3 ms·
We've been hunting for leaked keys, broken IBB's and ACM's for a while, but no real structural thing found so far. There was a Gigabyte implementation that had
by oneplane 8y ago
We've been hunting for leaked keys, broken IBB's and ACM's for a while, but no real structural thing found so far.
There was a Gigabyte implementation that had a broken HOB response meaning you could boot even with unsigned firmware because the BootGuard handler always returned true. Then there was the lenovo one with BootGuard not even enabled, and there was one compal designed board that had BootGuard enabled but no keys fused. (MFG mode open as well)
Most of the implementation don't use Intel's reference with the logic bug, but an AMI or Phoenix or Insyde implementation.
But still hopeful to find a way to serve a bad ACM, mod the IBB (microcode update attack vector perhaps), or find a way to have the ME report fake values for the fuses (since the values are communicated buy the ME OS to the CPU).