5 ms·

Apple’s Secureboot private key leaked

SulfurHexaFluri 6y ago
What does this mean?
- M4v3R 6y ago
  Apparently not much and the title seems to be wrong (unless there’s more the I didn’t see). According to people in that Twitter thread it’s the public part that’s just extracted from iBoot which ships on every iOS device [1]. It doesn’t let you sign your own boot loaders. [0] https://twitter.com/aydenpanhuyzen/status/1332084351039889412?s=21 https://twitter.com/aydenpanhuyzen/status/133208435103988941... [1] https://twitter.com/matteyeux/status/1332083960172703750?s=21 https://twitter.com/matteyeux/status/1332083960172703750?s=2...
DyslexicAtheist 6y ago
-----BEGIN CERTIFICATE----- MIIFWjCCA0KgAwIBAgIIUhVj+f330MYwDQYJKoZIhvcNAQEMBQAwSzEnMCUGA1UE AwweQXBwbGUgU2VjdXJlIEJvb3QgUm9vdCBDQSAtIEcyMRMwEQYDVQQKDApBcHBs ZSBJbmMuMQswCQYDVQQGEwJVUzAeFw0xNDEyMTkyMDEzMTBaFw0zNDEyMTQyMDEz MTBaMEsxJzAlBgNVBAMMHkFwcGxlIFNlY3VyZSBCb290IFJvb3QgQ0EgL
- viraptor 6y ago
  So the tweet contents are the beginning of a public part of the certificate. Maybe there are private keys in the link down the thread, but that's a multi-megabyte package, while the key would be just ~1kB normally. If this is real, it's a really weird way to share it.
  - DyslexicAtheist 6y ago
    the link to the full key is in one of the replies (on mega) d4x ├── d431ap │ ├── AppleSecureBootCA-G2.der │ ├── AppleSecureBootRootCA-G2.pem │ ├── AppleSMCFirmware-2317.60.63.0.1.d43_avus.REL.dump │ ├── AppleSMCFirmware-2317.60.63.0.1.d43_whitney.REL.dump │ ├── AppleStorageProcessorANS2-1161.60.1.122.1~1.dump │ ├── iBoot-6723.60.60.0.2-iOS-14.3b2 │ ├── _iBoot-6723.60.60.0.2-iOS-14.3b2-0.extracted.zip │ ├── _iBoot-6723.60.60.0.2-iOS-14.3b2-1.extracted.zip │ ├── _iBoot-6723.60.60.0.2-iOS-14.3b2.extracted 2.zip │ ├── _iBoot-6723.60.60.0.2-iOS-14.3b2.extracted.zip │ └── LLB.i64 └── __MACOSX └── d431ap 3 directories, 11 files
    - gretchmaar 6y ago
      Anyone loaded the pem to test if it matches?
      - DyslexicAtheist 6y ago
        yes, it is just the certificate. no private key. (i fired to quick with this post - too good to be true lol) Certificate: Data: Version: 3 (0x2) Serial Number: 5914743610979897542 (0x521563f9fdf7d0c6) Signature Algorithm: sha384WithRSAEncryption Issuer: CN = Apple Secure Boot Root CA - G2, O = Apple Inc., C = US Validity Not Before: Dec 19 20:13:10 2014 GMT Not After : Dec 14 20:13:10 2034 GMT Subject: CN = Apple Secure Boot Root CA - G2, O = Apple Inc., C = US Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (4096 bit) Modulus: 00:d3:bb:1e:c2:f4:ad:f1:6d:ee:8f:12:e4:e2:4f: ce:15:5a:a7:0b:7c:12:21:09:4e:0d:32:6a:c7:c9: 5d:ea:f6:d1:80:94:7f:a5:37:13:1a:c7:39:f4:b3: 0f:97:dc:7b:06:52:c3:25:ee:96:4a:14:b7:0b:ba: 3f:9c:30:63:fa:4e:38:f6:01:5b:ec:0b:9d:e2:44: a5:c5:49:2d:69:78:5f:27:b4:a8:a4:3a:8d:a9:7d: e3:cd:a3:ec:ca:d5:f6:82:76:7d:75:be:27:a3:1b: f3:a2:5f:6c:60:2e:71:5f:c1:b4:dd:61:8b:ab:13: