The MSI data breach might have leaked some very important Intel code

(Image credit: Pixabay)

The recent ransomware attack on computing giant MSI, which the company said had resulted in, “no significant impact on the business in terms of finances or operations,” actually did have a significant business impact after all.

Following the attack and the subsequent data leak in April 2023, cybersecurity researchers started sifting through the data for interesting tidbits. One such individual, Alex Matrosov, has now taken to Twitter to say that Intel’s BootGuard private keys were probably leaked with the database.

“The data has now been made public, revealing a vast number of private keys that could affect numerous devices,” he tweeted. “FW Image Signing Keys: 57 products; Intel BootGuard BPM/KM Keys: 166 products.”

Significant impact

Matrosov also explained which devices could be affected by the leak, saying “it appears that Intel BootGuard may not be effective on certain devices based on the 11th Tiger Lake, 12th Adler Lake, and 13th Raptor Lake. Our investigation is ongoing, stay tuned for updates.”

Joining in on the action, automated firmware supply chain security platform, Binarly, tweeted that the “leaked Intel BootGuard keys from MSI are affecting many different device vendors, including Intel, Lenovo, Supermicro, and many others industry-wide.”

On ServeTheHome Intel Boot Guard is described as a “form of protection” similar to Secure Boot, with the main difference being Boot Guard requiring an Authenticated Code Module, signed cryptographically, by Intel.

> Clop ransomware may have infected even more victims than previously thought

> Saks Fifth Avenue becomes latest Clop ransomware victim

> Check out the best firewalls right now

“It could mean that attackers can sign tampered systems and then gain access to what would be considered a secure system,” the publication claims.

While everyone seems to be up in arms over these findings, saying the leak could have “enormous downstream impact”, we’re still waiting for confirmation that the keys are actually authentic. Intel’s Twitter account is currently silent on the matter.

Roughly a month ago, the Taiwanese computing hardware powerhouse MSI filed a document with the Taiwanese Stock Exchange, breaking the news of the ransomware and the subsequent data theft.

These are the best endpoint protection tools right now

Via: ServeTheHome

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.