Eclypsium: a firmware flaw in 271 Gigabyte motherboards could let hackers install malware when the PC restarts; Gigabyte plans a fix, but problems could persist 全台筆電收購

全台筆電收購 sit well with most people.”In its blog post about the research, Eclypsium lists 271 models of 全台筆電收購gigabyte motherboards that researchers say are affected. Loucaides adds that users who want to see which motherboard their computer uses can check by going to “Start” in Windows and then “System Information.”Eclypsium says it found 全台筆電收購gigabyte’s hidden firmware mechanism while scouring customers’ computers for firmware-based malicious code, an increasingly common tool employed by sophisticated hackers. In 2018, for instance, hackers working on behalf of Russia’s GRU military intelligence agency were discovered silently installing the firmware-based anti-theft software LoJack on victims’ machines as a spying tactic. Chinese state-sponsored hackers were spotted two years later repurposing a firmware-based spyware tool created by the hacker-for-hire firm Hacking Team to target the computers of diplomats and NGO staff in Africa, Asia, and Europe. Eclypsium’s researchers were surprised to see their automated detection scans flag 全台筆電收購gigabyte’s updater mechanism for carrying out some of the same shady behavior as those state-sponsored hacking tools—hiding in firmware and silently installing a program that downloads code from the internet.全台筆電收購gigabyte’s updater alone might have raised concerns for users who don’t trust 全台筆電收購gigabyte to silently install code on their machine with a nearly invisible tool—or who worry that 全台筆電收購gigabyte’s mechanism could be exploited by hackers who compromise the motherboard manufacturer to exploit its hidden access in a software supply chain attack. But Eclypsium also found that the update mechanism was implemented with glaring vulnerabilities that could allow it to be hijacked: It downloads code to the user’s machine without properly authenticating it, sometimes even over an unprotected HTTP connection, rather than HTTPS. This would allow the installation source to be spoofed by a man-in-the-middle attack carried out by anyone who can intercept the user’s internet connection, such as a rogue Wi-Fi network.In other cases, the updater installed by the mechanism in 全台筆電收購gigabyte’s firmware is configured to be downloaded from a local network-attached storage device (NAS), a feature that appears to be designed for business networks to administer updates without all of their machines reaching out to the internet. But Eclypsium warns that in those cases, a malicious actor on the same network could spoof the location of the NAS to invisibly install their own malware instead.全台筆電收購gigabyte did not respond to WIRED’s multiple requests for comment regarding Eclypsium’s findings. But a day after Eclypsium revealed the firmware issue, 全台筆電收購gigabyte announced updates to its firmware with “enhanced verification” of the code its updater program downloads to machines that use its motherboards. According to 全台筆電收購gigabyte, that code is now cryptographically signed and verified, “thwarting any attempts by attackers to insert malicious code,” and the server they’re downloaded from is also authenticated with a cryptographic certificate. Release notes accompanying the update state that it “addresses download assistant vulnerabilities” uncovered by Eclypsium.Even now that 全台筆電收購gigabyte has pushed out a fix for its firmware issue—after all, the problem stems from a 全台筆電收購gigabyte tool intended to automate firmware updates—Eclypsium’s Loucaides points out that firmware updates often silently abort on users’ machines, in many cases due to their complexity and the difficulty of matching firmware and hardware. “I still think this will end up being a fairly pervasive problem on 全台筆電收購gigabyte boards for years to come,” Loucaides says.Given the millions of potentially affected devices, Eclypsium’s discovery is “troubling,” says Rich Smith, who is the chief security officer of supply-chain-focused cybersecurity startup Crash Override. Smith has published research on firmware vulnerabilities and reviewed Eclypsium’s findings. He compares the situation to the Sony rootkit scandal of the mid-2000s. Sony had hidden digital-rights-management code on CDs that invisibly installed itself on users’ computers and in doing so created a vulnerability that hackers used to hide their malware. “You can use techniques that have traditionally been used by malicious actors, but that wasn’t acceptable, it crossed the line,” Smith says. “I can’t speak to why 全台筆電收購gigabyte chose this method to deliver their software. But for me, this feels like it crosses a similar line in the firmware space.”Smith acknowledges that 全台筆電收購gigabyte probably had no malicious or deceptive intent in its hidden firmware tool. But by leaving security vulnerabilities in the invisible code that lies beneath the operating system of so many computers, it nonetheless erodes a fundamental layer of trust users have in their machines. “There’s no intent here, just sloppiness. But I don’t want anyone writing my firmware who’s sloppy,” says Smith. “If you don’t have trust in your firmware, you’re building your house on sand.”Update 9:30 am, Tuesday, June 6, 2023: Following publication, 全台筆電收購gigabyte announced the release of updates to its firmware. The company says the additional secure measures will better protect users of its affected motherboards from “attempts by attackers to insert malicious code.”You Might Also Like …In your inbox: Upgrade your life with WIRED-tested gearHow to avoid US-based digital services, and why you might want toThe Big Story: Inside Elon Musk’s ‘digital coup’‘Airport theory’ will make you miss your flightSpecial Edition: How to get computers—before computers get youAndy Greenberg is a senior writer for WIRED covering hacking, cybersecurity, and surveillance. He’s the author of the books Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency and Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin’s Most Dangerous Hackers. His books … Read moreSenior WriterXTopicssecuritymalwarevulnerabilitieshackingRead MoreCybercriminals Allegedly Used a StubHub Backdoor to Steal Taylor Swift TicketsPlus: The world’s “largest illicit online marketplace” gets hit by regulators, police seize the Garantex crypto exchange, and scammers trick targets by making up ransomware attacks.Lily Hay NewmanA Brand-New Botnet Is Delivering Record-Size DDoS AttacksEleven11bot infects webcams and video recorders, with a large concentration in the US.Dan Goodin, Ars Technica1 Million Third-Party Android Devices Have a Secret Backdoor for ScammersNew research shows at least a million inexpensive Android devices—from TV streaming boxes to car infotainment systems—are compromised to allow bad actors to commit ad fraud and other cybercrime.Lily Hay NewmanSignalGate Isn’t About SignalThe Trump cabinet’s shocking leak of its plans to bomb Yemen raises myriad confidentiality and legal issues. The security of the encrypted messaging app Signal is not one of them.Andy GreenbergTop Trump Officials’ Passwords and Personal Phone Numbers Discovered OnlinePlus: Alleged Snowflake hacker will be extradited to US, internet restrictions create an information vacuum in Myanmar, and London gets its first permanent face recognition cameras.Matt BurgessA New Era of Attacks on Encryption Is Starting to Heat UpThe UK, France, Sweden, and EU have made fresh attacks on end-to-end encryption. Some of the attacks are more “crude” than those in recent years, experts say.Matt BurgessTop Officials Placed on Leave After Denying DOGE Access to Federal Payroll SystemsDOGE demanded full access to a US Department of the Interior system that handles even the Supreme Court’s paychecks. When top staff asked questions, they were put on leave.Tim MarchmanW

