Anyone seen this shit?
Posted by r0lfi@reddit | sysadmin | View on Reddit | 179 comments
Secure Boot is compromised on 200 models from 5 major manufacturers, affecting numerous devices. This serious security flaw could allow attackers to bypass protections.
ITguydoingITthings@reddit
Saw it earlier and laughed. Too much of the world has bought into the marketing slogans around security, so I appreciate the irony.
Nietechz@reddit
They sell us security products They don't follow their own security ideas.
littlemaybatch@reddit
Any ideas as to what the fix would be?
pdp10@reddit
Freshly built and signed UEFI firmware from the hardware vendor.
Or, just maybe, /r/Coreboot or LinuxBoot.
Nietechz@reddit
At this point be a nerd and install Coreboot/Libreboot is the only way to avoid this shitshow.
littlemaybatch@reddit
Holy shit.. I really didn't want it to be true man.
RatherB_fishing@reddit
lol, was on discord with a buddy who is pretty high up at a very important IT firm in security and he was talking about this last night.
Anonymous1Ninja@reddit
So was I
RatherB_fishing@reddit
Damnit… stalking me on LinkedIn and here too. lol, you never answered to phone this weekend Mr. “I’m making wine”
catwiesel@reddit
oh come on, as if secureboot did anything we really needed.
and this is not new, and its even worse... barely patchable, old systems wont ever see updates, microsoft probably pulling their secureboot keys... oh joy
Wil420b@reddit
AMI (American Megatrends International) the BIOS manufacturer. Released several test BIOS's to OEMs clearly marked "DO NOT TRUST". With pared down encryption. Somehow it made its way into about 500 different motherboards from a range of OEMs from HP to Supermicro.
nohairday@reddit
The word 'somehow' is doing a lot of heavy lifting there.
Who wants to guess a combination of cost cutting and unreasonable product delivery times?
GimmeSomeSugar@reddit
The word 'somehow' has been ruined by being used in 'somehow... Palatine returned'.
Kulandros@reddit
Well, Palatine was a god, so that makes sense.
BeckoningEagle@reddit
And Palpatine was an emperor.
blancpainsimp69@reddit
palpatine was *the senate
nsvxheIeuc3h2uddh3h1@reddit
Yes, but that happened a long, long time ago...
Kulandros@reddit
Glad we're on the same page.
DigitalEskarina@reddit
Palatine is a hill and I think it's still there
sunnyspiders@reddit
Ya Paladope.
NotAMotivRep@reddit
Wanna do some Palablow?
TheButtholeSurferz@reddit
Have I told you the story of Darth Plackius?
GimmeSomeSugar@reddit
Sounds unhealthy.
narcissisadmin@reddit
Palpatine?
GimmeSomeSugar@reddit
Indeed. I done fucked up.
pdp10@reddit
Even our Intel NUCs have firmware fields that ship saying
To Be Filled by O.E.M.. Here's some moredmidecodeoutput from a different system from a niche vendor:420GB@reddit
Is the serial number literally
Default stringor did you redact that?hunterkll@reddit
It is, and it's correct, since you're supposed to use the intel configuration utilities to fill it in yourself before deploying/reselling.
pdp10@reddit
It's literally
Default string.hunterkll@reddit
And... this is correct. You're supposed to fill those in yourself using the intel configuration utilities before reselling and/or deploying the units.
soupcan_@reddit
That's probably because Intel NUCs (the kits, anyways) are intended to be rebranded and sold by other companies, i.e. the System76 Meerkat.
accidental-poet@reddit
Correct. I've been selling NUC's for years and use Intel's tools to populate these fields so the devices show our company name, serial number and model number in our RMM.
cluberti@reddit
It's always my favorite to see retail motherboards also ship with this - I get why (it goes in a system someone else builds), but unless you have access to the keys and are able to put it into whatever passes for "manufacturing mode" on the devices themselves, you aren't able to easily update those anyway. It's just a funny oddity of the (admittedly small) portion of build-your-own-systems out there.
darthgeek@reddit
Meh. At my previous gig, we had a number of servers from Rackable (who ended up buying SGI and keeping the name) that had that in their BIOS. They were fine. It's just a lazy OEM.
nohairday@reddit
Oh yeah. But an OEM not filling in a field is quite a bit more acceptable than actively using something that says "DO NOT USE, YOU ABSOLUTE BELLEND"
(Slight paraphrasing by me)
Greed_Sucks@reddit
I work with ISO procedures. I see this often when a company mixes nonconforming product with conforming product because of bad training or bad procedures. I consider this a quality management issue.
da_chicken@reddit
Also possibly just people that can't read English. DO NOT TRUST and DO NOT USE aren't actually clear in some parts of the world.
nohairday@reddit
Very true.
quiet0n3@reddit
Yeah like they said, somehow.
nohairday@reddit
One thing led to another....
