{"id":118325,"date":"2024-07-26T15:43:00","date_gmt":"2024-07-26T13:43:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot"},"modified":"2024-07-26T15:43:00","modified_gmt":"2024-07-26T13:43:00","slug":"v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-806-modelyah-materinskih-plat-vyyavlen-testovyj-klyuch-pozvolyayushhij-obojti-uefi-secure-boot","title":{"rendered":"A test key has been discovered in 806 models of motherboards that allows bypassing UEFI Secure Boot.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Security researchers from Binarly have discovered a bypass for the UEFI Secure Boot verified boot mode in over 800 products released by companies including Acer, Dell, Fujitsu, Gigabyte, HP, Intel, Lenovo, and Supermicro. The issue has been code-named PKfail and is related to the use of an untrustworthy Platform Key (PK), generated by AMI (American Megatrends International) and supplied as a test sample. The oldest firmware using this test key was released in 2012, while the most recent is dated June 2024. According to researchers, more than 10% of all verified firmware are vulnerable to this problem. <\/p>\n
The parameters for the key indicated that it was untrustworthy and should not be shipped in products. It was implied that this test key should be replaced with a proprietary one, but manufacturers overlooked the warning and used a generic shared key provided to all partners and customers of AMI. <\/p>\n
The private part of the AMI test key, necessary for creating digital signatures, was made publicly available after a leak from one of the hardware manufacturers, whose employee accidentally posted code containing this key in a public repository on GitHub. The private key was placed in an encrypted file, which was encrypted with a simple 4-character password that could be easily cracked using a brute force method. <\/p>\n
The platform key is used as the root of trust for signing the databases containing keys for Secure Boot. Obtaining the private part of the platform key compromises the entire chain of trust involved in validating the components of the booting system \u2014 knowing the platform key allows bypassing Secure Boot protection and facilitating the substitution of custom components by manipulating the KEK (Key Exchange Key) and the databases 'db' (Signature Database) and 'dbx' (Forbidden Signature Database). The KEK is responsible for creating the chain of trust between the firmware and the operating system, 'db' contains certificates and signatures for the bootloader and third-party UEFI components, while 'dbx' includes revoked signatures of known malicious components. <\/p>\n
To carry out the attack, it is enough to generate new keys and certificates for KEK and db, after which the publicly available test platform key can be used to load the created KEK certificate into the UEFI firmware. After loading the KEK certificate into the firmware, the associated private key can be used to load a new certificate into the db database. Once the db certificate is loaded, the associated private key may be used to sign the loaded EFI components. openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj '\/CN=BRLY KEK\/' -out KEK.crt openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj '\/CN=BRLY db\/' -out db.crt efi-updatevar -a -c KEK.crt -k PK.key KEK efi-updatevar -a -c db.crt -k KEK.key db sbsign --key db.key --cert db.crt --output rogue.efi.signed rogue.efi <\/p>\n
To verify the validity of the platform key, simply run the utility 'efi-readvar -v PK' from the efitools package and ensure that the platform key is not a test key: efi-readvar -v PK Variable PK, length 862 PK: List 0, type X509 Signature 0, size 834, owner 26dc4851-195f-4ae1-9a19-fbf883bbb35e Subject: CN=DO NOT TRUST \u2014 AMI Test PK Issuer: CN=DO NOT TRUST \u2014 AMI Test PK
![\"Play](\"https:\/\/img.youtube.com\/vi\/CveWt3gFQTE\/hqdefault.jpg\")
\r\n