SoylentNews is people
SoylentNews
With no easy way to revoke compromised keys, MSI, and its customers, are in a real pickle:
A ransomware intrusion on hardware manufacturer Micro-Star International, better known as MSI, is stoking concerns of devastating supply chain attacks that could inject malicious updates that have been signed with company signing keys that are trusted by a huge base of end-user devices, a researcher said.
"It's kind of like a doomsday scenario where it's very hard to update the devices simultaneously, and they stay for a while not up to date and will use the old key for authentication," Alex Matrosov, CEO, head of research and founder of security firm Binarly, said in an interview. "It's very hard to solve, and I don't think MSI has any backup solution to actually block the leaked keys."
The intrusion came to light in April when, as first reported by Bleeping Computer, the extortion portal of the Money Message ransomware group listed MSI as a new victim and published screenshots purporting to show folders containing private encryption keys, source code, and other data. A day later, MSI issued a terse advisory saying that it had "suffered a cyberattack on part of its information systems." The advisory urged customers to get updates from the MSI website only. It made no mention of leaked keys.
Since then, Matrosov has analyzed data that was released on the Money Message site on the dark web. To his alarm, included in the trove were two private encryption keys. The first is the signing key that digitally signs MSI firmware updates to cryptographically prove that they are legitimate ones from MSI rather than a malicious impostor from a threat actor.
This raises the possibility that the leaked key could push out updates that would infect a computer's most nether regions without triggering a warning. To make matters worse, Matrosov said, MSI doesn't have an automated patching process the way Dell, HP, and many larger hardware makers do. Consequently, MSI doesn't provide the same kind of key revocation capabilities.
"It's very bad, it doesn't frequently happen," he said. "They need to pay a lot of attention to this incident because there are very serious security implications here."
Adding to the concern, MSI to date has maintained radio silence on the matter. Company representatives didn't respond to emails seeking comment and asking if the company planned to issue guidance to its customers.
[...] Whatever the difficulty, possession of the signing key MSI uses to cryptographically verify the authenticity of its installer files significantly lowers the effort and resources required to pull off an effective supply chain attack.
"The worst scenario is if the attackers gain not only access to the keys but also can distribute this malicious update [using those keys]," Matrosov said.
In an advisory, the Netherlands-based National Cybersecurity Center didn't rule out the possibility.
"Because successful abuse is technically complex and in principle requires local access to a vulnerable system, the NCSC considers the risk of abuse to be small," NCSC officials wrote.
(Score: 3, Troll) by Rosco P. Coltrane on Friday May 12, @06:52PM (2 children)
People who modded you up didn't even read what you wrote.
This isn't about secure boot, or recovering a bricked device, or even remote control of stuff the legitimate user is locked out of.
This is about signing a software update package. Of course only the valid distributor of the software - or in this case, firmware - is going to sign the software and keep the private key to themselves. Windows does it for their OS upgrades, Apple does it, Google does it, every Linux distro and every Linux package maintainer does it. It's perfectly normal, it's perfectly okay, this is what cryptographic signing is about.
The issue here is that MSI has lost their private key: anybody can create a firmware upgrade package that existing firmwares already deployed will accept as legit. This is the issue, and it has NOTHING TO DO WITH WITH WHAT YOU'RE RANTING ABOUT.
(Score: 5, Insightful) by Rich on Friday May 12, @07:56PM
They read what I wrote, and this IS about secure boot. From TFA:
"This raises the possibility that the leaked key could push out updates that would infect a computer’s most nether regions without triggering a warning. "
"Compounding the threat, the Money Message hackers also acquired a private encryption key used in a version of the Intel Boot Guard that MSI distributes to its customers. "
And from https://www.intel.com/content/dam/www/central-libraries/us/en/documents/below-the-os-security-white-paper.pdf [intel.com]
"Intel Boot Guard provides a key element of hardware-based boot integrity that meets the Microsoft Windows requirements for UEFI Secure Boot to mitigate unauthorized BIOS boot block modifications."
I read this as being able to get control of the entire boot chain with the keys. However, I will stand corrected if there's a Flashrom solution to directly install Coreboot for all the involved MSI boards that leaves the (CS)ME cold and doesn't install any negative ring crap. Bonus points if that solution provides enough TPM attestation to play games and streaming videos in HD.
(Score: 2) by rpnx on Saturday May 13, @05:31PM
Why are you copy-pasting this bullshit on multiple replies.
If you're going to shill, at least post a reasoned comment that considers the issues. oh... then it would be obvious that you are wrong. Carry on I guess.