MSI Data Breach: Private Code Signing Keys Leaked on the Dark Web

May 08, 2023Ravie LakshmananData Breach / Software Security

The threat actors behind the ransomware attack on Taiwanese PC maker MSI last month have leaked the company’s private code signing keys on their dark website.

“Confirmed, Intel OEM private key leaked, causing an impact on the entire ecosystem,” Alex Matrosov, founder and CEO of firmware security firm Binarly, said in a tweet over the weekend.

“It appears that Intel Boot Guard may not be effective on certain devices based on the 11th Tiger Lake, 12th Adler Lake, and 13th Raptor Lake.”

Cybersecurity

Present in the leaked data are firmware image signing keys associated with 57 PCs and private signing keys for Intel Boot Guard used on 116 MSI products. The Boot Guard keys from MSI are believed to impact several device vendors, including Intel, Lenovo and Supermicro.

Intel Boot Guard is a hardware-based security technology that’s designed to protect computers against executing tampered UEFI firmware.

The development comes a month after MSI fell victim to a double extortion ransomware attack perpetrated by a new ransomware gang known as Money Message.

MSI Data Breach

MSI, in a regulatory filing at the time, said, “the affected systems have gradually resumed normal operations, with no significant impact on financial business.” It, however, urged users to obtain firmware/BIOS updates only from its official website and refrain from downloading files from other sources.

The leak of the keys poses significant risks as threat actors could use them to sign malicious updates and other payloads and deploy them on targeted systems without raising any red flags.

UPCOMING WEBINAR

Learn to Stop Ransomware with Real-Time Protection

Join our webinar and learn how to stop ransomware attacks in their tracks with real-time MFA and service account protection.

Save My Seat!

It also follows another advisory from MSI recommending users to be on the lookout for fraudulent emails targeting the online gaming community that claims to be from the company under the pretext of a potential collaboration.

This is not the first time UEFI firmware code has entered the public domain. In October 2022, Intel acknowledged the leak of Alder Lake BIOS source code by a third party, which also included the private signing key used for Boot Guard.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.
Cyber Security

Articles You May Like

Samsung Galaxy Z Fold 6 Specifications Allegedly Revealed in Massive Leak, Suggest Minor Hardware Upgrades
SBI Balance Check Number: How to Check SBI Balance Online Using Different Methods
Microsoft Issues Patches for 51 Flaws, Including Critical MSMQ Vulnerability
Chinese EV stocks surge after EU slaps up to 38% additional import tariffs
Shutterstock ImageAI, an Enterprise-Focused AI Text-to-Image Generator Launched

Leave a Reply

Your email address will not be published. Required fields are marked *