MSI firmware signing keys leaked • Hacker News Board

Re: MSI firmware signing keys leaked

#11

Post by bogantech » Sat, May 06, 2023, 11:15 AM UTC

wkat4242 wrote: post #7

Why were these keys not in a HSM I wonder..

It's possible they did, in any case keys can be exported from HSMs to ensure availability in the event that your HSM becomes inoperable and needs to be replaced.

For example here are instructions on how to do so with a Thales HSM https://thalesdocs.com/gphsm/ptk/5.4/docs/Content/PTK-C_Admi...

Re: MSI firmware signing keys leaked

#12

Post by rkagerer » Sat, May 06, 2023, 11:20 AM UTC

Is it wrong that my immediate reaction to this is, "Sweet, so I can finally do things with my board I was prevented from before!"

Re: MSI firmware signing keys leaked

#13

Post by lakomen » Sat, May 06, 2023, 11:30 AM UTC

rkagerer wrote: post #12

Is it wrong that my immediate reaction to this is, "Sweet, so I can finally do things with my board I was prevented from before!"

It was mine as well.

They artificially limited both discrete and on board GPU being active at the same time in my GT72's BIOS.

Re: MSI firmware signing keys leaked

#14

Post by charcircuit » Sat, May 06, 2023, 11:37 AM UTC

rkagerer wrote: post #12

Is it wrong that my immediate reaction to this is, "Sweet, so I can finally do things with my board I was prevented from before!"

[flagged]

Re: MSI firmware signing keys leaked

#15

Post by dawidpotocki » Sat, May 06, 2023, 11:43 AM UTC

hexagonwin wrote: post #2

Does this mean that we can now custom firmwares (e.g. coreboot) on those MSI boards?

It was already possible.

https://docs.dasharo.com/variants/msi_z690/overview/

Re: MSI firmware signing keys leaked

#16

Post by solarkraft » Sat, May 06, 2023, 11:45 AM UTC

charcircuit wrote: post #14

rkagerer wrote: post #12

Is it wrong that my immediate reaction to this is, "Sweet, so I can finally do things with my board I was prevented from before!"

[flagged]

I'd be happy about security features if they weren't used against me.

Re: MSI firmware signing keys leaked

#17

Post by charcircuit » Sat, May 06, 2023, 11:47 AM UTC

solarkraft wrote: post #16

charcircuit wrote: post #14

Earlier quoted context omitted.

[flagged]

I'd be happy about security features if they weren't used against me.

Making the hardware you bought secure is the opposite of it being used against you.

Re: MSI firmware signing keys leaked

#18

Post by xvfLJfx9 » Sat, May 06, 2023, 11:48 AM UTC

charcircuit wrote: post #14

rkagerer wrote: post #12

Is it wrong that my immediate reaction to this is, "Sweet, so I can finally do things with my board I was prevented from before!"

[flagged]

Can't you enroll your own keys?

Re: MSI firmware signing keys leaked

#19

Post by charcircuit » Sat, May 06, 2023, 11:52 AM UTC

xvfLJfx9 wrote: post #18

charcircuit wrote: post #14

Earlier quoted context omitted.

[flagged]

Can't you enroll your own keys?

Enrolling keys doesn't make secure boot insecure.

Re: MSI firmware signing keys leaked

#20

Post by dawidpotocki » Sat, May 06, 2023, 11:56 AM UTC

charcircuit wrote: post #14

rkagerer wrote: post #12

Is it wrong that my immediate reaction to this is, "Sweet, so I can finally do things with my board I was prevented from before!"

[flagged]

Secure Boot was already very broken on these boards. By default it does nothing and even if you change settings so that it actually does validation, it should be possible to reset it back from the OS by updating the firmware from the OS as there are no locks for the firmware region.