The MSI data breach might have leaked some very important Intel code
Ransomware attack leaked Intel BootGuard private keys
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
The recentransomwareattack on computing giantMSI, which the company said had resulted in, “no significant impact on the business in terms of finances or operations,” actually did have a significant business impact after all.
Following the attack and the subsequent data leak in April 2023, cybersecurity researchers started sifting through the data for interesting tidbits. One such individual, Alex Matrosov, has now taken to Twitter to say thatIntel’s BootGuard private keys were probably leaked with the database.
“The data has now been made public, revealing a vast number of private keys that could affect numerous devices,” he tweeted. “FW Image Signing Keys: 57 products; Intel BootGuard BPM/KM Keys: 166 products.”
Significant impact
Matrosov also explained which devices could be affected by the leak, saying “it appears that Intel BootGuard may not be effective on certain devices based on the 11th Tiger Lake, 12th Adler Lake, and 13th Raptor Lake. Our investigation is ongoing, stay tuned for updates.”
Joining in on the action, automated firmware supply chain security platform, Binarly, tweeted that the “leaked Intel BootGuard keys from MSI are affecting many different device vendors, including Intel,Lenovo, Supermicro, and many others industry-wide.”
On ServeTheHome Intel Boot Guard is described as a “form of protection” similar to Secure Boot, with the main difference being Boot Guard requiring an Authenticated Code Module, signed cryptographically, by Intel.
Clop ransomware may have infected even more victims than previously thought>Saks Fifth Avenue becomes latest Clop ransomware victim>Check out the best firewalls right now
“It could mean that attackers can sign tampered systems and then gain access to what would be considered a secure system,” the publication claims.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
While everyone seems to be up in arms over these findings, saying the leak could have “enormous downstream impact”, we’re still waiting for confirmation that the keys are actually authentic. Intel’s Twitter account is currently silent on the matter.
Roughly a month ago, the Taiwanese computing hardware powerhouse MSI filed a document with the Taiwanese Stock Exchange, breaking the news of the ransomware and the subsequent data theft.
Via:ServeTheHome
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