a9:64:79:e4:9c:3c:a5:3c:00:02:48:d4:53:10:8a: 16:66:5b:b0:a9:67:ff:a8:e3:ea:b9:b3:8e:e9:d7: df:f7:3a:61:0c:52:11:96:71:8e:89:89:9b:7b:8f: 26:14:39:81:42:e9:9e:4b:5e:42:a2:6a:9b:78:e3: 2c:a9:b9:ed:3c:e6:77:5b:5c:4a:1c:36:7b:2d:02: 23:38:ab:d2:cc:3c:b8:5f:a9:fb:1e:5d:94:49:ac: 7b:1c:ea:46:03:86:ae:fd:db:8c:a4:e1:a3:9a:c4: f4:d3:39:0e:4a:4b:db:b3:68:14:9b:d8:4f:a3:fd: d1:ba:cf:74:88:c5:12:b3:1c:22:46:9b:0a:b0:aa: 62:3a:6e:17:76:10:38:34:8a:b2:db:23:84:5d:98: c0:e9:cc:d8:12:da:92:fd:40:2e:83:6b:bc:2b:ef: d2:2f:5c:f9:89:3f:e7:ae:5a:f7:64:6e:82:83:62: 17:e4:b4:fb:e9:15:01:42:57:3d:42:a8:f0:b9:7f: 88:ed:0e:6e:7a:cc:fb:37:2d:57:d9:d7:d5:a3:64: 16:35:6a:16:68:65:e7:f0:77:45:bb:bb:e6:d4:79: 87:23:5d:95:40:da:06:be:d2:de:b7:9f:39:b0:14: 83:3b:55:2c:9d:70:14:b0:e7:ca:ee:35:2f:18:c7: 70:13:70:2b:a4:11:be:1d:ba:94:65:a6:8b:a7:af: c9:65:5c:79:34:ae:13:9a:2f:0a:e3:59:16:f8:75: 9f:d5:51:f4:92:af:18:7c:7a:25:96:81:3e:24:ae: 19:f9:f7:5d:76:df:b7:41:0d:29:18:01:cf:ef:47: 67:48:96:7c:f9:2f:b7:2d:86:b1:22:c9:6d:ac:ba: 5c:c3:f9:1f:cb:32:c1:42:9b:34:20:03:c9:11:cc: 0e:47:0d:6a:3a:9c:d0:f9:35:d0:fa:d8:dd:50:89: 8d:a9:8d:f1:81:a6:d5:fb:c2:d8:52:10:f9:2b:3f: 56:68:81:c9:66:ce:df:b3:8c:b4:b7:e1:d1:9b:96: 85:31:8f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 68:E9:59:50:45:F1:5D:07:F9:3F:C4:26:FC:1C:27:62:7D:9E:13:94 X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Certificate Sign, CRL Sign Signature Algorithm: sha384WithRSAEncryption 86:7e:b5:1e:3a:d3:a9:f3:3c:4d:43:12:d3:9d:42:64:ae:d3: 25:8d:0e:18:84:52:f5:62:24:08:df:d0:a1:4c:2f:7f:09:66: 97:ee:3a:1c:e8:30:65:08:0c:50:28:65:07:2c:bf:22:02:e8: 99:2f:b2:20:bc:47:ca:2a:1a:41:98:2d:b4:cd:e0:f1:ca:a2: 68:dd:44:86:9f:1e:e4:64:74:bb:4a:93:f1:b6:0f:f2:36:bb: 08:de:a9:09:cb:9b:78:51:17:a2:43:e4:cb:60:52:09:c6:02: e8:56:f5:be:cc:a1:ed:2e:e8:87:73:33:8e:20:2f:33:b2:51: 56:32:9f:08:b1:9a:4e:ac:f4:a7:07:f8:8c:c8:80:fa:ba:34: 1a:eb:fb:81:8c:64:2c:d4:15:58:9d:fa:b9:7b:0d:8d:61:19: 87:e0:7f:2a:50:00:9e:44:13:94:62:73:fd:b1:d7:f1:ce:82: e1:a5:c0:fd:ac:99:75:f6:f9:18:c3:8d:aa:6a:19:4d:b3:78: 55:8d:87:0f:c6:ea:83:79:eb:52:73:ba:d7:f1:76:5d:71:03: 91:95:3c:ea:25:d5:b7:9a:ab:e8:67:c4:dd:ba:b1:93:2a:cf: 8d:d5:fe:b9:a6:e4:6c:f2:b7:ca:14:fa:56:05:8d:34:f9:f1: ee:3d:b2:b2:74:86:45:85:ef:d0:cf:c1:81:78:96:ce:93:93: e0:e1:b7:62:2c:66:dc:31:62:8a:ac:f8:30:82:29:d6:73:b9: c1:c9:f3:01:e9:2f:26:ff:e6:d7:7d:c9:38:52:48:c8:8d:77: c9:a4:32:eb:d7:a7:f3:78:55:a4:ab:d9:4d:97:4d:cf:c7:14: 11:43:11:bb:91:ef:e1:61:18:69:c6:4e:e0:94:ec:66:28:87: 30:26:87:b5:4b:f4:7f:90:c3:9e:17:2f:6c:b5:86:25:0a:ce: cf:65:ee:82:11:cb:5c:58:dc:c8:79:7f:19:3b:2b:3a:81:fb: 3d:90:35:03:03:b5:88:c7:a1:bd:41:35:cd:f9:72:2b:df:bd: b1:5c:37:48:ff:ab:1e:8c:75:e7:74:5d:9f:8e:d0:e4:96:93: 50:32:66:66:3f:c7:f9:75:c2:63:f7:35:15:8a:39:1f:66:df: f0:75:96:ba:51:1a:99:f1:ea:2f:ae:c6:98:c6:ff:37:16:da: 19:a6:32:f3:c0:8d:6e:a2:78:49:da:44:a4:2f:0a:39:cc:24: 74:a8:1f:8a:aa:c9:f0:9e:c5:8f:07:f1:ca:01:7d:5e:c8:fe: a5:84:be:90:99:84:32:48:54:eb:60:d1:12:11:55:a5:ff:c0: ab:9f:6c:92:30:02:a2:d7
