Laptops and computers using Intel chips could be at risk after a data breach at MSI which also led to a leak of Intel Boot Guard keys.
Back in March of this year, MSI was attacked by the Money Message ransomware gang that claims to have stolen 1.5TB of data including firmware, source code and databases according to BleepingComputer. The cybercriminal group demanded a ransom of $4 million from the company but when MSI refused to pay up, Money Message began leaking all of this stolen data on its data leak site.
Intel is just one of several companies affected by the data breach and its Boot Guard keys have now been leaked online in the aftermath of the attack. At the moment, the extent of the leak is still unknown but it could lead to serious problems for the chip maker as well as users of its products.
In a post on Twitter, Alex Matrosov, founder and CEO of the security platform Binarly, revealed that Intel Boot Guard keys for 166 different products were leaked as well as FW image signing keys for 57 MSI products. Besides Intel, Lenovo, Supermicro and several other companies are also dealing with fallout from MSI’s data breach.
Bypassing Intel’s built-in security features
For those unfamiliar, Intel’s Boot Guard is a security feature within its hardware that is designed to prevent hackers from loading malicious firmware in the Unified Extensible Firmware Interface (UEFI). This type of malicious firmware is known as UEFI bootkits.
With these leaked Intel Boot Guard keys in hand, hackers could be able to create malware capable of bypassing Intel’s safety features according to GHacks. If this happens, the malicious firmware which loads before the operating system on an infected machine would be able to hide its activities from both the kernel and security software like the best antivirus software. To make matters worse, even if an operating system is reinstalled, this malicious software would remain persistent on an affected machine.
In a statement to BleepingComputer, an Intel spokesperson provided further insight on the situation, saying:
"Intel is aware of these reports and actively investigating. There have been researcher claims that private signing keys are included in the data including MSI OEM Signing Keys for Intel® BootGuard. It should be noted that Intel BootGuard OEM keys are generated by the system manufacturer, and these are not Intel signing keys."
At the moment, there isn’t really much Intel users can do to protect themselves from potential threats but we’ll update this story once we find out more.