WWGHIAFTC@reddit
yada yada yada...
TheDarthSnarf@reddit
Or a government making sure hats the version that got deployed.
Dry_Condition_231@reddit
Capitalism functioning as intended. Just going to crush the rest of us along the way. So thrilled to be on this ride!\~
nohairday@reddit
Not to worry.
AI will solve all of these problems!
(Obligatory /s just to be perfectly clear)
DRHAX34@reddit
My Lenovo laptop is safe thankfully!
Doso777@reddit
Crowdstrike and now this. I am starting to believe that a lot of people in the industry don't actually test their shit anymore. Just copy/paste stuff and get it working somehow.
Most_Mix_7505@reddit
It’s all been downhill since 2007
axonxorz@reddit
Do you think this is because of some sort of export restrictions? I can't imagine why they'd spend effort on another crypt implementation otherwise.
420GB@reddit
Somehow, test BIOS returned.
drgngd@reddit
That sounds like a cluster fuck.
Fallingdamage@reddit
On windows machines you can survey you fleet with powershell:
anything that returns 'True' is using the test key thats been compromised.
imonlineagainagain@reddit
I am false
r0lfi@reddit (OP)
You can check Linux with this:
#!/bin/bash# Ensure efivar is installedif ! command -v efivar &> /dev/null; thenecho "efivar could not be found. Please install it first."exit 1fi# Find the Platform Key (PK) variablepk_var=$(sudo efivar -l | grep -i PK)if [ -z "$pk_var" ]; thenecho "Platform Key variable not found."exit 1fiecho "Found PK variable: $pk_var"# Read the PK variable, convert to a readable format, and check for the stringsoutput=$(sudo efivar -p -n "$pk_var" | hexdump -C)if echo "$output" | grep -E "DO NOT TRUST|DO NOT SHIP"; thenecho "Match found: DO NOT TRUST or DO NOT SHIP"elseecho "No match found"fiRemember to install: efivar,efibootmgr.
northrupthebandgeek@reddit
If your kernel is new enough to support efivarfs, then the following one-liner should also work:
grep -E "DO NOT TRUST|DO NOT SHIP" /sys/firmware/efi/efivars/PK*Seems my machine ain't affected, so score one for Framework :)
littlemaybatch@reddit
Are you sure this is correctly working? Unless grep is able to search for binary files I don't see this command working.
northrupthebandgeek@reddit
grepis indeed able to search binary files. I tested the above using some of the strings present in my laptop's PK and it matched as expected.littlemaybatch@reddit
Different versions I guess, I had to add
-afor it to read the binary data.pdp10@reddit
This is the check method with the fewest dependencies.
efivarfswas introduced with Linux kernel 3.8. Older kernels should still have the EFI variables in/sys/firmware/efi/efivars.We have affected hardware from niche vendors. However, all of that hardware is running Linux and has Secure Boot toggled off. This will be an exercise in vendor firmware support and UEFI firmware deployment.
pierrick_f@reddit
The article gives
for Windows, and
for Linux.
efi-readvaris part of theefitoolspackage.mr_ballchin@reddit
Thanks for sharing the script! Great one!
Niceuuuuuu@reddit
This is why the comments section is goated. Awesome stuff.
snorkel42@reddit
Not to take anything away from OP, but that command is in the article.
Iggyhopper@reddit
Yeah but I dont have to subject my poor eyes to shitty ads to see it.
12inch3installments@reddit
That assumes people read the article...
firefistus@reddit
Anyone smart enough to turn this into a splunk query?
Certain-Community438@reddit
I'd be surprised if a SIEM solution was grabbing UEFI data from hosts.
You'd need to get the data, then ingest it if you want to use it in Splunk
MarzMan@reddit
https://github.com/binarly-io/SupplyChainAttacks/blob/main/PKfail/ImpactedDevices.md
thortgot@reddit
Not sure you could do it via spelunking. What's your RMM?
thortgot@reddit
Great script. Thanks for sharing.