  - deleted 6y ago
    [deleted]
- loeg 6y ago
  00000000 30 82 05 5a 30 82 03 42 a0 03 02 01 02 02 08 52 |0..Z0..B.......R| 00000010 15 63 f9 fd f7 d0 c6 30 0d 06 09 2a 86 48 86 f7 |.c.....0...*.H..| 00000020 0d 01 01 0c 05 00 30 4b 31 27 30 25 06 03 55 04 |......0K1'0%..U.| 00000030 03 0c 1e 41 70 70 6c 65 20 53 65 63 75 72 65 20 |...Apple Secure | 00000040 42 6f 6f 74 20 52 6f 6f 74 20 43 41 20 2d 20 47 |Boot Root CA - G| 00000050 32 31 13 30 11 06 03 55 04 0a 0c 0a 41 70 70 6c |21.0...U....Appl| 00000060 65 20 49 6e 63 2e 31 0b 30 09 06 03 55 04 06 13 |e Inc.1.0...U...| 00000070 02 55 53 30 1e 17 0d 31 34 31 32 31 39 32 30 31 |.US0...141219201| 00000080 33 31 30 5a 17 0d 33 34 31 32 31 34 32 30 31 33 |310Z..3412142013| 00000090 31 30 5a 30 4b 31 27 30 25 06 03 55 04 03 0c 1e |10Z0K1'0%..U....| 000000a0 41 70 70 6c 65 20 53 65 63 75 72 65 20 42 6f 6f |Apple Secure Boo| 000000b0 74 20 52 6f 6f 74 20 43 41 20 |t Root CA | Which matches d431ap/AppleSecureBootRootCA-G2.pem and/or d431ap/AppleSecureBootCA-G2.der from the 7z bundle.
sparkling 6y ago
What are the implications?
- crispyporkbites 6y ago
  Everything will be different now
  - HeyZuess 6y ago
    I think we all have to agree, we couldn't keep doing the same old things, we need to change.
- WhoCaresLies 6y ago
  Microsoft can now reverse engineer Apple's product and attempt a better ARM story now
- tgsovlerkhgsel 6y ago
  If it were real: Secure boot is broken, attackers or homebrewers can boot arbitrary software that isn't signed by Apple, while still appearing to be running genuine Apple software. As is: Nothing, since no key was leaked.
trelliscoded 6y ago
I downloaded the package and there's no private keys in here. I have no idea why they're posting the public key as "proof" because private keys in PEM format start with -----BEGIN PRIVATE KEY-----, not -----BEGIN CERTIFICATE-----. The rest of it is firmware dumps for Mac SMC, the SSD controller, and various copies of iBoot.
- geoah 6y ago
  Yap. To be fair, the original person who posted this didn't mention anything about private keys, someone else just didn't know what they were seeing and jumped the gun.
- DyslexicAtheist 6y ago
  yapp i also jumped the gun. thought that the PEM file might contain the whole shebang but nada
sys_64738 6y ago
I'd expect that there will be multiple private keys and that a future FW update will revoke the corresponding public key of the leaked private key from being usable.
SuperCuber 6y ago
