securityaffairs.com Open in urlscan Pro
2606:4700:3031::ac43:8cd3  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.com/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.com/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

WE VALUE YOUR PRIVACY

We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.

With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.

MORE OPTIONSAGREE

Ad


 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


MUST READ

Headlines
 * Experts warn of backdoor-like behavior within Gigabyte systems
 * Threat actors are exploiting Barracuda Email Security Gateway bug since
   October 2022
 * Swiss real estate agency Neho fails to put a password on its systems
 * Microsoft found a new bug that allows bypassing SIP root restrictions in
   macOS
 * PyPI enforces 2FA authentication to prevent maintainers' account takeover
 * A database containing 478,000 RaidForums members leaked online



Ad


 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me


EXPERTS WARN OF BACKDOOR-LIKE BEHAVIOR WITHIN GIGABYTE SYSTEMS

May 31, 2023  By Pierluigi Paganini




RESEARCHERS DISCOVERED A SUSPECTED BACKDOOR-LIKE BEHAVIOR WITHIN GIGABYTE
SYSTEMS THAT EXPOSES DEVICES TO COMPROMISE.

Researchers from firmware security firm Eclypsium have discovered a suspected
backdoor-like behavior within Gigabyte systems.

The experts discovered that the firmware in Gigabyte systems drops and executes
a Windows native executable during the system startup process. The executable is
utilized for insecure downloading and execution of additional payloads. The
experts pointed out that this is the same behavior observed for other OEM
backdoor-like features like Computrace backdoor (a.k.a. LoJack DoubleAgent)
and firmware implants such as Sednit LoJax, MosaicRegressor, Vector-EDK. 


00:00/00:00


Further analysis revealed that this behavior is present in hundreds of models of
Gigabyte PCs.

“This backdoor appears to be implementing intentional functionality and would
require a firmware update to completely remove it from affected systems.” reads
the analysis from Eclypsium. “While our ongoing investigation has not confirmed
exploitation by a specific threat actor, an active widespread backdoor that is
difficult to remove poses a supply chain risk for organizations with Gigabyte
systems.”

Firmware security firm Eclypsium said it first detected the anomaly in April
2023. Gigabyte has since acknowledged and addressed the issue.



Upon analyzing of the impacted UEFI firmware, the researchers identified a file
named

File Name: 8ccbee6f7858ac6b92ce23594c9e2563ebcef59414b5ac13ebebde0c715971b2.bin,
which is a Windows Native Binary executable. The executable resides in a UEFI
firmware volume.

The firmware writes the executable to disk at the system boot process, this
technique is commonly employed by UEFI implants and backdoors.

The executable can be used to carry out malicious activities such as downloading
and executing additional payloads.

The Windows executable is a .NET application that downloads and runs an
executable payload from one of the following locations, depending on its
configuration:

 * http://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4
 * https://mb.download.gigabyte.com/FileList/Swhttp/LiveUpdate4
 * https://software-nas/Swhttp/LiveUpdate4

The experts pointed out that the use of HTTP opens the doors to
Machine-in-the-middle (MITM) attacks. The researchers also noticed that even
when using the HTTPS protocol, the validation of the remote server certificate
is not implemented correctly allowing MITM attacks also in that case. 

Compounding the situation, the firmware doesn’t support digital signature
verification for the executables.

“The dropped executable and the normally-downloaded Gigabyte tools do have a
Gigabyte cryptographic signature that satisfies the code signing requirements of
Microsoft Windows, but this does little to offset malicious use, especially if
exploited using Living-off-the-Land techniques (like in the recent alert
regarding Volt Typhoon attackers).” continues the report. “As a result, any
threat actor can use this to persistently infect vulnerable systems either via
MITM or compromised infrastructure.”

The backdoor-like behavior likely impacts more than three hundred Gigabyte
systems

These issues expose organizations wide a wide range of attack scenarios. 

 * Abuse of an OEM backdoor by threat actors.
 * Compromise of the OEM update infrastructure and supply chain.
 * Persistence using UEFI Rootkits and Implants.
 * MITM attacks on firmware and software update features.
 * Ongoing risk due to unwanted behavior within official firmware. 

Eclypsium recommends the following actions to minimize the risk:

 * Scan and monitor systems and firmware updates.
 * Update systems to the latest validated firmware and software.
 * Inspect and disable the “APP Center Download & Install” feature in UEFI/BIOS
   Setup on Gigabyte systems and set a BIOS password to deter malicious changes.
 * Block the above URLs.

The researchers are working with Gigabyte to address this issue.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Gigabyte)


SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 


FirmwareGigabyteHackinghacking newsinformation security newsIT Information
SecurityPierluigi PaganiniSecurity AffairsSecurity News


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

Threat actors are exploiting Barracuda Email Security Gateway bug since October
2022


--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


THREAT ACTORS ARE EXPLOITING BARRACUDA EMAIL SECURITY GATEWAY BUG SINCE OCTOBER
2022

May 31, 2023  By Pierluigi Paganini

SWISS REAL ESTATE AGENCY NEHO FAILS TO PUT A PASSWORD ON ITS SYSTEMS

May 31, 2023  By Pierluigi Paganini





 * Ad


 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES

 * Ad


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

THREAT ACTORS ARE EXPLOITING BARRACUDA EMAIL SECURITY GATEWAY BUG SINCE OCTOBER
2022

Recently disclosed zero-day flaw in Barracusa Email Security Gateway (ESG)
appliances had been actively exploited by attackers...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me

We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT


Go to mobile version