Fallingdamage@reddit
Wont take credit. It was posted in the article but the code wasnt perfect. I tested/fixed and reposted their suggestion. 👍
techtimee@reddit
Thank you!
Kawasakison@reddit
Thanks!
ah-cho_Cthulhu@reddit
Is this similar to boothole? We been tracking that vuln for some time and it was something that is a pita to resolve.
devloz1996@reddit
One more reason for vendors to replace their PK with Microsoft's. It's not like they sign anything other than Microsoft KEK anyway.
cluberti@reddit
But how would they get their hardware-specific or software-specific drivers to work in manufacturing mode, if they require them? That's not 100% trivial, and if they want to use the UEFI to install software automatically, that also requires their keys. They should be using Microsoft's MU UEFI (and I am a little biased, but still) or just the Microsoft-provided keys, but I can still see reasons why an OEM wants to ship with custom keys if they've got a manufacturing process that requires them, or they want to ship applications in the UEFI that will then get pushed to the Windows install on a device.
devloz1996@reddit
If vendor knows how to manage PK and can pledge to roll it for all their devices, should it be close to expiry, then of course they are free to manage it. My issue is with vendors that can't be bothered, magically lose their PK keys, or say they won't roll it on "unsupported devices", effectively attempting to deploy planned obsolescence.
hunterkll@reddit
PK's don't expire?
devloz1996@reddit
PK expires, but it would only block updating KEK, just like expired KEK would block updating DB, since each must be signed with PK within parent's validity period.
If PK expires, Microsoft won't be able to programmatically replace KEK, even if they get vendor to sign it with their PK. Well, depends on how much they fucked up their implementation anyway.
Either vendor updates firmware, power user enrolls custom keys, or device is soft bricked after KEK can't sign the latest DB.
It is important to note that the potential KEK shit show is between 2035 + \~12 years, unless a vendor did a serious PK gross negligence, so things might actually smooth out on their own.
Antroz22@reddit
What does it mean actually?
Sagail@reddit
It means someone who has already compromised your system can in effect make that persistent unless you wipe and reflash the bios
Sagail@reddit
I mean, you still need administrative rights. Don't get me wrong, it's not great. Frankly, I find secure boot annoying on Linux installs, so I generally turn it off
devopsslave@reddit
LOL
Sorry... marking this so I van do a "deep dive" later.
TragedySeraph@reddit
Quick list of affected systems:
