Uma exhashazwa, lawa maphutha angavumela abahlaseli ukuthi bathole ukufinyelela okungagunyaziwe kulwazi olubucayi noma ngokuvamile babangele izinkinga.
Kukhishwe ulwazi muva nje lokuthi abacwaningi be-Eclypsium bathole ukuziphatha okungavamile ezinhlelweni ezinamabhodi e-motherboard e-"Gigabyte".
Abacwaningi bathi bathole ukuthi i-firmware ye-UEFI esetshenziswa kumabhodi e-motherboard ithathe indawo futhi yavula ifayela elisebenzisekayo lepulatifomu ye-Windows, konke ngaphandle kokwazisa umsebenzisi ngesikhathi sokuqalisa uhlelo. Baphinde basho ukuthi i-executable eqalisiwe ilandwe ku-inthanethi futhi kamuva yavula ama-executable eqembu lesithathu.
Ukuhlaziywa okuningiliziwe kwalesi simo kubonise ukuthi ukuziphatha okufanayo kwenzeka emakhulwini amamodeli ebhodi le-Gigabyte ahlukene futhi kuhlotshaniswa nokusebenza kohlelo lokusebenza lwe-App Center lwenkampani.
Muva nje, inkundla ye-Eclypsium iqale ukuthola ukuziphatha okusolisayo kwe-backdoor ngaphakathi kwezinhlelo ze-Gigabyte endle. Lokhu kutholwa kwakuqhutshwa izindlela zokuthola i-heuristic, ezidlala indima ebalulekile ekutholeni izinsongo ezintsha nezingaziwa ngaphambilini ochungechungeni lokuhlinzeka, lapho imikhiqizo esemthethweni yenkampani yangaphandle noma izibuyekezo zobuchwepheshe ziye zafakwa engcupheni.
Ngokuphathelene nenqubo, kushiwo ukuthi ifayela elisebenzisekayo lifakwa kwi-firmware ye-UEFI futhi ligcinwe kudiski ngesikhathi senqubo yokuqalisa uhlelo ngesikhathi sokuqalisa. Ngesikhathi sesigaba sokuqalisa umshayeli (i-DXE, i-Driver Execution Environment), kusetshenziswa i-WpbtDxe.efi firmware module, leli fayela lifakwa kwimemori futhi libhalwe etafuleni le-WPBT ACPI, okuqukethwe kwalo kulayishwa futhi kusetshenziswe yi-Windows session manager (smss.exe, uhlelo olungaphansi lwe-Windows session manager).
Ngaphambi kokulayisha, imojula ihlola ukuthi isici esithi "Ukulanda Nokufaka Kwesikhungo Se-APP" sinikwe amandla ku-BIOS/UEFI, njengoba ngokuzenzakalela lokhu kuvaliwe. Ngesikhathi sokuqalisa ngasohlangothini lweWindows, ikhodi ingena esikhundleni sefayela elisebenzisekayo ohlelweni, elibhaliswe njengensizakalo yesistimu.
Ukuhlaziya kwethu kokulandela kuthole ukuthi i-firmware kuzinhlelo ze-Gigabyte ilanda futhi isebenzisa i-Windows yomdabu esebenzisekayo phakathi nenqubo yokuqalisa isistimu, futhi lokhu okusebenzisekayo bese kuyadawuniloda futhi kusebenzisa imithwalo ekhokhelwayo eyengeziwe ngendlela engavikelekile.
Ngemva kokuqala insiza ye-GigabyteUpdateService.exe, isibuyekezo silandwa kumaseva e-Gigabyte, kodwa lokhu kwenziwa ngaphandle kokuqinisekiswa okufanele kwedatha elandiwe kusetshenziswa isiginesha yedijithali futhi ngaphandle kokusebenzisa ukubethela kwesiteshi sokuxhumana.
Ngaphezu kwalokho, kushiwo ukuthi ukulanda nge-HTTP ngaphandle kokubethela kwakuvunyelwe, kodwa ngisho nalapho kufinyelelwa nge-HTTPS, isitifiketi asizange siqinisekiswe, okuvumela ifayela ukuthi lithathelwe indawo ngokuhlaselwa kwe-MITM kanye nokusetshenziswa kwekhodi yabo ohlelweni lomsebenzisi.
Le backdoor ibonakala isebenzisa umsebenzi wamabomu futhi izodinga isibuyekezo se-firmware ukuze siyisuse ngokuphelele kumasistimu athintekile. Nakuba uphenyo lwethu oluqhubekayo lungakaqinisekisi ukuxhashazwa yisigebengu esikhethekile, i-backdoor esabalele okunzima ukuyiqeda imelela ubungozi bochungechunge lokuhlinzeka ngezinhlangano ezinezinhlelo ze-Gigabyte.
Ukuze izinto zibe nzima, ukuqeda inkinga ngokuphelele kudinga isibuyekezo se-firmware , njengoba i-logic yokusebenzisa ikhodi yomuntu wesithathu ifakiwe ku-firmware. Njengesivikelo sesikhashana ekuhlaselweni kwe-man-in-the-middle (MITM) kwabasebenzisi be-Gigabyte motherboard, kunconywa ukuvimba ama-URL ashiwo ngenhla ku-firewall yakho.
I-Gigabyte iyazi ngokungamukeleki kokuba nezinsizakalo zokuvuselela okuzenzakalelayo ezingavikelekile ezifakwe ngenkani kwi-firmware yesistimu, njengoba ukufaka engcupheni ingqalasizinda yenkampani noma yelungu le-supply chain kungaholela ekuhlaselweni kwabasebenzisi kanye nenhlangano, njengoba okwamanje ukukhishwa kwe-malware akulawulwa ezingeni lesistimu yokusebenza.
Ngenxa yalokho, noma yimuphi umlingisi osongelayo angasebenzisa lokhu ukuze aqhubeke ethelela amasistimu asengozini, kungaba nge-MITM noma ingqalasizinda esengozini.
Okokugcina, uma unesithakazelo sokufunda okwengeziwe, ungathola imininingwane kusixhumanisi esilandelayo.