![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
erek
[H]F Junkie
- Joined
- Dec 19, 2005
- Messages
- 10,674
Hmm 
âGiven the millions of potentially affected devices, Eclypsiumâs discovery is âtroubling,â says Rich Smith, who is the chief security officer of supply-chain-focused cybersecurity startup Crash Override. Smith has published research on firmware vulnerabilities and reviewed Eclypsiumâs findings. He compares the situation to the Sony rootkit scandal of the mid-2000s. Sony had hidden digital-rights-management code on CDs that invisibly installed itself on usersâ computers and in doing so created a vulnerability that hackers used to hide their malware. âYou can use techniques that have traditionally been used by malicious actors, but that wasnât acceptable, it crossed the line,â Smith says. âI canât speak to why Gigabyte chose this method to deliver their software. But for me, this feels like it crosses a similar line in the firmware space.â
Smith acknowledges that Gigabyte probably had no malicious or deceptive intent in its hidden firmware tool. But by leaving security vulnerabilities in the invisible code that lies beneath the operating system of so many computers, it nonetheless erodes a fundamental layer of trust users have in their machines. âThereâs no intent here, just sloppiness. But I donât want anyone writing my firmware whoâs sloppy,â says Smith. âIf you donât have trust in your firmware, youâre building your house on sand.ââ
Source: https://www.wired.com/story/gigabyte-motherboard-firmware-backdoor/
âGiven the millions of potentially affected devices, Eclypsiumâs discovery is âtroubling,â says Rich Smith, who is the chief security officer of supply-chain-focused cybersecurity startup Crash Override. Smith has published research on firmware vulnerabilities and reviewed Eclypsiumâs findings. He compares the situation to the Sony rootkit scandal of the mid-2000s. Sony had hidden digital-rights-management code on CDs that invisibly installed itself on usersâ computers and in doing so created a vulnerability that hackers used to hide their malware. âYou can use techniques that have traditionally been used by malicious actors, but that wasnât acceptable, it crossed the line,â Smith says. âI canât speak to why Gigabyte chose this method to deliver their software. But for me, this feels like it crosses a similar line in the firmware space.â
Smith acknowledges that Gigabyte probably had no malicious or deceptive intent in its hidden firmware tool. But by leaving security vulnerabilities in the invisible code that lies beneath the operating system of so many computers, it nonetheless erodes a fundamental layer of trust users have in their machines. âThereâs no intent here, just sloppiness. But I donât want anyone writing my firmware whoâs sloppy,â says Smith. âIf you donât have trust in your firmware, youâre building your house on sand.ââ
Source: https://www.wired.com/story/gigabyte-motherboard-firmware-backdoor/
![Zarathustra[H]](https://cdn.hardforum.com/data/avatars/m/9/9298.jpg?1677728934){kind=avatar}