The download is a .7z file, with one of the files called AppleSecureBootRootCA-G2.pem containing the following: -----BEGIN CERTIFICATE----- MIIFWjCCA0KgAwIBAgIIUhVj+f330MYwDQYJKoZIhvcNAQEMBQAwSzEnMCUGA1UE AwweQXBwbGUgU2VjdXJlIEJvb3QgUm9vdCBDQSAtIEcyMRMwEQYDVQQKDApBcHBs ZSBJbmMuMQswCQYDVQQGEwJVUzAeFw0xNDEyMTkyMDEzMTBaFw0zNDEyMTQyMDEz MTBaMEsxJzAlBgNVBAMMHkFwcGxlIFNlY3VyZSBCb290IFJvb3QgQ0EgLSBHMjET MBEGA1UECgwKQXBwbGUgSW5jLjELMAkGA1UEBhMCVVMwggIiMA0GCSqGSIb3DQEB AQUAA4ICDwAwggIKAoICAQDTux7C9K3xbe6PEuTiT84VWqcLfBIhCU4NMmrHyV3q 9tGAlH+lNxMaxzn0sw+X3HsGUsMl7pZKFLcLuj+cMGP6Tjj2AVvsC53iRKXFSS1p eF8ntKikOo2pfePNo+zK1faCdn11viejG/OiX2xgLnFfwbTdYYurE6lkeeScPKU8 AAJI1FMQihZmW7CpZ/+o4+q5s47p19/3OmEMUhGWcY6JiZt7jyYUOYFC6Z5LXkKi apt44yypue085ndbXEocNnstAiM4q9LMPLhfqfseXZRJrHsc6kYDhq7924yk4aOa xPTTOQ5KS9uzaBSb2E+j/dG6z3SIxRKzHCJGmwqwqmI6bhd2EDg0irLbI4RdmMDp zNgS2pL9QC6Da7wr79IvXPmJP+euWvdkboKDYhfktPvpFQFCVz1CqPC5f4jtDm56 zPs3LVfZ19WjZBY1ahZoZefwd0W7u+bUeYcjXZVA2ga+0t63nzmwFIM7VSydcBSw 58ruNS8Yx3ATcCukEb4dupRlpounr8llXHk0rhOaLwrjWRb4dZ/VUfSSrxh8eiWW gT4krhn5911237dBDSkYAc/vR2dIlnz5L7cthrEiyW2sulzD+R/LMsFCmzQgA8kR zA5HDWo6nND5NdD62N1QiY2pjfGBptX7wthSEPkrP1Zogclmzt+zjLS34dGbloUx jwIDAQABo0IwQDAdBgNVHQ4EFgQUaOlZUEXxXQf5P8Qm/BwnYn2eE5QwDwYDVR0T AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQEMBQADggIBAIZ+ tR4606nzPE1DEtOdQmSu0yWNDhiEUvViJAjf0KFML38JZpfuOhzoMGUIDFAoZQcs vyIC6JkvsiC8R8oqGkGYLbTN4PHKomjdRIafHuRkdLtKk/G2D/I2uwjeqQnLm3hR F6JD5MtgUgnGAuhW9b7Moe0u6IdzM44gLzOyUVYynwixmk6s9KcH+IzIgPq6NBrr +4GMZCzUFVid+rl7DY1hGYfgfypQAJ5EE5Ric/2x1/HOguGlwP2smXX2+RjDjapq GU2zeFWNhw/G6oN561Jzutfxdl1xA5GVPOol1beaq+hnxN26sZMqz43V/rmm5Gzy t8oU+lYFjTT58e49srJ0hkWF79DPwYF4ls6Tk+Dht2IsZtwxYoqs+DCCKdZzucHJ 8wHpLyb/5td9yThSSMiNd8mkMuvXp/N4VaSr2U2XTc/HFBFDEbuR7+FhGGnGTuCU 7GYohzAmh7VL9H+Qw54XL2y1hiUKzs9l7oIRy1xY3Mh5fxk7KzqB+z2QNQMDtYjH ob1BNc35civfvbFcN0j/qx6Mded0XZ+O0OSWk1AyZmY/x/l1wmP3NRWKOR9m3/B1 lrpRGpnx6i+uxpjG/zcW2hmmMvPAjW6ieEnaRKQvCjnMJHSoH4qqyfCexY8H8coB fV7I/qWEvpCZhDJIVOtg0RIRVaX/wKufbJIwAqLX -----END CERTIFICATE----- I don't know enough about certificates to do anything with it...
- tmzt 6y ago
  openssl x509 -noout -text < cert.pem
- LaSombra 6y ago
  $ keytool -printcert -file AppleSecureBootCA-G2.der Owner: C=US, O=Apple Inc., CN=Apple Secure Boot Root CA - G2 Issuer: C=US, O=Apple Inc., CN=Apple Secure Boot Root CA - G2 Serial number: 521563f9fdf7d0c6 Valid from: Fri Dec 19 20:13:10 GMT 2014 until: Thu Dec 14 20:13:10 GMT 2034 Certificate fingerprints: MD5: 8D:C7:F2:A5:BF:FF:FE:19:EE:FA:49:02:91:1C:34:DE SHA1: 02:60:CA:4D:08:6E:7C:CB:C2:7B:32:24:6B:22:21:6B:55:B3:D4:C2 SHA256: 64:28:66:5D:0B:97:C1:EC:B8:76:D2:D5:A9:32:57:D4:67:FF:C1:88:DF:66:30:5D:FD:21:F4:88:E7:9C:94:EC Signature algorithm name: SHA384withRSA Subject Public Key Algorithm: 4096-bit RSA key Version: 3 Extensions: #1: ObjectId: 2.5.29.19 Criticality=true BasicConstraints:[ CA:true PathLen:2147483647 ] #2: ObjectId: 2.5.29.15 Criticality=true KeyUsage [ Key_CertSign Crl_Sign ] #3: ObjectId: 2.5.29.14 Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: 68 E9 59 50 45 F1 5D 07 F9 3F C4 26 FC 1C 27 62 h.YPE.]..?.&..'b 0010: 7D 9E 13 94 .... ] ]
anfilt 6y ago
The pem does not have -----BEGIN PRIVATE KEY-----.
underseacables 6y ago
Looks too good to be true.

