MSI firmware signing keys leaked
github.com
MSI firmware signing keys leaked
1–10 of 37 posts
Re: MSI firmware signing keys leaked
#2Does this mean that we can now custom firmwares (e.g. coreboot) on those MSI boards?
Re: MSI firmware signing keys leaked
#3I would love to learn more about that.
How would someone use those keys? What's beneficial, what could be useful possible cases for me? And Are my workstations in my company at risk?
Re: MSI firmware signing keys leaked
#4Intel BootGuard Keys? that sounds intriguing
Re: MSI firmware signing keys leaked
#5I would love to learn more about that. How would someone use those keys? What's beneficial, what could be useful possible cases for me? And Are my workstations in my company at risk?
If I recall correctly, at boot time CPUs retrieve the firmware along with a cryptographic signature that verifies the firmware came from the signer. Some boards choose to burn this signature into the hardware using e-fuses. If the signing key is leaked, that means someone can flash custom firmware into the chip and the CPU would be none the wiser, all while operating at Ring 0.
Re: MSI firmware signing keys leaked
#6[dead]
Re: MSI firmware signing keys leaked
#7Why were these keys not in a HSM I wonder..
Re: MSI firmware signing keys leaked
#8Does this mean that we can now custom firmwares (e.g. coreboot) on those MSI boards?
I'm interested as well in finding out about being able to flash custom firmware.
Is there any other resources to follow?
Re: MSI firmware signing keys leaked
#9Does this mean that we can now custom firmwares (e.g. coreboot) on those MSI boards?
It's really fucked up that we can't disable secure boot on boards we've bought, and we have to hope their security is compromised instead. What would be the issue with requiring a very manual process to add my own CA to the board so I can load up whatever I want?
Ah, vendor lockin, got it.
Re: MSI firmware signing keys leaked
#10I would love to learn more about that. How would someone use those keys? What's beneficial, what could be useful possible cases for me? And Are my workstations in my company at risk?
If I recall correctly, at boot time CPUs retrieve the firmware along with a cryptographic signature that verifies the firmware came from the signer. Some boards choose to burn this signature into the hardware using e-fuses. If the signing key is leaked, that means someone can flash custom firmware into the chip and the CPU would be none the wiser, all while operating at Ring 0.
CPU firmware (microcode) is signed by Intel, so it would not be affected by this leak, only motherboard firmware.