Crack open your desktop PC for a second. No rush, I’ll wait. Are you looking in there? Good. Do you see a Gigabyte motherboard? Okay, now peek under the CPU cooler. I’ll wait again. Okay, see that CPU? If it’s an Intel processor from 8th to 11th generations (2017 to 2021), you might need a new BIOS update… which may or may not exist. Oh dear.
Researchers at Binarly and Carnegie Mellon University disclosed four deep firmware issues to Gigabyte back in April, which could allow attackers to bypass Secure Boot on hundreds of Gigabyte motherboard models. These compromised versions of the Unified Extensible Firmware Interface (UEFI, also sometimes called by the outdated term BIOS) can be used to run code in a pre-boot environment, essentially compromising the computer long before Windows or another operating system boots.
According to BleepingComputer, about 240 Gigabyte motherboard models with Intel chipsets use the American Megatrends parts affected by this firmware, plus tons of devices from other manufacturers that aren’t currently disclosed. Gigabyte already patched the issue on some affected motherboards via the June BIOS update. But given the age of these PCs, many of them are out of service, meaning they’re not scheduled to ever get UEFI/BIOS updates to fix the problem. That is… a problem.
Gigabyte
Gigabyte issued a security bulletin showing which of the affected systems, by chipset, have been patched. About half are past the End Of Life service date, for which Gigabyte recommends that users “Contact the FAE for support.” FAE stands for Field Application Engineer, basically a more technical sort of corporate salesperson who offers highly specialized service after hardware has been bought and installed.
If you bought a Gigabyte motherboard at a retail store, or a PC from a system integrator with a Gigabyte motherboard inside, you don’t have a Field Application Engineer. Reading between the lines, Gigabyte is basically saying “buy a new motherboard.” (Or, considering how old some of them are, “buy a new computer.”) Which, to be fair, is pretty much the same message it’s sending to corporate clients, too.