7 ms·
MSI firmware signing keys leaked
- hexagonwin 3y agoDoes this mean that we can now custom firmwares (e.g. coreboot) on those MSI boards?
- mailey 3y agoI'm interested as well in finding out about being able to flash custom firmware. Is there any other resources to follow?
- stavros 3y agoIt's really fucked up that we can't disable secure boot on boards we've bought, and we have to hope their security is compromised instead. What would be the issue with requiring a very manual process to add my own CA to the board so I can load up whatever I want? Ah, vendor lockin, got it.
- whoopdedo 3y agoWell you're in luck then because MSI will just ignore SecureBoot for you. https://news.ycombinator.com/item?id=34388533 https://news.ycombinator.com/item?id=34388533
- dawidpotocki 3y agoIt was already possible. https://docs.dasharo.com/variants/msi_z690/overview/ https://docs.dasharo.com/variants/msi_z690/overview/
- ewokone 3y agoI would love to learn more about that. How would someone use those keys? What's beneficial, what could be useful possible cases for me? And Are my workstations in my company at risk?
- leohonexus 3y agoIf I recall correctly, at boot time CPUs retrieve the firmware along with a cryptographic signature that verifies the firmware came from the signer. Some boards choose to burn this signature into the hardware using e-fuses. If the signing key is leaked, that means someone can flash custom firmware into the chip and the CPU would be none the wiser, all while operating at Ring 0.
- dist-epoch 3y agoCPU firmware (microcode) is signed by Intel, so it would not be affected by this leak, only motherboard firmware.
- rasz 3y agoLenovo vendor locking Ryzen CPUs with AMD PSB https://news.ycombinator.com/item?id=29958247 https://news.ycombinator.com/item?id=29958247
- rasz 3y agoIntel BootGuard Keys? that sounds intriguing
- Proven 3y ago[dead]
- wkat4242 3y agoWhy were these keys not in a HSM I wonder..
- bogantech 3y agoIt's possible they did, in any case keys can be exported from HSMs to ensure availability in the event that your HSM becomes inoperable and needs to be replaced. For example here are instructions on how to do so with a Thales HSM https://thalesdocs.com/gphsm/ptk/5.4/docs/Content/PTK-C_Admin/KMU/import_export.htm https://thalesdocs.com/gphsm/ptk/5.4/docs/Content/PTK-C_Admi...
- Hackbraten 3y agoWhoa. Never would I have thought that a HSM allowed key exports. I somehow assumed that real, non-toy HSMs involved dedicated generators as companion devices with heavily reduced attack surface, which generate and store private key material, are able to transfer it to the HSM proper (and to a paper backup), and are strictly kept offline after that. Sometimes the world feels disappointing.
- hartmel 3y agoHSMs allows to have key stored with the option to disable key export. This means every cryptographic operation must be done by the HSM (commonly through pkcs 11 API). HSMs have backup features and the data cannot be restored without a secret split among multiple secret holders (like https://en.m.wikipedia.org/wiki/Shamir%27s_secret_sharing https://en.m.wikipedia.org/wiki/Shamir%27s_secret_sharing). So a backup can be done on physical media and put in a safe. It's a lot of things about key management, HSMs, pkcs interfaces to learn though.
- ties_ 3y agoWhat is possible with a HSM depends on the policies of the HSM and key objects (e.g. with PKCS#11). Vendors limit the "most open" policy that you can apply. For example, a FIPS 140-2 level 3 module can not offer unbounded key export (https://security.stackexchange.com/a/83981 https://security.stackexchange.com/a/83981). Using a HSM does _not_ guarantee that keys can not be exported. But the converse also holds, a key that is managed by a HSM can not necessarily be exported.
- rkagerer 3y agoIs it wrong that my immediate reaction to this is, "Sweet, so I can finally do things with my board I was prevented from before!"
- lakomen 3y agoIt was mine as well. They artificially limited both discrete and on board GPU being active at the same time in my GT72's BIOS.
- charcircuit 3y ago[flagged]
- solarkraft 3y agoI'd be happy about security features if they weren't used against me.
- charcircuit 3y agoMaking the hardware you bought secure is the opposite of it being used against you.
- TheNewsIsHere 3y agoI don’t agree with that framing. You can absolutely hide behind security to justify actions that are hostile to users. Companies do it _all the time_. There is room for both of these to be true.
- pxmpxm 3y agoMe doing whatever I want with stuff I bought is the definition of ownership. I'm starting to think that these sort of "CVE bro" posts are part of an intentional campaign by manufacturers trying to hold on to their rent seeking scheme. John Deere et al was definitely trying to use those arguments recently.
- josteink 3y agoUnfortunately this leak seems to be for Intel-based boards only, not the AMD ones :(