MSI firmware signing keys leaked
github.com
github.com
They artificially limited both discrete and on board GPU being active at the same time in my GT72's BIOS.
There is a giant pile of hardware in the world that relies on unsigned hardware. Meanwhile, MSI uses its hardware signing to hurt its customers.
Will some MSI users get tricked into using malicious firmware? Doubtless, eventually. That's sad. But not nearly as sad as the millions of users who can't use their own computers in a manner of their choosing.
Celebrate, without remorse.
Like I said, I get the support for increased openness and freedom in hardware and the appeal that has to some users. But security is a feature that a lot of users (even power users) care about too, and it's bad when that feature breaks.
Asus seems to have had several design issues, qc flaws and other support issues lately. MSI have had data breaches, and even then bully reviewers to the point you really can't trust a lot of their product reviews or them. Gigabyte treats their Linux using customers like hot garbage, and then there's the exploding PSU coverup/downplay. I'm not sure how many options that's leaving on the table at this point. I know there's ASRock for MBs and haven't seen anything bad about them lately.
Ah, vendor lockin, got it.
How would someone use those keys? What's beneficial, what could be useful possible cases for me? And Are my workstations in my company at risk?
For example here are instructions on how to do so with a Thales HSM https://thalesdocs.com/gphsm/ptk/5.4/docs/Content/PTK-C_Admi...
I somehow assumed that real, non-toy HSMs involved dedicated generators as companion devices with heavily reduced attack surface, which generate and store private key material, are able to transfer it to the HSM proper (and to a paper backup), and are strictly kept offline after that.
Sometimes the world feels disappointing.
HSMs have backup features and the data cannot be restored without a secret split among multiple secret holders (like https://en.m.wikipedia.org/wiki/Shamir%27s_secret_sharing). So a backup can be done on physical media and put in a safe.
It's a lot of things about key management, HSMs, pkcs interfaces to learn though.
Using a HSM does _not_ guarantee that keys can not be exported. But the converse also holds, a key that is managed by a HSM can not necessarily be exported.