Intel investigating BootGuard security key leak following MSI hack

Intel is allegedly investigating an information leak that noticed delicate BootGuard non-public keys printed on the darkish internet. 

These non-public keys are designed to guard the units from UEFI bootkits, malicious software program that’s put in on the gadget’s firmware, establishing persistence even when the laborious drive is changed. 

The information was damaged by BleepingComputer, with out elaborating what this investigation entails. In response to the assault, Intel informed the publication “it ought to be famous that Intel BootGuard OEM keys are generated by the system producer, and these should not Intel signing keys.”

Useless features

What we do know is that a ransomware operator known as Money Message broke into hardware manufacturer MSI earlier this year and stole sensitive data. 

The group claims it made away with 1.5TB of sensitive information, including source code, firmware intel, and various databases. In order not to publish the stolen files on the dark web, the group allegedly demanded $4 million in ransom.

MSI turned the offer down, claiming the attack and the stolen files represented no real threat to its business operations. In response, the threat actors made the files public.

After that, different cybersecurity researchers started analyzing the leaked data, with some finding what appear to be image signing private keys for 57 MSI products and Intel Boot Guard private keys for 116 MSI products.

Researcher Alex Matrosov told BleepingComputer that the leak could render Boot Guard ineffective on “11th Tiger Lake, 12th Adler Lake, and 13th Raptor Lake” processors.

“We have evidence the whole Intel ecosystem is impacted by this MSI data breach. It’s a direct threat to MSI customers and unfortunately not only to them,” he mentioned. “The signing keys for fw image allow an attacker to craft malicious (opens in new tab) firmware updates and it can be delivered through a normal bios update process with MSI update tools.”

“The Intel Boot Guard keys leak impacts the whole ecosystem (not only MSI) and makes this security feature useless.”

• These are the perfect endpoint safety instruments (opens in new tab) proper now

Via: BleepingComputer (opens in new tab)