4 ms·

If private keys were stolen couldn't they be used to sign malicious official downloads?

by joemazerino 4y ago

m348e912 4y ago
Yes, but as other commenters have mentioned, it's unclear if MSI's firmware was signed in the first place.
- flangola7 4y ago
  Why wouldn't it be signed? This isn't 1998 any more.
  - dawidpotocki 4y ago
    Because motherboard vendors really don't care about security[1]. In case you forgot/not heard, MSI also broke Secure Boot on purpose and didn't mention it anywhere[2]. And let me pull up another quote from MSI: > We've started to lock ME FW on our MBs since Intel 700 series. Yup, Intel ME was in manufacturing mode until new boards released in Q4 of 2022 on MSI boards. Why? Got no answer from them, unsurprisingly. 1: https://twitter.com/pinkflawd/status/890334031593721856 https://twitter.com/pinkflawd/status/890334031593721856 2: https://news.ycombinator.com/item?id=34388533 https://news.ycombinator.com/item?id=34388533
henriquez 4y ago
Yeah they could, the article mentions this. The article fails to mention that one of the major motherboard manufacturers recently had their “auto update” software compromised and it was pushing malicious updates over the air. I forgot if that was also MSI or some other company. All of the manufacturers seem to use godawful driver software and it feels safer just leaving them uninstalled and adjusting settings in the BIOS, if needed.
dawidpotocki 4y ago
Yes, but most of their boards don't have the most basic protections (like all of the DIY mobo industry), because their customers don't care at all. For example, on MSI PRO Z690-A, you are able to install coreboot to replace the official proprietary firmware from the OS, because the firmware regions are left writable. They have some signing in 700-series Intel boards like I have mentioned in another comment, but I can't tell how it actually works.

4 ms·

If private keys were stolen couldn't they be used to sign malicious official downloads?

by joemazerino 4y ago

If private keys were stolen couldn't they be used to sign malicious official downloads?

m348e912 4y ago
Yes, but as other commenters have mentioned, it's unclear if MSI's firmware was signed in the first place.
- flangola7 4y ago
  Why wouldn't it be signed? This isn't 1998 any more.
  - dawidpotocki 4y ago
    Because motherboard vendors really don't care about security[1]. In case you forgot/not heard, MSI also broke Secure Boot on purpose and didn't mention it anywhere[2]. And let me pull up another quote from MSI: > We've started to lock ME FW on our MBs since Intel 700 series. Yup, Intel ME was in manufacturing mode until new boards released in Q4 of 2022 on MSI boards. Why? Got no answer from them, unsurprisingly. 1: https://twitter.com/pinkflawd/status/890334031593721856 https://twitter.com/pinkflawd/status/890334031593721856 2: https://news.ycombinator.com/item?id=34388533 https://news.ycombinator.com/item?id=34388533
henriquez 4y ago
Yeah they could, the article mentions this. The article fails to mention that one of the major motherboard manufacturers recently had their “auto update” software compromised and it was pushing malicious updates over the air. I forgot if that was also MSI or some other company. All of the manufacturers seem to use godawful driver software and it feels safer just leaving them uninstalled and adjusting settings in the BIOS, if needed.
dawidpotocki 4y ago
Yes, but most of their boards don't have the most basic protections (like all of the DIY mobo industry), because their customers don't care at all. For example, on MSI PRO Z690-A, you are able to install coreboot to replace the official proprietary firmware from the OS, because the firmware regions are left writable. They have some signing in 700-series Intel boards like I have mentioned in another comment, but I can't tell how it actually works.