What does this mean?

M4v3R 6y ago
Apparently not much and the title seems to be wrong (unless there’s more the I didn’t see). According to people in that Twitter thread it’s the public part that’s just extracted from iBoot which ships on every iOS device [1]. It doesn’t let you sign your own boot loaders. [0] https://twitter.com/aydenpanhuyzen/status/1332084351039889412?s=21 https://twitter.com/aydenpanhuyzen/status/133208435103988941... [1] https://twitter.com/matteyeux/status/1332083960172703750?s=21 https://twitter.com/matteyeux/status/1332083960172703750?s=2...

viraptor 6y ago
So the tweet contents are the beginning of a public part of the certificate. Maybe there are private keys in the link down the thread, but that's a multi-megabyte package, while the key would be just ~1kB normally. If this is real, it's a really weird way to share it.
- DyslexicAtheist 6y ago
  the link to the full key is in one of the replies (on mega) d4x ├── d431ap │ ├── AppleSecureBootCA-G2.der │ ├── AppleSecureBootRootCA-G2.pem │ ├── AppleSMCFirmware-2317.60.63.0.1.d43_avus.REL.dump │ ├── AppleSMCFirmware-2317.60.63.0.1.d43_whitney.REL.dump │ ├── AppleStorageProcessorANS2-1161.60.1.122.1~1.dump │ ├── iBoot-6723.60.60.0.2-iOS-14.3b2 │ ├── _iBoot-6723.60.60.0.2-iOS-14.3b2-0.extracted.zip │ ├── _iBoot-6723.60.60.0.2-iOS-14.3b2-1.extracted.zip │ ├── _iBoot-6723.60.60.0.2-iOS-14.3b2.extracted 2.zip │ ├── _iBoot-6723.60.60.0.2-iOS-14.3b2.extracted.zip │ └── LLB.i64 └── __MACOSX └── d431ap 3 directories, 11 files
  - gretchmaar 6y ago
    Anyone loaded the pem to test if it matches?
    - DyslexicAtheist 6y ago
      yes, it is just the certificate. no private key. (i fired to quick with this post - too good to be true lol) Certificate: Data: Version: 3 (0x2) Serial Number: 5914743610979897542 (0x521563f9fdf7d0c6) Signature Algorithm: sha384WithRSAEncryption Issuer: CN = Apple Secure Boot Root CA - G2, O = Apple Inc., C = US Validity Not Before: Dec 19 20:13:10 2014 GMT Not After : Dec 14 20:13:10 2034 GMT Subject: CN = Apple Secure Boot Root CA - G2, O = Apple Inc., C = US Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (4096 bit) Modulus: 00:d3:bb:1e:c2:f4:ad:f1:6d:ee:8f:12:e4:e2:4f: ce:15:5a:a7:0b:7c:12:21:09:4e:0d:32:6a:c7:c9: 5d:ea:f6:d1:80:94:7f:a5:37:13:1a:c7:39:f4:b3: 0f:97:dc:7b:06:52:c3:25:ee:96:4a:14:b7:0b:ba: 3f:9c:30:63:fa:4e:38:f6:01:5b:ec:0b:9d:e2:44: a5:c5:49:2d:69:78:5f:27:b4:a8:a4:3a:8d:a9:7d: e3:cd:a3:ec:ca:d5:f6:82:76:7d:75:be:27:a3:1b: f3:a2:5f:6c:60:2e:71:5f:c1:b4:dd:61:8b:ab:13: a9:64:79:e4:9c:3c:a5:3c:00:02:48:d4:53:10:8a: 16:66:5b:b0:a9:67:ff:a8:e3:ea:b9:b3:8e:e9:d7: df:f7:3a:61:0c:52:11:96:71:8e:89:89:9b:7b:8f: 26:14:39:81:42:e9:9e:4b:5e:42:a2:6a:9b:78:e3: 2c:a9:b9:ed:3c:e6:77:5b:5c:4a:1c:36:7b:2d:02: 23:38:ab:d2:cc:3c:b8:5f:a9:fb:1e:5d:94:49:ac: 7b:1c:ea:46:03:86:ae:fd:db:8c:a4:e1:a3:9a:c4: f4:d3:39:0e:4a:4b:db:b3:68:14:9b:d8:4f:a3:fd: d1:ba:cf:74:88:c5:12:b3:1c:22:46:9b:0a:b0:aa: 62:3a:6e:17:76:10:38:34:8a:b2:db:23:84:5d:98: c0:e9:cc:d8:12:da:92:fd:40:2e:83:6b:bc:2b:ef: d2:2f:5c:f9:89:3f:e7:ae:5a:f7:64:6e:82:83:62: 17:e4:b4:fb:e9:15:01:42:57:3d:42:a8:f0:b9:7f: 88:ed:0e:6e:7a:cc:fb:37:2d:57:d9:d7:d5:a3:64: 16:35:6a:16:68:65:e7:f0:77:45:bb:bb:e6:d4:79: 87:23:5d:95:40:da:06:be:d2:de:b7:9f:39:b0:14: 83:3b:55:2c:9d:70:14:b0:e7:ca:ee:35:2f:18:c7: 