A security breach in March robbed MSI of up to 1.5TB of sensitive data. However, MSI is not the only company impacted.
As a result of the breach, Intel is now investigating a major leak of Intel Boot Guard keys. The extent of the damage is still unclear, but the worst-case scenario is that the security feature is now useless on compromised devices — and that’s a pretty lengthy list.
⛓️Digging deeper into the aftermath of the @msiUSA data breach and its impact on the industry.
🔥Leaked Intel BootGuard keys from MSI are affecting many different device vendors, including @Intel , @Lenovo, @Supermicro_SMCI, and many others industry-wide.
🔬#FwHunt is on! https://t.co/NuPIUJQUgr pic.twitter.com/ZB8XKj33Hv
— BINARLY🔬 (@binarly_io) May 5, 2023
This whole fiasco seems to have begun with the MSI data breach that took place earlier this year. The Money Message extortion gang targeted MSI in March, saying that it managed to steal around 1.5TB of sensitive data. It demanded a ransom of $4 million to not leak the data to the public.
MSI refused to give in and didn’t pay the ransom, and unfortunately, the hacker gang followed through and started leaking the firmware source code of MSI’s motherboards.
According to Alex Matrosov, the CEO of Binarly, a security platform, the source code may have contained some really sensitive information, such as Intel Boot Guard private keys for 116 MSI products.
Intel Boot Guard prevents the loading of malicious firmware on Intel hardware. The fact that it’s now compromised makes this as much Intel’s problem as it is MSI’s. If threat actors gain access to these keys, they might be able to create powerful malware that’s capable of bypassing Intel’s security measures.
Matrosov claims that Intel Boot Guard may now be ineffective on some of Intel’s best processors, including Tiger Lake, Alder Lake, and Raptor Lake chips running on MSI-based devices.
In a statement to Bleeping Computer, Intel said: “Intel is aware of these reports and actively investigating. There have been researcher claims that private signing keys are included in the data, including MSI OEM Signing Keys for Intel BootGuard. It should be noted that Intel BootGuard OEM keys are generated by the system manufacturer, and these are not Intel signing keys.”
It’s hard to say precisely how big of an impact this leak might have. It’s possible that it opened the door to the creation of malware that can skip right past Intel Boot Guard, and that could be dangerous for affected devices.
If you’re using a build with an MSI motherboard and an Intel chip, take the usual security measures to stay safe. This includes not downloading files from sources you don’t trust and regularly scanning your computer with antivirus software, if you’re using any. We’ll have to wait for Intel and MSI to share more information on the data breach in order to know what happens next.