Vendor|Model Acer|c24-1655 Acer|aspire c22-1600 Acer|c24-962 Acer|altos r680 f4 Acer|altos r680s f4 Aopen|iKBLMUx-DER(Volta Charging) Dell|xps-8950-desktop Dell|alienware-aurora-r13-desktop Dell|alienware-x15-r1-laptop Dell|alienware-m17-r3-laptop Dell|alienware-area51m-r2-laptop Dell|alienware-aurora-r15-desktop Dell|alienware-aurora-r16-desktop Dell|xps-8960-desktop Dell|alienware-m17-r4-laptop Dell|alienware-aurora-r11-desktop Dell|alienware-m15-r2-laptop Dell|alienware-15-r4 Formelife|Studio Sys UPD Gigabyte|E162-220 Gigabyte|G262-IR0 Gigabyte|G292-280 Gigabyte|G492-ID0 (rev. 100) Gigabyte|H252-3C0 (rev. 100) Gigabyte|H262-PC0 (rev. 100) Gigabyte|H262-PC1 (rev. 100) Gigabyte|H262-PC2 Gigabyte|MD72-HB0 (rev. 1.x/2.0) Gigabyte|MD72-HB1 (rev. 1.x) Gigabyte|MD72-HB2 (rev. 1.x) Gigabyte|MD72-HB3 (rev. 1.x) Gigabyte|MU72-SU0 (rev. 1.x/2.x) Gigabyte|MU92-TU0 (rev. 1.x) Gigabyte|MU92-TU1 (rev. 1.x/2.x) Gigabyte|R182-34A Gigabyte|R182-NA0 Gigabyte|R182-NC0 Gigabyte|R282-G30 Gigabyte|E152-ZE1 (rev. A00) Gigabyte|G152-Z12 Gigabyte|G242-Z11 Gigabyte|G242-Z12 Gigabyte|G262-ZR0 Gigabyte|G292-Z20 (rev. A00) Gigabyte|G292-Z43 Gigabyte|G292-Z45 Gigabyte|G482-Z50 Gigabyte|G492-Z52 Gigabyte|H252-Z12 (rev. A02) Gigabyte|H262-Z61 Gigabyte|H262-Z6B Gigabyte|H282-ZC0 (rev. A00) Gigabyte|MZ32-AR0 (rev. 3.x) Gigabyte|MZ72-HB0 (rev. 3.x/4.x) Gigabyte|MZ72-HB2 (rev. 3.x) Gigabyte|R162-Z10 Gigabyte|R162-ZA2 Gigabyte|R182-Z90 (rev. A00/B00/AT0) Gigabyte|R262-ZA2 Gigabyte|R282-Z97 (rev. A00) Gigabyte|S252-ZC0 Gigabyte|G191-H44 Gigabyte|G241-G40 (rev. 100) Gigabyte|G291-2G0 (rev. 100) Gigabyte|G591-HS0 Gigabyte|H231-G20 (rev. 100/A00) Gigabyte|H261-H61 (rev. 100) Gigabyte|H261-NO0 Gigabyte|H281-PE0 Gigabyte|MD61-SC2 (rev. 1.x) Gigabyte|MD71-HB0 (rev. 1.x) Gigabyte|MD71-HB1 (rev. 1.x) Gigabyte|MU71-SU0 (rev. 1.x) Gigabyte|R161-340 (rev. 100/200) Gigabyte|R281-3C1 Gigabyte|R281-3C2 Gigabyte|T181-G20 (rev. 1.0) Gigabyte|E251-U70 (rev. 100) Gigabyte|R162-ZA1 Gigabyte|G242-Z10 Gigabyte|MC62-G41 (rev. 1.0) Gigabyte|MX33-BS0 (rev. 1.x) Gigabyte|MD72-HB2 (rev. 1.x/2.x) Gigabyte|G482-Z54 Gigabyte|R271-Z00 (rev. B00) Gigabyte|E152-ZE0 Gigabyte|R282-Z93 (rev. A00) Gigabyte|R162-ZA0 (rev. A00) Gigabyte|G262-ZO0 Gigabyte|H262-Z6A Gigabyte|MZ72-HB0 (rev. 3.0/4.0) Gigabyte|MZ72-HB2 (rev. 3.0) Gigabyte|G152-Z12 (rev. 200) Gigabyte|G292-Z40 Gigabyte|H242-Z10 (rev. A00) Gigabyte|R152-Z30 Gigabyte|G262-IR0 (rev. 100) Gigabyte|G292-280 (rev. 100) Gigabyte|G492-H80 Gigabyte|H262-NO0 Gigabyte|H262-NO1 Gigabyte|R182-340 (rev. 100) Gigabyte|G291-280 Gigabyte|G481-H80 (rev. 100) Gigabyte|H231-H60 (rev. 100/A00) Gigabyte|R181-2A0 (rev. 100) Gigabyte|S251-3O0 (rev. 100) Gigabyte|S451-3R0 Gigabyte|WRX80-SU8-IPMI (rev. 1.0) Gigabyte|R292-4S0 Gigabyte|R161-R12 Gigabyte|TO23-H60 Gigabyte|GB-BRR7-4700 Gigabyte|GB-BRR7-4800 Gigabyte|GB-BRR3-4300 (rev. 1.0) Gigabyte|GB-BRR5-4500 (rev. 1.0) Gigabyte|W771-Z00 (rev. 100) Gigabyte|MB51-PS0 (rev. 1.0) Gigabyte|G492-ZD2 (rev. A00) Gigabyte|MW22-SE0 (rev. 1.0) Gigabyte|MX32-4L0 (rev. 1.0) Gigabyte|MW32-SP0 (rev. 1.0) Gigabyte|MX32-BS0 (rev. 1.0) Gigabyte|GB-BER3-5300 Gigabyte|GB-BER3-5400 