Solved Gigabyte Download Assistant Vulnerabilities Reported by Eclypsium Research

thecaretaker · Jun 1, 2023

I see Gigabyte are rushing to fix a vulnerability in its BIOS for motherboard that use the App Center. By default, when you start your PC you get a pop up (notification) asking you to download the App Center. This behaviour can be turned off in the BIOS. I personally don't need or want any of the extra items that are controlled by the App Center and have turned this off in the BIOS.

What I don't know, is if by turning this behaviour off in the BIOS, does that render my PC safe from this vulnerability or do I still need to update the BIOS which was released today: BIOS Update

This is the information released yesterday by Eclypsium: Risk-from-gigabyte-app-center-backdoor

Ghot · Jun 1, 2023

thecaretaker said:
I see Gigabyte are rushing to fix a vulnerability in its BIOS for motherboard that use the App Center. By default, when you start your PC you get a pop up (notification) asking you to download the App Center. This behaviour can be turned off in the BIOS. I personally don't need or want any of the extra items that are controlled by the App Center and have turned this off in the BIOS.

What I don't know, is if by turning this behaviour off in the BIOS, does that render my PC safe from this vulnerability or do I still need to update the BIOS which was released today: BIOS Update

This is the information released yesterday by Eclypsium: Risk-from-gigabyte-app-center-backdoor

Try to keep the motherboard chipset drivers, up to date.
As for the BIOS... try to only update (flash), the BIOS when necessary.

Due to Windows 11's never ending changes... you should probably flash the BIOS only every 3-4 versions.
On all other Windows versions, you should only flash the BIOS when absolutely needed.

Motherboard utility software... worse than vampires, werewolves, and giant Japanese robot warriors.

thecaretaker · Jun 1, 2023

Ghot said:
Try to keep the motherboard chipset drivers, up to date.
As for the BIOS... try to only update (flash), the BIOS when necessary.

Dues to Windows 11's never ending changes... you should probably flash the BIOS only every 3-4 versions.
On all other Windows versions, you should only flash the BIOS when absolutely needed.

Motherboard utility software... worse than vampires, werewolves, and giant Japanese robot warriors.

Thanks for the advice Ghot. I would like to add, Motherboard Utility Software... Is as much use as a fart in a spacesuit

Ghot · Jun 1, 2023

thecaretaker said:
Is as much use as a fart in a spacesuit

As much use as...

a screen door in a submarine.
a pay toilet in a diarrhea ward.
a chocolate teapot.
an ashtray on a motorcycle.
an inflatable dart board.
a solar powered foghorn.
a water proof teabag.
an ejector seat in a helicopter.

thecaretaker · Jun 1, 2023

I see Brink has just posted about it: HERE

glasskuter · Jun 1, 2023

To answer your question, in this particular case, if this bios is Gibabytes's fix for the back door issue Brink mentioned, this new bios DOES definitely need to be flashed. You would need to read the release notes on the update to verify that is the fact.

thecaretaker · Jun 1, 2023

glasskuter said:
To answer your question, in this particular case, if this bios is Gibabytes's fix for the back door issue Brink mentioned, this new bios DOES definitely need to be flashed. You would need to read the release notes on the update to verify that is the fact.

Yes, I have updated the bios on this occasion. I had a few TPM mismatch errors when I had fast boot set, but turned hibernate off and back on and it cleared it. All seems well now.

JerryW · Jun 1, 2023

Just flashed my B66M GAMING DDR4 (rev.1.0) since the same note was present with this new a-version bios. Just to be on the safe side.

milkturnipsbage · Jun 2, 2023

JerryW said:
Just flashed my B66M GAMING DDR4 (rev.1.0) since the same note was present with this new a-version bios. Just to be on the safe side.

How can one make sure that their PC have not already been infected with some low-level rootkit/malware because of this open door? I'm thinking about other PC's in the network, mice/keyboard firmware etc.

JerryW · Jun 2, 2023

Yeahoww said:
How can one make sure that their PC have not already been infected with some low-level rootkit/malware because of this open door? I'm thinking about other PC's in the network, mice/keyboard firmware etc.

Scan with anti-virus and/or anti-malware program. The important thing is to close the backdoor in the UEFI/BIOS that otherwise would let the bad actors right in again.

milkturnipsbage · Jun 3, 2023

JerryW said:
Scan with anti-virus and/or anti-malware program. The important thing is to close the backdoor in the UEFI/BIOS that otherwise would let the bad actors right in again.

Sure, but the problem with low level UEFI firmware like this is that the OS have no idea if it’s running malicious code or not. It can lay dormant and download malware in small pieces over time to gain access to and hide from higher levels of the system. Which means that if you have been infected it’s almost impossible to get rid of. And gigabyte left the door open for this to happen.

JerryW · Jun 3, 2023

Yeahoww said:
Sure, but the problem with low level UEFI firmware like this is that the OS have no idea if it’s running malicious code or not. It can lay dormant and download malware in small pieces over time to gain access to and hide from higher levels of the system. Which means that if you have been infected it’s almost impossible to get rid of. And gigabyte left the door open for this to happen.

You do not understand what I am saying. After the UEFI/BIOS is flashed there is no way in for malicious code and so the backdoor is closed. After this you can start getting rid of the malicious programs in a normal way, they are not more dormant or invisible than other malware.

milkturnipsbage · Jun 3, 2023

JerryW said:
You do not understand what I am saying. After the UEFI/BIOS is flashed there is no way in for malicious code and so the backdoor is closed. After this you can start getting rid of the malicious programs in a normal way, they are not more dormant or invisible than other malware.

How would one go about fixing already infected UEFI firmware? Sure, the backdoor is now closed, but what about any potential UEFI malware that was installed during the backdoor was open?

SuperConker · Jun 7, 2023

Yeahoww said:
How would one go about fixing already infected UEFI firmware? Sure, the backdoor is now closed, but what about any potential UEFI malware that was installed during the backdoor was open?

As far as i know updating the Bios will overwrite every part of the old Bios with the new version.

This means anything that should not be there will be gone after an update.