![](/style/images/good.png)
![](/style/images/bad.png)
Hackers publish MSI private keys, enabling signed malware | TechSpot
source link: https://www.techspot.com/news/98612-hackers-publish-msi-private-keys-enabling-signed-malware.html
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Hackers publish MSI private keys, enabling signed malware
Be extra careful when downloading MSI firmware updates and other software
By Daniel Sims May 8, 2023, 4:44 PM![Hackers publish MSI private keys, enabling signed malware](https://www.techspot.com/images2/news/bigimage/2023/01/2023-01-02-image-7.jpg)
Alert: Owners of MSI motherboards, laptops, and other devices should take extra caution when downloading firmware updates and other software from the company, as it could be disguised malware. Hackers recently published the company's private keys, which could let malicious actors sign their code as if it came from MSI.
Security researchers have confirmed that private keys for MSI products and Intel Boot Guard are loose in the wild. Hackers could use the keys to sign malware under the guise of official MSI firmware. Intel Boot Guard is a critical security check for when computers first start up, and the leak could let bad actors bypass it.
Researchers at Binarly said the leaked keys affect dozens of products from several companies, including Intel, Lenovo, Supermicro, and others. See the group's GitHub page for a complete list. Binarly tweeted that it will hunt for specific examples of infected firmware to let users know what to avoid.
When updating any affected devices, downloading directly from MSI's website is the safest option. Users should be suspicious of emails and other messages purportedly coming from MSI.
�"ï¸ÂDigging deeper into the aftermath of the @msiUSA data breach and its impact on the industry.
– BINARLY�"� (@binarly_io) May 5, 2023
�"�Leaked Intel BootGuard keys from MSI are affecting many different device vendors, including @Intel , @Lenovo, @Supermicro_SMCI, and many others industry-wide.
�"�#FwHunt is on! https://t.co/NuPIUJQUgr pic.twitter.com/ZB8XKj33Hv
Be careful when searching for MSI, as hackers could game Google's search rankings to distribute fraudulent firmware through fake websites. Checking URLs for oddities is always a good practice. A company's Twitter account or Wikipedia page is usually a more reliable source for trustworthy website links. Attacks delivered through other vectors could also be more dangerous than usual because malware masquerading under MSI keys can easily avoid detection from antivirus and other security systems.
Hackers hit MSI with a significant cyberattack last month. While the company didn't confirm that it was ransomware, the ransomware gang Money Message was likely behind the incident. Money Message claimed it extracted around 1.5 terabytes of data after infiltrating MSI's systems. The materials included signing keys, source code, and private communications. The company decided against paying the group's $4 million ransom, after which it appears to have followed through on its threat to publish the stolen information.
The attack on MSI is just another in a string of recent cybercrimes. Western Digital vaguely confirmed that hackers leaked some customers' data. A February ransomware attack left the US Marshal's computer systems offline for 10 weeks. Another incident forced Dallas to shut down its IT services, affecting the 911 dispatch system, the county police website, and jury trials.
Recommend
-
43
Officials with the widely used PHP Extension and Application Repository have temporarily shut down most of their website and are urging users to inspect their systems after discovering hackers replaced the main package ma...
-
36
The security industry is waking up to the insidious threat posed by software supply chain attack...
-
43
The Pale Moon web browser team announced today that their Windows archive servers were breached and the hackers infected all archived...
-
3
@willvelidaWill VelidaSoftware Engineer and Microsoft Data Platform MVP based in Auckland, New ZealandIntroduction
-
6
Will the law firm be able to convince cybercriminals not to publish the stolen data based on this paper? Following the hack of 4 New Square Chambers, the company won a court order preventing the hac...
-
6
Trojan Source flaw allows hackers to embed malware directly into source code They can also hide invisible vulnerabilities in open source software libraries By...
-
3
http-server with self-signed certs and enabling support in Chrome To test loading a site locally with http-server you need to generate self-signed certs: openssl req -newkey rsa:2048 -new...
-
4
SoftwareHow to Publish Private NPM Packages With Github Package Registryby Samuel Olaegbe9 min read·...
-
4
Overview If you contribute a fix or new feature to CAS you either need to use a snapshot build, wait for an official release or publish your own release to a private repository. In my situation I work somewhere that uses...
-
9
How to Create and Publish Your First Private NPM PackageJuly 9th 2022 new story5
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK