-10
B760M-D2H-DDR4-rev-10
B760M-D2H-rev-10
B760M-D3H-DDR4-rev-10
B760M-DS3H-AX-DDR4-rev-1x
B760M-DS3H-AX-rev-1x
B760M-DS3H-DDR4-rev-10
B760M-DS3H-rev-10
B760M-GAMING-AC-DDR4-rev-10
B760M-GAMING-AC-rev-10
B760M-GAMING-DDR4-rev-10
B760M-GAMING-rev-10
B760M-GAMING-X-AX-DDR4-rev-1x
B760M-GAMING-X-AX-rev-1x
B760M-GAMING-X-DDR4-rev-10
B760M-GAMING-X-rev-10
B760M-POWER-DDR4-rev-10
B760M-POWER-rev-10
GA-B560M-D3P-rev-10
H410M-DS2V-rev-10
H410M-DS2V-V2-rev-10
H410M-DS2V-V2-rev-11
H410M-DS2V-V3-rev-10
H410M-DS2V-V3-rev-11-13
H410M-H-rev-1x
H410M-H-V2-rev-10
H410M-H-V2-rev-11-12-13-14-16
H410M-H-V2-rev-11-13-14
H410M-H-V2-rev-17
H410M-H-V3-rev-10
H410M-H-V3-rev-10-12
H410M-H-V3-rev-11-13
H410M-HD3P-rev-1x
H410M-K-rev-10
H410M-S2-rev-1x
H410M-S2-V2-rev-10
H410M-S2-V2-rev-11-12-13-14-16
H410M-S2-V2-rev-11-13-14
H410M-S2-V2-rev-17
H410M-S2-V3-rev-10
H410M-S2-V3-rev-10-12
H410M-S2-V3-rev-11-13
H410M-S2H-rev-1x
H410M-S2H-V2-rev-10
H410M-S2H-V2-rev-11
H410M-S2H-V2-rev-11-12-13-14-16
H410M-S2H-V3-rev-10
H410M-S2H-V3-rev-10-12
H410M-S2H-V3-rev-11-13
H470M-H-rev-10
H470M-K-rev-10
H510M-DS2-rev-10
H510M-DS2-rev-10-11
H510M-DS2V-rev-10-12
H510M-DS2V-rev-10-12-15
H510M-DS2V-rev-13
H510M-DS2V-rev-13-16
H510M-H-rev-10-11
H510M-H-rev-10-11-15
H510M-H-rev-13
H510M-H-rev-13-16
H510M-H-rev-17
H510M-K-rev-10
H510M-K-rev-11
H510M-S2-rev-10-11-12
H510M-S2-rev-13
H510M-S2H-rev-10
H510M-S2H-V2-rev-10
H510M-S2H-V2-rev-11
H510M-S2H-V2-rev-13
H510M-S2P-rev-10
H510M-S2P-rev-10-12
H610I-DDR4-rev-10
H610M-H-DDR4-rev-10
H610M-H-DDR4-rev-11
H610M-H-DDR4-rev-11-13
H610M-H-DDR4-rev-12
H610M-H-rev-10
H610M-H-V2-DDR4-rev-10
H610M-HD3P-rev-10
H610M-HD3P-rev-20
H610M-K-DDR4-rev-10
H610M-S2-DDR4-rev-10
H610M-S2-DDR4-rev-11
H610M-S2-DDR4-rev-11-13
H610M-S2-DDR4-rev-12
H610M-S2-rev-10
H610M-S2-V2-DDR4-rev-10
H610M-S2H-DDR4-rev-10
H610M-S2H-DDR4-rev-11
H610M-S2H-DDR4-rev-11-13
H610M-S2H-DDR4-rev-12
H610M-S2H-rev-10
H610M-S2H-V2-DDR4-rev-10
N4120I-H-rev-10
N5105I-H-rev-10
Q670M-D3H-DDR4-rev-10
W480M-VISION-W-rev-10
X570S-AORUS-ELITE-AX-rev-11
X570S-AORUS-ELITE-rev-10
X570S-AORUS-MASTER-rev-10
X570S-AORUS-PRO-AX-rev-10
X570S-AORUS-PRO-AX-rev-11
X570S-GAMING-X-rev-10
X570S-UD-rev-10
X570SI-AORUS-PRO-AX-rev-10
X570SI-AORUS-PRO-AX-rev-11
X670-AORUS-ELITE-AX-rev-10
X670-AORUS-ELITE-AX-rev-11
