3 ms·
It also means that instead of having to compromise Intel's signing key to gain full control, now it's also possible to use any compromised key that's been signe
by jarfil 8y ago
It also means that instead of having to compromise Intel's signing key to gain full control, now it's also possible to use any compromised key that's been signed by Intel, which may not be as well guarded as Intel's one.
- oneplane 8y agoYes, well, it was always possible (either using direct flashing or HDA_SDO), or by forcing a reboot with the upgrade bit set (which was enabled by default on most platforms I've seen up to 2017. (no real data after that since I no longer have to deal with fleets of random systems). I suppose the ME MFG mode here adds for an additional path that can be abused silently, which is a real problem. On the key side of things: I have not yet found a leaked key. That would have made coreboot life so much easier...