Understanding the Supply Chain Risk Posed by the Gigabyte App Center Backdoor

In recent news, Eclypsium, a renowned firmware and hardware security company, has uncovered a concerning discovery related to Gigabyte, a prominent Taiwanese computer component giant. Through extensive research, Eclypsium's experts have identified backdoor functionality in hundreds of Gigabyte motherboard models, raising serious concerns for organizations worldwide.

The backdoor, detected using Eclypsium's advanced heuristic methods, involves the execution of a Windows native executable during system startup. This insecurely downloaded executable can introduce additional payloads, similar to other exploited OEM backdoor features. After thorough analysis, cybersecurity experts have confirmed the presence of this vulnerability across numerous Gigabyte PC models. To mitigate the associated supply chain risks, it is imperative to address this issue promptly by implementing a firmware update to remove the backdoor from affected systems.

Key Findings:

1. Firmware Dropping OS Executable: The UEFI firmware contains a Windows Native Binary executable that is written to disk and loaded into memory during the system boot process. It is executed by the Windows Session Manager Subsystem upon Windows startup. The "WpbtDxe.efi" firmware module responsible for this behavior checks if the "APP Center Download & Install" feature is enabled in the BIOS/UEFI setup before installing the executable. However, it should be noted that this setting was enabled on the examined system, despite being disabled by default.
2. Downloading and Running Additional Executables: The dropped Windows executable functions as a .NET application that downloads and executes further payloads from specific URLs. These URLs include both insecure (HTTP) and HTTPS-enabled options. It is important to highlight that even with HTTPS, remote server certificate validation is not correctly implemented, making man-in-the-middle (MITM) attacks possible.

Risks and Impact:
The presence of the Gigabyte App Center backdoor poses several risks and potential attack scenarios, including:

1. Abuse of OEM Backdoor: Historically, threat actors have taken advantage of insecure "OEM backdoor" software embedded in PC firmware. Notably, the Sednit group (APT28, FancyBear) exploited Computrace LoJack as a masquerade for a legitimate laptop anti-theft feature.
2. Compromise of OEM Update Infrastructure and Supply Chain: Gigabyte's past breaches, such as the RansomEXX and AvosLocker incidents, raise concerns about the integrity of their update infrastructure and supply chain.
3. Persistence via UEFI Rootkits and Implants: UEFI rootkits and implants are sophisticated malware that reside in firmware, enabling them to subvert the operating system and security controls. The presence of this backdoor opens the door to similar attack scenarios, as demonstrated by the discovery of other UEFI threats like LoJax, MosaicRegressor, and FinSpy.
4. MITM Attacks on Firmware and Software Update Features: The insecure nature of the update process exposes systems to potential MITM attacks, where attackers can manipulate network traffic and compromise the firmware or software updates.
5. Ongoing Risk from Unwanted Behavior within Firmware: Backdoors hidden within firmware are challenging to remove completely. Even if the backdoor executable is removed, the firmware will reinstate it during subsequent system boots.

Recommendations:
To minimize the risks associated with the Gigabyte App Center backdoor, Armoryze, a leading cybersecurity company, recommends the following actions:

1. Regularly Update and Secure Firmware: Ensure that firmware on Gigabyte systems is up to date and includes the latest security patches. Regularly check for firmware updates provided by Gigabyte and apply them promptly to mitigate the risk of abuse through OEM backdoors.
2. Strengthen Supply Chain Security: Implement robust security measures within your organization's supply chain processes. Verify the integrity and authenticity of software updates and components from Gigabyte. Monitor and assess Gigabyte's update infrastructure to detect and prevent potential compromises.
3. Employ UEFI Security Measures: Protect systems against UEFI rootkits and implants by utilizing security solutions that specialize in detecting and mitigating such threats. Consider implementing secure boot and firmware integrity checks to ensure the integrity of the boot process.
4. Secure Firmware and Software Update Channels: Utilize secure channels for firmware and software updates to prevent potential man-in-the-middle (MITM) attacks. Implement encryption and authentication mechanisms to verify the integrity and authenticity of updates. Regularly monitor and assess the update process for any signs of compromise.
5. Partner with Armoryze: Enhance your cybersecurity posture through Armoryze's comprehensive managed security services. Safeguard your organization from risks associated with the Gigabyte App Center backdoor. Our team of experts can provide tailored solutions and proactive threat monitoring to ensure the security of your systems. Schedule a FREE consultation today!

In conclusion, the Gigabyte App Center backdoor poses significant risks to organizations relying on Gigabyte motherboard models. It is crucial to take immediate action by implementing firmware updates, strengthening supply chain security, employing UEFI security measures, and utilizing secure firmware and software update channels. By partnering with Armoryze, you can further enhance your organization's cybersecurity and mitigate the risks associated with this backdoor. Stay proactive and protect your systems from potential threats. Contact us today to secure your digital assets.