Last week, we learned that a ransomware intrusion on hardware manufacturer MSI (Micro-Star International) exposed private keys for Intel Boot Guard. These private keys are used to sign firmware updates to assure users that the updates are legitimate and not from a cybercriminal.
In an ideal situation, Boot Guard will prevent unauthorized firmware from starting. This would prevent malicious actors from inserting malware or spyware below the operating system, out of sight of antivirus and other defense tools. But when cybercriminals have access to the Boot Guard OEM keys, they can make these malicious updates look legitimate to users and trusted by security solutions.
While it’s important to note that these private keys are not actually Intel signing keys, but are keys generated by the system manufacturer, the impact is still widespread—and perhaps not limited to MSI only. Because MSI motherboards may be incorporated into products from other vendors, those systems could also potentially be exposed to abuse from the leaked keys.
But before we talk about how the keys were exposed in the breach, I want to spend a few minutes thinking about what I see is the real problem here. Why were the keys being stored in a location that allowed them to be stolen in the first place?
SolarWinds: Anatomy of a Supersonic Supply Chain Attack
Code signing keys are some of the most valuable security assets that many organizations don’t seem to care about. The private keys that cybercriminals used to compromise over 1 million ASUS customers through firmware updates were found haphazardly stored on a developer’s desktop. And, if that didn’t scare us sufficiently, then maybe the SolarWinds supply chain compromise really should have made us sit up in our seats.
For these reasons, and more, the Certification Authority Browser (CA/B) Forum has decided to take the security of code signing keys under its wing. Starting June 1, they will require that all code signing keys to be stored in security tokens or hardware security modules (HSMs). But did we really need to wait for someone to tell us to take better care of our private keys?
If the Intel Boot Guard private keys had been appropriately secured, then MSI wouldn’t be scrambling to update over a hundred products impacted by the leaked private keys. But how did we get to this point? And how bad is the aftermath likely to be?
It all started in March, when the Money Message extortion gang claimed to have stolen 1.5TB of data from MSI—including firmware, source code and databases. When MSI refused to pay the $4 million ransom, the gang began leaking the MSI data. This data included source code for firmware used by MSI motherboards.
When Alex Matrosov, CEO, head of research, and founder of security firm Binarly, began looking at the stolen data, he was shocked to find two private encryption keys-- the image signing private keys for 57 MSI products and Intel Boot Guard private keys for 116 MSI products. The misuse of these keys would impede the use of Intel Boot Guard in MSI computers to block bad, unwanted, or malicious firmware.
According to Bleeping Computer, “the public keys used to verify firmware signed using the leaked keys are believed to be built into Intel hardware. If they cannot be modified, the security feature is no longer trustworthy on devices using those leaked keys.”
The bottom line is that the MSI breach further highlights the need for organizations of all kinds to protect their private keys. The results of the compromise of just one signing key can be far reaching and severe. Do you know where your organization’s private keys are being stored? Talk to an expert at Venafi to schedule a Venafi Code Sign Maturity Assessment where you can see just how secure your code signing processes are.
Get Fast, Easy, and Secure Enterprise-Grade Code Signing With Venafi!
Related posts