70:13:70:2b:a4:11:be:1d:ba:94:65:a6:8b:a7:af: c9:65:5c:79:34:ae:13:9a:2f:0a:e3:59:16:f8:75: 9f:d5:51:f4:92:af:18:7c:7a:25:96:81:3e:24:ae: 19:f9:f7:5d:76:df:b7:41:0d:29:18:01:cf:ef:47: 67:48:96:7c:f9:2f:b7:2d:86:b1:22:c9:6d:ac:ba: 5c:c3:f9:1f:cb:32:c1:42:9b:34:20:03:c9:11:cc: 0e:47:0d:6a:3a:9c:d0:f9:35:d0:fa:d8:dd:50:89: 8d:a9:8d:f1:81:a6:d5:fb:c2:d8:52:10:f9:2b:3f: 56:68:81:c9:66:ce:df:b3:8c:b4:b7:e1:d1:9b:96: 85:31:8f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 68:E9:59:50:45:F1:5D:07:F9:3F:C4:26:FC:1C:27:62:7D:9E:13:94 X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Certificate Sign, CRL Sign Signature Algorithm: sha384WithRSAEncryption 86:7e:b5:1e:3a:d3:a9:f3:3c:4d:43:12:d3:9d:42:64:ae:d3: 25:8d:0e:18:84:52:f5:62:24:08:df:d0:a1:4c:2f:7f:09:66: 97:ee:3a:1c:e8:30:65:08:0c:50:28:65:07:2c:bf:22:02:e8: 99:2f:b2:20:bc:47:ca:2a:1a:41:98:2d:b4:cd:e0:f1:ca:a2: 68:dd:44:86:9f:1e:e4:64:74:bb:4a:93:f1:b6:0f:f2:36:bb: 08:de:a9:09:cb:9b:78:51:17:a2:43:e4:cb:60:52:09:c6:02: e8:56:f5:be:cc:a1:ed:2e:e8:87:73:33:8e:20:2f:33:b2:51: 56:32:9f:08:b1:9a:4e:ac:f4:a7:07:f8:8c:c8:80:fa:ba:34: 1a:eb:fb:81:8c:64:2c:d4:15:58:9d:fa:b9:7b:0d:8d:61:19: 87:e0:7f:2a:50:00:9e:44:13:94:62:73:fd:b1:d7:f1:ce:82: e1:a5:c0:fd:ac:99:75:f6:f9:18:c3:8d:aa:6a:19:4d:b3:78: 55:8d:87:0f:c6:ea:83:79:eb:52:73:ba:d7:f1:76:5d:71:03: 91:95:3c:ea:25:d5:b7:9a:ab:e8:67:c4:dd:ba:b1:93:2a:cf: 8d:d5:fe:b9:a6:e4:6c:f2:b7:ca:14:fa:56:05:8d:34:f9:f1: ee:3d:b2:b2:74:86:45:85:ef:d0:cf:c1:81:78:96:ce:93:93: e0:e1:b7:62:2c:66:dc:31:62:8a:ac:f8:30:82:29:d6:73:b9: c1:c9:f3:01:e9:2f:26:ff:e6:d7:7d:c9:38:52:48:c8:8d:77: c9:a4:32:eb:d7:a7:f3:78:55:a4:ab:d9:4d:97:4d:cf:c7:14: 11:43:11:bb:91:ef:e1:61:18:69:c6:4e:e0:94:ec:66:28:87: 30:26:87:b5:4b:f4:7f:90:c3:9e:17:2f:6c:b5:86:25:0a:ce: cf:65:ee:82:11:cb:5c:58:dc:c8:79:7f:19:3b:2b:3a:81:fb: 3d:90:35:03:03:b5:88:c7:a1:bd:41:35:cd:f9:72:2b:df:bd: b1:5c:37:48:ff:ab:1e:8c:75:e7:74:5d:9f:8e:d0:e4:96:93: 50:32:66:66:3f:c7:f9:75:c2:63:f7:35:15:8a:39:1f:66:df: f0:75:96:ba:51:1a:99:f1:ea:2f:ae:c6:98:c6:ff:37:16:da: 19:a6:32:f3:c0:8d:6e:a2:78:49:da:44:a4:2f:0a:39:cc:24: 74:a8:1f:8a:aa:c9:f0:9e:c5:8f:07:f1:ca:01:7d:5e:c8:fe: a5:84:be:90:99:84:32:48:54:eb:60:d1:12:11:55:a5:ff:c0: ab:9f:6c:92:30:02:a2:d7
- deleted 6y ago
  [deleted]
loeg 6y ago
00000000 30 82 05 5a 30 82 03 42 a0 03 02 01 02 02 08 52 |0..Z0..B.......R| 00000010 15 63 f9 fd f7 d0 c6 30 0d 06 09 2a 86 48 86 f7 |.c.....0...*.H..| 00000020 0d 01 01 0c 05 00 30 4b 31 27 30 25 06 03 55 04 |......0K1'0%..U.| 00000030 03 0c 1e 41 70 70 6c 65 20 53 65 63 75 72 65 20 |...Apple Secure | 00000040 42 6f 6f 74 20 52 6f 6f 74 20 43 41 20 2d 20 47 |Boot Root CA - G| 00000050 32 31 13 30 11 06 03 55 04 0a 0c 0a 41 70 70 6c |21.0...U....Appl| 00000060 65 20 49 6e 63 2e 31 0b 30 09 06 03 55 04 06 13 |e Inc.1.0...U...| 00000070 02 55 53 30 1e 17 0d 31 34 31 32 31 39 32 30 31 |.US0...141219201| 00000080 33 31 30 5a 17 0d 33 34 31 32 31 34 32 30 31 33 |310Z..3412142013| 00000090 31 30 5a 30 4b 31 27 30 25 06 03 55 04 03 0c 1e |10Z0K1'0%..U....| 000000a0 41 70 70 6c 65 20 53 65 63 75 72 65 20 42 6f 6f |Apple Secure Boo| 000000b0 74 20 52 6f 6f 74 20 43 41 20 |t Root CA | Which matches d431ap/AppleSecureBootRootCA-G2.pem and/or d431ap/AppleSecureBootCA-G2.der from the 7z bundle.

