The MSI data breach might have leaked some very important Intel code

Ransomware attack leaked Intel BootGuard private keys

The recent ransomware (opens in new tab) attack on computing giant MSI, which the company said had resulted in, “no significant impact on the business in terms of finances or operations,” actually did have a significant business impact after all.

Following the attack and the subsequent data leak in April 2023, cybersecurity researchers started sifting through the data for interesting tidbits.

One such individual, Alex Matrosov, has now taken to Twitter to say that Intel’s BootGuard private keys were probably leaked with the database.

“The data has now been made public, revealing a vast number of private keys that could affect numerous devices,” he tweeted. “FW Image Signing Keys: 57 products; Intel BootGuard BPM/KM Keys: 166 products.”

Significant impact

Matrosov also explained which devices could be affected by the leak, saying “it appears that Intel BootGuard may not be effective on certain devices based on the 11th Tiger Lake, 12th Adler Lake, and 13th Raptor Lake. Our investigation is ongoing, stay tuned for updates.”

Joining in on the action, automated firmware supply chain security platform, Binarly, tweeted that the “leaked Intel BootGuard keys from MSI are affecting many different device vendors, including Intel, Lenovo, Supermicro, and many others industry-wide.”

On ServeTheHome Intel Boot Guard is described as a “form of protection” similar to Secure Boot, with the main difference being Boot Guard requiring an Authenticated Code Module, signed cryptographically, by Intel.

“It could mean that attackers can sign tampered systems and then gain access to what would be considered a secure system,” the publication claims.

While everyone seems to be up in arms over these findings, saying the leak could have “enormous downstream impact”, we’re still waiting for confirmation that the keys are actually authentic. Intel’s Twitter account is currently silent on the matter.

Roughly a month ago, the Taiwanese computing hardware powerhouse MSI filed a document with the Taiwanese Stock Exchange, breaking the news of the ransomware and the subsequent data theft.

Source