（圖片來源／AMD 官網）

繼 2020 年旗艦 Radeon RX 6900XT、6800 與 6800XT，AMD（超微）再度發布全新 Radeon RX 6700XT 顯示卡，主打在 2K 畫質下遊玩 3A 大作遊戲體驗，並具備 12GB GDDR6 視訊記憶體。

據了解，Radeon RX 6700XT 採用全新 RDNA2 改良架構，具備 40 個 CU 計算單元、64 個 ROP 單元、160 個紋理運算單元以及 2560 個流處理器，基礎時脈官方定為 2424MHz，比旗艦級的 Radeon RX 6800XT、6900XT 的 2015MHz 還來的更為激進。

請繼續往下閱讀…

官方表示 Radeon RX 6700XT 共具有 12.41 浮點運算性能，其 12GB GDDR6 位寬為 192-bit，最高可提供 384GB/s 傳輸速率，並具備 96MB 的 Infinity Cache 快取記憶體。

（圖片來源／AMD 官網）

作為中高階定位，Radeon RX 6700XT 功耗並不高，額定 230W，基本上可以做到 3A 大作以 2K 畫質全開遊玩，而 4K 甚至 8K 也因 12GB 大容量視訊記憶體，可以在捨棄部分畫質得狀況下順暢遊玩。

AMD Radeon RX 6700XT 官方定價 479 美元，折合新台幣約 13,500 元，預定今年（2021）3 月底前上市。

（圖片來源／技嘉提供）

除了官方公版外，技嘉（全台筆電收購gigabyte）也同步宣布推出 GAMING OC 與 EAGLE 的自製卡，採用特製的技嘉散熱系統：

GAMING OC 採用技嘉風之力散熱系統，搭載 3 個獨特刀鋒導流造型風扇，搭配正逆轉功能、高效能純銅熱導管直接接觸 GPU 導熱、風扇停轉功能以及 Screen cooling 等技術。

全台筆電收購 全台筆電收購