sparkling 6y ago

What are the implications?

crispyporkbites 6y ago
Everything will be different now
- HeyZuess 6y ago
  I think we all have to agree, we couldn't keep doing the same old things, we need to change.
WhoCaresLies 6y ago
Microsoft can now reverse engineer Apple's product and attempt a better ARM story now
tgsovlerkhgsel 6y ago
If it were real: Secure boot is broken, attackers or homebrewers can boot arbitrary software that isn't signed by Apple, while still appearing to be running genuine Apple software. As is: Nothing, since no key was leaked.

trelliscoded 6y ago

I downloaded the package and there's no private keys in here. I have no idea why they're posting the public key as "proof" because private keys in PEM format start with -----BEGIN PRIVATE KEY-----, not -----BEGIN CERTIFICATE-----. The rest of it is firmware dumps for Mac SMC, the SSD controller, and various copies of iBoot.

geoah 6y ago
Yap. To be fair, the original person who posted this didn't mention anything about private keys, someone else just didn't know what they were seeing and jumped the gun.
DyslexicAtheist 6y ago
yapp i also jumped the gun. thought that the PEM file might contain the whole shebang but nada

sys_64738 6y ago

I'd expect that there will be multiple private keys and that a future FW update will revoke the corresponding public key of the leaked private key from being usable.