X670-GAMING-X-AX-rev-10
X670E-AORUS-MASTER-rev-10
X670E-AORUS-XTREME-rev-10
Z590-AORUS-ELITE-AX-rev-10
Z590-AORUS-ELITE-rev-10
Z590-AORUS-MASTER-rev-10
Z590-AORUS-PRO-AX-rev-10
Z590-AORUS-TACHYON-rev-10
Z590-AORUS-ULTRA-rev-10
Z590-D-rev-10
Z590-GAMING-X-rev-1x
Z590-UD-AC-rev-1x
Z590-UD-rev-10
Z590I-AORUS-ULTRA-rev-10
Z690-AERO-D-rev-10
Z690-AERO-D-rev-1x
Z690-AERO-G-DDR4-rev-10
Z690-AERO-G-DDR4-rev-1x
Z690-AERO-G-rev-10
Z690-AERO-G-rev-1x
Z690-AORUS-ELITE-AX-DDR4-rev-10
Z690-AORUS-ELITE-AX-DDR4-rev-1x
Z690-AORUS-ELITE-AX-DDR4-V2-rev-10
Z690-AORUS-ELITE-AX-rev-10
Z690-AORUS-ELITE-AX-rev-14
Z690-AORUS-ELITE-AX-rev-1x
Z690-AORUS-ELITE-DDR4-rev-10
Z690-AORUS-ELITE-DDR4-rev-1x
Z690-AORUS-ELITE-DDR4-V2-rev-10
Z690-AORUS-ELITE-rev-10
Z690-AORUS-ELITE-STEALTH-rev-10
Z690-AORUS-MASTER-rev-10
Z690-AORUS-MASTER-rev-1x
Z690-AORUS-PRO-DDR4-rev-10
Z690-AORUS-PRO-DDR4-rev-1x
Z690-AORUS-PRO-rev-10
Z690-AORUS-PRO-rev-1x
Z690-AORUS-TACHYON-rev-10
Z690-AORUS-ULTRA-rev-10
Z690-AORUS-ULTRA-rev-1x
Z690-AORUS-XTREME-rev-10
Z690-AORUS-XTREME-WATERFORCErev-10
Z690-GAMING-X-DDR4-rev-10
Z690-GAMING-X-DDR4-rev-11
Z690-GAMING-X-DDR4-V2-rev-10
Z690-GAMING-X-rev-10
Z690-GAMING-X-rev-10-11
Z690-UD-AC-rev-10
Z690-UD-AX-DDR4-rev-10
Z690-UD-AX-DDR4-rev-1x
Z690-UD-AX-DDR4-V2-rev-10
Z690-UD-AX-rev-10
Z690-UD-AX-rev-1x
Z690-UD-DDR4-rev-10
Z690-UD-DDR4-rev-1x
Z690-UD-DDR4-V2-rev-10
Z690-UD-rev-10
Z690-UD-rev-1x
Z690I-AORUS-ULTRA-DDR4-rev-10
Z690I-AORUS-ULTRA-LITE-DDR4-rev-10
Z690I-AORUS-ULTRA-LITE-rev-10
Z690I-AORUS-ULTRA-PLUS-DDR4-rev-10
Z690I-AORUS-ULTRA-PLUS-rev-10
Z690I-AORUS-ULTRA-rev-10
Z690M-AORUS-ELITE-AX-DDR4-rev-10
Z690M-AORUS-ELITE-AX-DDR4-rev1x
Z690M-AORUS-ELITE-DDR4-rev-10
Z690M-DS3H-DDR4-rev-10
Z790-AERO-G-rev-10
Z790-AORUS-ELITE-AX-DDR4-rev-10
Z790-AORUS-ELITE-AX-rev-10
Z790-AORUS-ELITE-AX-rev-11
Z790-AORUS-ELITE-DDR4-rev-10
Z790-AORUS-ELITE-rev-10
Z790-AORUS-ELITE-rev-11
Z790-AORUS-MASTER-rev-10
Z790-AORUS-TACHYON-rev-10
Z790-AORUS-XTREME-rev-10
Z790-D-DDR4-rev-10
Z790-GAMING-X-AX-rev-10
Z790-GAMING-X-AX-rev-1x
Z790-GAMING-X-rev-10
Z790-UD-AC-rev-10
Z790-UD-AX-rev-10
Z790-UD-rev-10
Z790I-AORUS-ULTRA-rev-10
Z790M-AORUS-ELITE-AX-rev-10

Jane Leok Contributor

News

This backdoor vulnerability exposes enterprises to a variety of threats and potential attack situations.

Related posts