Gigabyte|GB-BER5-5500 (rev. 1.0) Gigabyte|GB-BER5-5600 Gigabyte|GB-BER7-5700 Gigabyte|GB-BER7-5800 Gigabyte|GB-BMCE-4500C Gigabyte|GB-BMCE-5105 Gigabyte|GB-BMPD-6005 Gigabyte|GB-BRi3-10110 (rev. 1.0) Gigabyte|GB-BRi7-10510 (rev. 1.0) Gigabyte|MF51-ES1 (rev. 1.0) Gigabyte|MF51-ES0 (rev. 1.0) Gigabyte|MF51-ES2 (rev. 1.0) Gigabyte|G492-Z50 (rev. A00) Gigabyte|GB-BSRE-1505 (rev. 1.0) Gigabyte|GB-BSi3-1115G4 (rev. 1.0) Gigabyte|GB-BSi5-1135G7 Gigabyte|GB-BSi7-1165G7 Gigabyte|G292-Z20 (rev. 100) Gigabyte|H261-Z60 Gigabyte|MZ71-CE0 (rev. 3.x/4.x) Gigabyte|G292-Z40 (rev. 100) Gigabyte|G182-C20 Gigabyte|R162-ZA0 (rev. 100) Gigabyte|MZ72-HB0 (rev. 1.x) Gigabyte|G221-Z30 Gigabyte|G291-Z20 (rev. A00) Gigabyte|MZ71-CE0 (rev. 1.x) Gigabyte|R181-Z90 Gigabyte|R271-Z00 (rev. A00) Gigabyte|T181-Z70 (rev. A00) Gigabyte|GB-BRi7-10710 (rev. 1.0) Gigabyte|GB-BRi5-10210(E) Gigabyte|G492-ZD0 Gigabyte|G292-Z46 Gigabyte|R282-Z90 (rev. A00) Gigabyte|R282-Z96 (rev. 100) Gigabyte|G482-Z50 (rev. 100) Gigabyte|G492-ZD0 (rev. 100) Gigabyte|W281-G40 Gigabyte|MW51-HP0 (rev. 1.x) Gigabyte|G482-Z53 Gigabyte|G482-Z54 (rev. 100) Gigabyte|C621 AORUS XTREME (rev. 1.0) Gigabyte|MJ11-EC0 (rev. 1.2) Gigabyte|G291-Z20 (rev. 100) Gigabyte|H261-Z60 (rev. 100) Gigabyte|R181-Z90 (rev. 100) Gigabyte|H261-T60 (rev. 100) Gigabyte|C621-SD8 Gigabyte|C621-SU8 (rev. 1.0) Gigabyte|GB-BSRE-1605 (rev. 1.0) Gigabyte|C621-WD12-IPMI (rev. 1.0) Gigabyte|C621-WD12 Gigabyte|G292-Z42 (rev. 100) Gigabyte|G482-Z51 (rev. 100) Gigabyte|W42G-P08R Gigabyte|S12-P04R (rev. 1.0) Gigabyte|R272-Z30 (rev. 100) Gigabyte|R181-T90 (rev. 100) Intel|BIOS Update [PNWHL357] Intel|BIOS Update [PNWHL57v] Intel|Intel Server Board M10JNP2SB - Firmware Update Package - EFI BIOS 7220, BMC 8100.01.12 Intel|Intel Server Board M10JNP2SB - Firmware Update Package - EFI BIOS 7219, BMC 8100.01.11 Intel|Intel Server Board M10JNP2SB - Firmware Update Package - EFI BIOS 7218, BMC 8100.01.10 Intel|Intel Server Board M10JNP2SB - Firmware Update Package - EFI BIOS 7217, BMC 8100.01.10 Intel|Intel Server Board M10JNP2SB - Firmware Update Package - EFI BIOS 7216, BMC 8100.01.10 Supermicro|AS -4124GQ-TNMI Supermicro|MBD-H12DSG-Q-CPU6 Supermicro|MBD-H12DGO-6 Supermicro|MBD-H12SSW-AN6 Supermicro|MBD-H12DSU-iN Supermicro|MBD-H12DSi-N6 Supermicro|MBD-H12DGQ-NT6 Supermicro|MBD-X11QPL Supermicro|B11DPT Supermicro|X11QPH+ Supermicro|X11DPS-RE Supermicro|B11QPI Supermicro|B11DPE Supermicro|X11SCH-F/LN4F Supermicro|AOM-X11OPI-LBG-P/MBD-X11OPI-CPU-P Supermicro|X11DPG-SN Supermicro|X11DGQ Supermicro|X11SSE8_308 Supermicro|X11DPG-HGX2 Supermicro|X11DPI-N(T) Supermicro|X11DPi-N(T) Supermicro|X11OPi Supermicro|C7Z270L8_222 Supermicro|B11QPI-T
New_CatOld_Cat@reddit
Datto uses a lot of Gigabyte mobos
KaitRaven@reddit
No Dell enterprise PCs, nice.
bcredeur97@reddit
Has anyone actually seen secureboot actually protect a computer against something? Or is it more just there as a deterrent?