SuperCuber 6y ago

The download is a .7z file, with one of the files called AppleSecureBootRootCA-G2.pem containing the following: -----BEGIN CERTIFICATE----- MIIFWjCCA0KgAwIBAgIIUhVj+f330MYwDQYJKoZIhvcNAQEMBQAwSzEnMCUGA1UE AwweQXBwbGUgU2VjdXJlIEJvb3QgUm9vdCBDQSAtIEcyMRMwEQYDVQQKDApBcHBs ZSBJbmMuMQswCQYDVQQGEwJVUzAeFw0xNDEyMTkyMDEzMTBaFw0zNDEyMTQyMDEz MTBaMEsxJzAlBgNVBAMMHkFwcGxlIFNlY3VyZSBCb290IFJvb3QgQ0EgLSBHMjET MBEGA1UECgwKQXBwbGUgSW5jLjELMAkGA1UEBhMCVVMwggIiMA0GCSqGSIb3DQEB AQUAA4ICDwAwggIKAoICAQDTux7C9K3xbe6PEuTiT84VWqcLfBIhCU4NMmrHyV3q 9tGAlH+lNxMaxzn0sw+X3HsGUsMl7pZKFLcLuj+cMGP6Tjj2AVvsC53iRKXFSS1p eF8ntKikOo2pfePNo+zK1faCdn11viejG/OiX2xgLnFfwbTdYYurE6lkeeScPKU8 AAJI1FMQihZmW7CpZ/+o4+q5s47p19/3OmEMUhGWcY6JiZt7jyYUOYFC6Z5LXkKi apt44yypue085ndbXEocNnstAiM4q9LMPLhfqfseXZRJrHsc6kYDhq7924yk4aOa xPTTOQ5KS9uzaBSb2E+j/dG6z3SIxRKzHCJGmwqwqmI6bhd2EDg0irLbI4RdmMDp zNgS2pL9QC6Da7wr79IvXPmJP+euWvdkboKDYhfktPvpFQFCVz1CqPC5f4jtDm56 zPs3LVfZ19WjZBY1ahZoZefwd0W7u+bUeYcjXZVA2ga+0t63nzmwFIM7VSydcBSw 58ruNS8Yx3ATcCukEb4dupRlpounr8llXHk0rhOaLwrjWRb4dZ/VUfSSrxh8eiWW gT4krhn5911237dBDSkYAc/vR2dIlnz5L7cthrEiyW2sulzD+R/LMsFCmzQgA8kR zA5HDWo6nND5NdD62N1QiY2pjfGBptX7wthSEPkrP1Zogclmzt+zjLS34dGbloUx jwIDAQABo0IwQDAdBgNVHQ4EFgQUaOlZUEXxXQf5P8Qm/BwnYn2eE5QwDwYDVR0T AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQEMBQADggIBAIZ+ tR4606nzPE1DEtOdQmSu0yWNDhiEUvViJAjf0KFML38JZpfuOhzoMGUIDFAoZQcs vyIC6JkvsiC8R8oqGkGYLbTN4PHKomjdRIafHuRkdLtKk/G2D/I2uwjeqQnLm3hR F6JD5MtgUgnGAuhW9b7Moe0u6IdzM44gLzOyUVYynwixmk6s9KcH+IzIgPq6NBrr +4GMZCzUFVid+rl7DY1hGYfgfypQAJ5EE5Ric/2x1/HOguGlwP2smXX2+RjDjapq GU2zeFWNhw/G6oN561Jzutfxdl1xA5GVPOol1beaq+hnxN26sZMqz43V/rmm5Gzy t8oU+lYFjTT58e49srJ0hkWF79DPwYF4ls6Tk+Dht2IsZtwxYoqs+DCCKdZzucHJ 8wHpLyb/5td9yThSSMiNd8mkMuvXp/N4VaSr2U2XTc/HFBFDEbuR7+FhGGnGTuCU 7GYohzAmh7VL9H+Qw54XL2y1hiUKzs9l7oIRy1xY3Mh5fxk7KzqB+z2QNQMDtYjH ob1BNc35civfvbFcN0j/qx6Mded0XZ+O0OSWk1AyZmY/x/l1wmP3NRWKOR9m3/B1 lrpRGpnx6i+uxpjG/zcW2hmmMvPAjW6ieEnaRKQvCjnMJHSoH4qqyfCexY8H8coB fV7I/qWEvpCZhDJIVOtg0RIRVaX/wKufbJIwAqLX -----END CERTIFICATE----- I don't know enough about certificates to do anything with it...

tmzt 6y ago
openssl x509 -noout -text < cert.pem
LaSombra 6y ago
$ keytool -printcert -file AppleSecureBootCA-G2.der Owner: C=US, O=Apple Inc., CN=Apple Secure Boot Root CA - G2 Issuer: C=US, O=Apple Inc., CN=Apple Secure Boot Root CA - G2 Serial number: 521563f9fdf7d0c6 Valid from: Fri Dec 19 20:13:10 GMT 2014 until: Thu Dec 14 20:13:10 GMT 2034 Certificate fingerprints: MD5: 8D:C7:F2:A5:BF:FF:FE:19:EE:FA:49:02:91:1C:34:DE SHA1: 02:60:CA:4D:08:6E:7C:CB:C2:7B:32:24:6B:22:21:6B:55:B3:D4:C2 SHA256: 64:28:66:5D:0B:97:C1:EC:B8:76:D2:D5:A9:32:57:D4:67:FF:C1:88:DF:66:30:5D:FD:21:F4:88:E7:9C:94:EC Signature algorithm name: SHA384withRSA Subject Public Key Algorithm: 4096-bit RSA key Version: 3 Extensions: #1: ObjectId: 2.5.29.19 Criticality=true BasicConstraints:[ CA:true PathLen:2147483647 ] #2: ObjectId: 2.5.29.15 Criticality=true KeyUsage [ Key_CertSign Crl_Sign ] #3: ObjectId: 2.5.29.14 Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: 68 E9 59 50 45 F1 5D 07 F9 3F C4 26 FC 1C 27 62 h.YPE.]..?.&..'b 0010: 7D 9E 13 94 .... ] ]

anfilt 6y ago

The pem does not have -----BEGIN PRIVATE KEY-----.

underseacables 6y ago

Looks too good to be true.