{"id":765,"date":"2023-05-15T02:18:03","date_gmt":"2023-05-15T07:18:03","guid":{"rendered":"https:\/\/kentprotect.com\/?p=765"},"modified":"2023-05-15T02:39:38","modified_gmt":"2023-05-15T07:39:38","slug":"breach-report-intel-bootguard-msi-private-keys-involved-in-msi-breach","status":"publish","type":"post","link":"https:\/\/kentprotect.com\/index.php\/2023\/05\/15\/breach-report-intel-bootguard-msi-private-keys-involved-in-msi-breach\/","title":{"rendered":"Breach Report: Intel BootGuard private keys involved in MSI breach"},"content":{"rendered":"
<\/div>\n

One-sentence summary: <\/strong><\/p>\n\n\n\n

Intel BootGuard private keys for MSI devices were compromised during the Money Message’s ransomware attack on MSI. <\/p>\n\n\n\n

Who was involved?<\/strong><\/p>\n\n\n\n

Intel (as a vendor), MSI (Micro-Star International Co., Ltd), and the Money Message ransomware gang. <\/p>\n\n\n\n

What was the timeline?<\/strong><\/p>\n\n\n\n

April 5, 2023: Money Message publishes extortion\/ransom countdown timer on its website (Toulas, 2023)<\/p>\n\n\n\n

April 7, 2023: MSI publishes a statement on its website about its cyberattack<\/p>\n\n\n\n

May 1, 2023: Approximately when Money Message began leaking MSI and Intel data<\/p>\n\n\n\n

What occurred?<\/strong><\/p>\n\n\n\n

Intel processors were caught up as a vendor in a data breach that affected MSI by the Money Message ransomware gang in April 2023 (Abrams, 2023; Fisher, 2023). Intel has clarified that the Intel BootGuard OEM keys from MSI are compromised and not Intel’s central signing keys (Abrams, 2023). Thus, the breach impacts MSI devices with Intel processors from generations 11-13 (Abrams, 2023; Montalbano, 2023). Potentially rogue firmware updates could be digitally signed from the compromised keys and be installed on victim machines to maintain indefinite persistence, hence why MSI is advising users to only obtain official firmware updates (Montalbano, 2023; MSI, 2023). <\/p>\n\n\n\n

Estimated costs:<\/strong><\/p>\n\n\n\n

Incident response costs, potential business continuity response to the leaks to preserve BootGuard integrity<\/p>\n\n\n\n

Involved laws: <\/strong><\/p>\n\n\n\n

TBA or N\/A (see disclaimer)<\/p>\n\n\n\n

Root cause: <\/strong><\/p>\n\n\n\n

TBA or N\/A (see disclaimer)<\/p>\n\n\n\n

Lessons learned: <\/strong><\/p>\n\n\n\n

TBA or N\/A (see disclaimer)<\/p>\n\n\n\n

Sources: <\/strong><\/p>\n\n\n\n

Abrams, L. (2023, May 9). Intel investigating leak of Intel Boot Guard private keys after MSI breach. BleepingComputer<\/em>. https:\/\/www.bleepingcomputer.com\/news\/security\/intel-investigating-leak-of-intel-boot-guard-private-keys-after-msi-breach\/<\/p>\n\n\n\n

Fisher, D. (2023, May 9). Intel BootGuard, Firmware Signing Keys Found in MSI Data Leak<\/em>. Decipher. Retrieved May 15, 2023, from https:\/\/duo.com\/decipher\/intel-bootguard-firmware-signing-keys-found-in-msi-data-leak<\/p>\n\n\n\n

Montalbano, E. (2023, May 10). Leak of Intel Boot Guard Keys Could Have Security Repercussions for Years. Dark Reading<\/em>. https:\/\/www.darkreading.com\/attacks-breaches\/leak-of-intel-boot-guard-keys-could-have-security-repercussions-for-years<\/p>\n\n\n\n

MSI. (n.d.). msi-dragon-logo-wallpaper-preview.jpg<\/em>. wallpaperflare.com. https:\/\/www.wallpaperflare.com\/static\/179\/258\/486\/msi-dragon-logo-wallpaper-preview.jpg<\/p>\n\n\n\n

MSI. (2023, April 7). MSI  Global – The Leading Brand in High-end Gaming & Professional Creation<\/em>. MSI Statement. Retrieved May 15, 2023, from https:\/\/www.msi.com\/news\/detail\/MSI-Statement-141688<\/p>\n\n\n\n

Toulas, B. (2023, April 6). Money Message ransomware gang claims MSI breach, demands $4 million. BleepingComputer<\/em>. https:\/\/www.bleepingcomputer.com\/news\/security\/money-message-ransomware-gang-claims-msi-breach-demands-4-million\/<\/p>\n\n\n\n

\n