For those who’re a gamer or an avid squeezer of uncooked computing energy, you’ve in all probability spent hours tweaking your motherboard settings to eke out each final drop of efficiency.
Over time, you may even have tried out varied unofficial firmware bodges and hacks to allow you to change settings that might in any other case be inaccessible, or to decide on configuration combos that aren’t normally allowed.
Simply to be clear: we strongly advise towards putting in unknown, untrusted firmware BLOBs.
(BLOB is a jocular jargon time period for firmware information that’s quick for binary massive object, which means that it’s an all-in-one stew of code, tables of knowledge, embedded information and pictures, and certainly something wanted by the firmware when it begins up.)
Loosely talking, the firmware is a sort of low-level working system in its personal proper that’s answerable for getting your laptop to the purpose at which it might boot into an everyday working system akin to Home windows, or one of many BSDs, or a Linux distro.
Which means booby-trapped firmware code, if you happen to may be tricked into putting in it, could possibly be used to undermine the very safety on which your subsequent working system safety depends.
Rogue firmware might, in concept, be used to spy on virtually the whole lot you do in your laptop, appearing as a super-low-level rootkit, the jargon time period for malware that exists primarily to guard and conceal different malware.
Rootkits usually intention to make higher-level malware troublesome not solely to take away, however even to detect within the first place.
The phrase rootkit comes from the outdated days of Unix hacking, earlier than PCs themselves existed, not to mention PC viruses and different malware. It referred to what was basically a rogueware toolkit {that a} person with unauthorised sysadmin privileges, also called root entry, might set up to evade detection. Rootkit elements may embrace modified ls, ps and rm instruments, for instance (listing information, listing processes and take away information respectively), that intentionally suppressed point out of the intruder’s rogue software program, and refused to delete it even when requested to take action. The title derives from the idea of “a software program equipment to assist hackers and crackers preserve root entry even after they’re being hunted down by the system’s actual sysadmins”.
Digital signatures thought-about useful
As of late, rogue firmware downloads are usually simpler to identify than they had been up to now, on condition that they’re normally digitally signed by the official vendor.
These digital signatures can both be verified by the prevailing firmware to stop rogue updates being put in in any respect (relying in your motherboard and its present configuration), or verified on one other laptop to examine that they’ve the imprimatur of the seller.
Notice that digital signatures provide you with a a lot stronger proof of legitimacy than obtain checksums akin to SHA-256 file hashes which might be revealed on an organization’s obtain website.
A obtain checksum merely confirms that the uncooked content material of the file you downloaded matches the copy on the positioning the place the checksum was saved, thus offering a fast approach of verifying that there have been no community errors in the course of the obtain.
If crooks hack the server to change the file you’re going to obtain, they’ll merely alter its listed checksum on the identical time, and the 2 will match, as a result of there isn’t a cryptographic secret concerned in calculating the checkum from the file.
Digital signatures, nevertheless, are tied to a so-called non-public key that the seller can retailer individually from the web site, and the digital signature is usually calculated and added to the file someplace within the vendor’s personal, supposedly safe, software program construct system.
That approach, the signed file retains its signed digital label wherever it goes.
So, even when crooks handle to create a booby-trapped obtain server with a Trojanised obtain on it, they’ll’t create a digital signature that reliably identifies them as the seller you’d count on to see because the creator and signer of the file.
Until, in fact, the crooks handle to steal the seller’s non-public keys used for creating these digital signatures…
…which is a bit like getting maintain of a medieval monarch’s signet ring, so you may press their official signal into the wax seals on completely fraudulent paperwork.
MSI’s dilemma
Properly, followers of MSI motherboards ought to be doubly cautious of putting in off-market firmware proper now, apparently even when it apparently comes with a legitimate-looking MSI digital “seal of approval”.
The motherboard megacorp issued an official breach notification on the finish of final week, admitting:
MSI not too long ago suffered a cyberattack on a part of its data methods. […] At the moment, the affected methods have step by step resumed regular operations, with no vital affect on monetary enterprise.
Phrase on the road is that MSI was hit by a ransomware gang going by the in-your-face title of Cash Message, who’re apparently making an attempt to blackmail MSI by threatening, amongst different nastinesses, to show stolen knowledge akin to:
MSI supply code together with framework to develop BIOS [sic], additionally we now have non-public keys.
The implication appears to be that the criminals now have the wherewithal to construct a firmware BLOB not solely in the fitting format but in addition with the fitting digital signature embedded in it.
MSI has neither confirmed nor denied what was stolen, however is warning clients “to acquire firmware/BIOS updates solely from [MSI’s] official web site, and to not use information from sources apart from the official web site.”
What to do?
If the criminals are telling the reality, and so they actually do have the non-public keys they should signal firmware BLOBs (MSI definitely has numerous totally different non-public keys for all types of various signing functions, so even when the crooks have some non-public keys they may not have the fitting ones for approving firmware builds)…
…then going off-market is now doubly harmful, as a result of checking the digital signature of the downloaded file is now not sufficient to verify its origin.
Fastidiously sticking to MSI’s official website is safer, as a result of the crooks would want not solely the signing keys for the firmware file, but in addition entry to the official website to switch the real obtain with their booby-trapped pretend.
We’re hoping that MSI is taking additional care over who has entry to its official obtain portal proper now, and watching it extra fastidiously than normal for surprising modifications…
