{"id":52163,"date":"2023-06-02T02:15:10","date_gmt":"2023-06-02T02:15:10","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/millions-of-gigabyte-pc-motherboards-backdoored-whats-the-actual-score\/"},"modified":"2023-06-02T02:15:10","modified_gmt":"2023-06-02T02:15:10","slug":"millions-of-gigabyte-pc-motherboards-backdoored-whats-the-actual-score","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/millions-of-gigabyte-pc-motherboards-backdoored-whats-the-actual-score\/","title":{"rendered":"Millions of Gigabyte PC motherboards backdoored? What’s the actual score?"},"content":{"rendered":"
<\/div>\n

FAQ<\/span> You may have seen some headlines about a supply-chain backdoor in millions of Gigabyte motherboards. Here’s the lowdown.<\/p>\n

What’s the problem?<\/h3>\n

Gigabyte ships a wide range of motherboard models that come with an App Center<\/a> utility, which is supposed to keep the system’s firmware, drivers, and related software up to date. It checks for updates and offers to fetch and install them, saving people from having to do it by hand or getting deep into their BIOS settings. Trouble is, the way Gigabyte implemented this potentially leaves people at risk of infection.<\/p>\n

How so?<\/h3>\n

The UEFI firmware Gigabyte ships with its motherboards performs a number of actions as the system boots. On Windows PCs, this includes quietly writing a Windows program that’s embedded in the firmware to disk as GigabyteUpdateService.exe<\/code> in the OS’s system32<\/code> folder, and running it. That .exe sets itself up as a Windows service and then fetches from the internet another executable, and runs it. It fetches that second program from one of these locations:<\/p>\n