THEoMADoPROPHET@reddit
That's the end of the work I did this week to make a bunch of machines work with Secure Boot.
Significant_Debt8289@reddit
Secure boot is Swiss cheese… you could manually flash the bios to make secure boot act as if it’s “working” but in reality you can just run what ever EFI program you want.
Takes a bit of snooping around the CAP with Ghidra but it’s honestly fairly easy
DGC_David@reddit
I said it about Crowdstrike and I'll say it again... Fine them...
Government: You owe us $XX,XXX,XXX,XXX.XX for the disaster you caused and we have to fix.
CompilerError404@reddit
How? You can't fine a company out of nowhere. There has to be a law in place to allow that to happen...
DGC_David@reddit
They little oopsies do upwards of millions of dollars in damages... This is how laws are created... So yes they can fine these companies.
DejfCold@reddit
You can't apply a law retroactively.
bigpirm1977@reddit
New York disagrees.
BatemansChainsaw@reddit
New York is wrong
DGC_David@reddit
Except they can and also it's already a law... Stfu
9-28.010 - Foundational Principles of Corporate Prosecution
CompilerError404@reddit
Why are you salty bro?
Is it a corporate crime to push out a faulty update. That's the issue here.
DejfCold@reddit
With regards to the first part - Ianal and also not 'murican, but... Wiki:
CompilerError404@reddit
They can be sued for damages, 100%. They can't be fined for a law that doesn't exist or retroactively. You're not correct in this scenario you are presenting.
Netprincess@reddit
You can't fine a war
DGC_David@reddit
I mean you can, Germany was forced to pay reparations after WW1
Doso777@reddit
Which was part of the reason why WWII happened. Not shure where you are going with this.
DGC_David@reddit
Okay shh!!! Listen home dawg Hitler was inspired by America and Ford's Dearborn Independent... These fines just needed an update.
Doso777@reddit
Took like what.. five minutes?.. for someone to mention Hitler. Online discussion speedrun.
DigitalEskarina@reddit
You're the one who brought up WWII!
Netprincess@reddit
Good point. But that was long long ago and we had solid proof
DGC_David@reddit
We have proof that AMI shipped these motherboards, HP also received these motherboards, we also have proof that HP then sold these motherboards in computers they sold.
Netprincess@reddit
Right but we don't know for sure "who" did it. Or when it was really effected.
Bios are sha checked before leaving the factory. At least gigabyte dell and HP are. The final QA test
DGC_David@reddit
We do, the companies.
Like HP scans through every board they run through. This was a QA failure. Why? Likely because they cut or outsourced QA.
I mean that's not a reason not to fine someone.
Doso777@reddit
What about the 200 other governments in the rest of the world?
DGC_David@reddit
Tbh I think they should also fine the company but lol that ain't happening 🤣
sithelephant@reddit
The best sort of crime to commit is the sort where your great grandpappy lobbied successfully for it to be legal, and it's now just good buisness practice.
tsavong117@reddit
Not gonna happen, but bailouts that never get paid back will.
CyberWarLike1984@reddit
Fridays, right?
narcissisadmin@reddit
Dave talks about it. Plus his shirt is awesome.
https://www.youtube.com/watch?v=7sYzwb6eUgQ
Ok_Mention6990@reddit
Does it ever end. Ffs
Valdaraak@reddit
It does not, and it's one of the main reasons I'd like to get out of IT at some point.
Doso777@reddit
People on here have recommended Goat herding or becoming a gardener. So.. yeah.
Ok_Mention6990@reddit
Sounds good to me.
Ok_Mention6990@reddit
Recently its just gone crazy, but one of the key points to this are companies reliance on outside services to secure their internal networks etc....
Two weeks ago I started to research crowdstrike, now I don't plan to use anyone but defender p2, I no longer trust any outside security company of any kind.
cluberti@reddit
This is the inevitable first blocks to fall when trying to outsource everything to show quarterly profit improvements. This, and layoffs, will keep this happening.
AdditionalReaction52@reddit
19 year old sys admin here with intune and everything else. How would I run this system wide and receive results other than a bad usb and manually going to every device. 80+
rweedn@reddit
You can power shell on remote machines on the network. Should be able to find some info online about it. But you'd bet best of creating a script that reports the status and saves to a txt file or something
AdditionalReaction52@reddit
We don’t have WinRM yet. I came a month ago to a blank Intune; they only care about the Office suite and outsource security through an Antivirus software managed by a different company. People can do what they want with their PCs and it’s scary. I was thinking win32 script deployment and to check, so thank you
thanitos1@reddit
Use the remediation powershell script section just do a detection script and leave the remediation side blank.
