gigabyte potential security vulnerability

[HomerJ]

came across this on gamers nexus, in the video which starts from 7:50, apparently gigabyte has a new potential security vulnerability in the motherboards

Supply Chain Risk from Gigabyte App Center Backdoor - Eclypsium | Supply Chain Security for the Modern Enterprise

Eclypsium Research discovers that Gigabyte motherboards have an embedded backdoor in their firmware, which drops a Windows executable that can download and execute additional payloads insecurely. The backdoor affects gaming PCs and high-end computers.

eclypsium.com

list of effected motherboards

https://eclypsium.com/wp-content/uploads/Gigabyte-Affected-Models.pdf

gigabyte response

GIGABYTE Fortifies System Security with Latest BIOS Updates and Enhanced Verification | News - GIGABYTE Global

June 1, 2023 – GIGABYTE Technology, one of the leading global manufacturers of motherboards, graphics cards, and hardware solutions, has always priori...

www.gigabyte.com

 

[SpyderTracks]

came across this on gamers nexus, in the video which starts from 7:50, apparently gigabyte has a new potential security vulnerability in the motherboards

Supply Chain Risk from Gigabyte App Center Backdoor - Eclypsium | Supply Chain Security for the Modern Enterprise

Eclypsium Research discovers that Gigabyte motherboards have an embedded backdoor in their firmware, which drops a Windows executable that can download and execute additional payloads insecurely. The backdoor affects gaming PCs and high-end computers.

eclypsium.com

list of effected motherboards

https://eclypsium.com/wp-content/uploads/Gigabyte-Affected-Models.pdf

gigabyte response

GIGABYTE Fortifies System Security with Latest BIOS Updates and Enhanced Verification | News - GIGABYTE Global

June 1, 2023 – GIGABYTE Technology, one of the leading global manufacturers of motherboards, graphics cards, and hardware solutions, has always priori...

www.gigabyte.com

It’s so many boards, not good.

And the fact that it creates a windows account with a basic password is unforgivable, that is literally what malware does.

 

[HomerJ]

It’s so many boards, not good.

And the fact that it creates a windows account with a basic password is unforgivable, that is literally what malware does.

thats what gamers nexus said, literally malware

 

[polycrac]

So, if the vulnerability is in Gigabyte's access to remote-update the Bios, do I need to worry about updating the Bios or will the security fixes be applied automatically?

 

[SpyderTracks]

So, if the vulnerability is in Gigabyte's access to remote-update the Bios, do I need to worry about updating the Bios or will the security fixes be applied automatically?

You'd need to update manually, don't ever trust automated updates,they tend not to apply for months after they're needed