MSI Data Breach: Private Code Signing Keys Leaked on the Dark Web

May 08, 2023Ravie LakshmananData Breach / Software Security

The threat actors behind the ransomware attack on Taiwanese PC maker MSI last month have leaked the company's private code signing keys on their dark website.

"Confirmed, Intel OEM private key leaked, causing an impact on the entire ecosystem," Alex Matrosov, founder and CEO of firmware security firm Binarly, said in a tweet over the weekend.

"It appears that Intel Boot Guard may not be effective on certain devices based on the 11th Tiger Lake, 12th Adler Lake, and 13th Raptor Lake."

Present in the leaked data are firmware image signing keys associated with 57 PCs and private signing keys for Intel Boot Guard used on 116 MSI products. The Boot Guard keys from MSI are believed to impact several device vendors, including Intel, Lenovo and Supermicro.

Intel Boot Guard is a hardware-based security technology that's designed to protect computers against executing tampered UEFI firmware.

The development comes a month after MSI fell victim to a double extortion ransomware attack perpetrated by a new ransomware gang known as Money Message.

MSI, in a regulatory filing at the time, said, "the affected systems have gradually resumed normal operations, with no significant impact on financial business." It, however, urged users to obtain firmware/BIOS updates only from its official website and refrain from downloading files from other sources.

The leak of the keys poses significant risks as threat actors could use them to sign malicious updates and other payloads and deploy them on targeted systems without raising any red flags.

It also follows another advisory from MSI recommending users to be on the lookout for fraudulent emails targeting the online gaming community that claims to be from the company under the pretext of a potential collaboration.

This is not the first time UEFI firmware code has entered the public domain. In October 2022, Intel acknowledged the leak of Alder Lake BIOS source code by a third party, which also included the private signing key used for Boot Guard.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.