Detection scripts need to return output and an exit code. I typically just do Write-Host "Data returned from test or random crap" followed by an Exit 1 for a fail and the same thing but Exit 0 for pass
Soooo
If(something is true){ Write-Host "I've got bad keys pop" Exit 1
}Else{ Write-Host "I'm air tight no bad keys here" Exit 0
}
rdldr1@reddit
Yes, we are trying to figure out how to deploy BIOS updates on 2000 computers where most are working remote.
pdp10@reddit
UEFI Capsule Updates should work. An updater runs, and using standard UEFI mechanisms, drops off the firmware package for the systemboard to use at next bootup.
The main task is to make sure your hardware vendor issues updates through your OS vendor's firmware repos. If not, you might have to package them yourself.
Mindestiny@reddit
Might even just end up in the typical Windows Update pipeline (assuming you're using Windows). At least Dell typically releases critical BIOS updates via WU these days.
cluberti@reddit
Assuming they shipped them via WU, sure, that works. If they didn't, you'd have to contact the vendor to see how they recommend they be deployed in an automatic fashion. There are still a lot of UEFI updates for platforms out there that don't use WU or another automation platform, unfortunately.
Mindestiny@reddit
Honestly these days, that'd be something I'd make sure to consider when choosing a hardware vendor. BIOS updates via Windows Update are just a huge headache lifted off our shoulders, and especially with hybrid/remote becoming the norm, I'd say the labor involved in doing it some other way has real cost associated with it. If a hardware vendor didn't push them through WU, I'd make the case to choose someone else unless I already had a reliable pipeline to push them remotely for that specific vendor.
techtornado@reddit
It's a really good thing I have a Mac...
Otherwise yay for Dell not being on the list yet?
bobmlord1@reddit
Sounds like Dell is unaffected?
We're 100% Dell with the exception of this one old butt HP switch installed 2 sysadmins ago that's in such an inconvenient location that redoing it is too cost and labor prohibitive to justify.
FoxNairChamp@reddit
You saved me some time today. Thank the Optiplex!
bobmlord1@reddit
Definitely wouldn't hurt to runt he powershell on a random sampling of PC's.
cluberti@reddit
Running a few checks, including signature checks and grabbing the bitlocker recovery key (if used) and keeping it in your hardware inventory tool of choice, updated on every boot if possible, is a good way to keep tabs on what's out there.
Doso777@reddit
Just checked on new PowerEdge R660xs i racked last week, also false.
jmbpiano@reddit
I just ran the test across our network and found the bad key on a few Dells, though (as expected) they were all older systems (specifically Inspiron 3650s purchased in 2017).
Cormacolinde@reddit
It looks like this affects mostly end-of-life, unsupported hardware so far. So few patches will be incoming and if security is important to you you shouldn’t be running unsupported hardware.
buecker02@reddit
The article lists the powershell and linux commands to run to see if any of your devices are affected.
Dabnician@reddit
so only sysadmins that havent moved to azure or aws
420GB@reddit
You're still going to have some amount of client machines accessing azure / AWS / vcenter?? What are you saying lol
enp2s0@reddit
If you're on azure or aws it's not your problem at all since it's an issue with physical host firmware.
MatFrapper@reddit
Dell is listed. Why do you say that it’s unaffected?
cp07451@reddit
Probably cause its not any of Dell's enterprise models just the Alienware models.
bobmlord1@reddit
Because most business don't buy alienware? Looks like there's 2 XPS computers on there.
OkAmListening@reddit
Dell is affected according to the article, "...more than 200 device models sold by Acer, Dell, Gigabyte, Intel, and Supermicro."
Though not many models per the table at the end of the article.
thefpspower@reddit
There is a device list at the end of the article, there are some Dell models but mostly Alienware.
comagnum@reddit
It’s more like 200 models from 5 manufacturers with 80% being gigabyte.
georgecm12@reddit
If I read the article correctly, those are the ones known to use it, but they also say "In addition to the five makers mentioned earlier, they include Aopen, Foremelife, Fujitsu, HP, Lenovo, and Supermicro." So it may not be limited to just the list in that article.
tsavong117@reddit
As always, I feel vindicated by my strange obsession with MSI motherboards, despite their godawful UEFI interface. I've literally never had an issue with them.
Not_a_Candle@reddit
I will leave that here. No hate, but every vendor has its flaws.
tsavong117@reddit
Welp.
cluberti@reddit
Yup - and MSI uses AMI pretty much for everything, so while this one didn't get you (it shouldn't have gotten anyone, but... still), there could be others. Be careful out there and assume compromise whenever protecting your system(s).
bigpirm1977@reddit
Since Abit folded I’m with you.
MSgtGunny@reddit
Same with asrock
Wrong-Appearance3277@reddit
,,,,
EastcoastNobody@reddit
sent this to my boss in security (i have 3 bosses bob do you know what thats like?) I laughed and told him this effects us and Laughe and said there is no compensating control for this one. and laughed again
waynemr@reddit
Correct powershell command for me needed -Name in it, like this:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI -Name PK).bytes) -match "DO NOT TRUST|DO NOT SHIP"curleys@reddit
thank you thank you, I was like, dude did anyone actually try the command. I was a quarter through reading the cmdlet page when i figured somebody in the comments had to have tread this ground.
Appreciates you.
ben_zachary@reddit
I tossed this together rq for N1 - I am not a powershell guru ... make a custom device field tpmtrust
$tpm = [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI PK).bytes) -match "DO NOT TRUST|DO NOT SHIP"
if ($tpm -like "*false*") {
Ninja-Property-Set tpmTrust 'OK'
Write-Output 'UEFI OK'
} else {
Ninja-Property-Set tpmTrust 'DO NOT TRUST'
Write-Output 'UEFI UNSECURE'
}
Steve----O@reddit
So people can re-image your computer with a non-official OS? If they are even trying, you already lost (the bad guy has your computer). I really don't see the issue,
Not_a_Candle@reddit
Not quite. The device gets infected with low level malware that outlives a reinstall of your operating system and is undetectable via conventional methods like anti virus programs. That way any other type of malware could get pushed into your system. It's the ultimate, and most importantly, persistent way of infecting a system with anything the attacker likes.
Logical-Mongoose1614@reddit
Is this vuln exploitable remotely or do you need physical access to the machine?
Not_a_Candle@reddit
Neither. The user runs some funny stuff they shouldn't with admin rights and then shit hits the fan. Malware gets deployed into the uefi and outlives anything but a reflash.
Tulpen20@reddit
...and in the in-depth article from Ars, they said the GitHub repo with the keys had been removed.
and then this today: https://www.theregister.com/2024/07/25/data_from_deleted_github_repos/?td=rt-3a
Tripsyou@reddit
SeanFrank@reddit
My uncle works for Lenovo, and he confirmed the password was 1234
Certain-Community438@reddit
Oh good, I'll be having the team work up an exploit for upcoming engagements 👍
lighthills@reddit
Is there a CVE for this?
WillVH52@reddit
There goes all the work I did this week to enable Secure Boot on a bunch of servers…
Doso777@reddit
Servers don't seem to be affected as much.
deltron@reddit
Nation states are crying over this loss.
Cormacolinde@reddit
This is a serious fail, but the threat model here is not very consumer-facing. This is something mostly nation-state attackers are likely to look to exploit, not your average cryptolocker peddler.
Anonymous1Ninja@reddit
So someone leaked a key?
Why was it designed that way in the first place?
shortfinal@reddit
Two issues. Key leak and an improper key use
arvidsem@reddit
The key was accidentally leaked 2 years ago, but it shouldn't have mattered because it was the key for the sample certificate provided with the BIOS source. Companies using the BIOS are supposed to replace that certificate with a new one when they build their hardware specific versions.
The certificate is clearly labeled as DO NOT USE, but 🤷🏽
ITfactotum@reddit
O.o ooof
That's not good.
I expect we'll see some firmware updates coming soon for lots and lots of systems....
For companies that deal in computer hardware, you'd think that cryptographic key management would be pretty high up on the things that are important not to cock up....
The PS scripts that are in the article don't work for checking windows machines for this vuln, anyone got one that does?
buecker02@reddit
you need to run the PS command as administrator. It does work.
nerfblasters@reddit
Also needs to run via windows powershell, pwsh (7.4.3 at least) returns "InvalidOperation: Cannot Invoke method. Method invocation is supported only on core types in this language mode."
Admin windows powershell works fine.
LongStoryShrt@reddit
Boeing does UEFI.