![]() In an advisory, the Netherlands-based National Cybersecurity Center didn’t rule out the possibility. “The worst scenario is if the attackers gain not only access to the keys but also can distribute this malicious update ," Matrosov said. Whatever the difficulty, possession of the signing key MSI uses to cryptographically verify the authenticity of its installer files significantly lowers the effort and resources required to pull off an effective supply chain attack. Because MSI doesn’t have an automated update mechanism or a revocation process, the bar would probably be lower, though. Gaining the kind of control required to compromise a software build system is generally a non-trivial event that requires a great deal of skill and possibly some luck. There are no reports of any supply chain attacks targeting MSI customers. Security firm Mandiant later reported that the compromise of 3CX resulted from it being infected through a supply chain attack on software developer Trading Technologies, maker of the X_Trader financial trading program 3CX used. The hackers behind that intrusion, who work on behalf of the North Korean government, according to researchers, used their foothold to deliver malicious updates to an unknown number of customers. In March, telephony company 3CX, maker of popular VoIP software used by more than 600,000 organizations in 190 countries, disclosed a breach of its build system. Ten federal agencies and about 100 private companies received follow-on payloads that installed backdoors for use in espionage. With control of the private key used to certify legitimate updates, the Kremlin-backed hacking unit known as APT29 and Cozy Bear, believed to be part of Russia’s Foreign Intelligence Service, infected more than 18,000 customers with a first stage of malware. Advertisementįurther Reading ~18,000 organizations downloaded backdoor planted by Cozy Bear hackersOver the past decade, supply chain attacks have delivered malicious payloads to thousands of users in a single incident when the victims did nothing other than install a validly signed update, in the 2019 compromise of the software build and distribution system for SolarWinds, a cloud-based network management service. Consequently, MSI doesn’t provide the same kind of key revocation capabilities. To make matters worse, Matrosov said, MSI doesn’t have an automated patching process the way Dell, HP, and many larger hardware makers do. ![]() ![]() This raises the possibility that the leaked key could push out updates that would infect a computer’s most nether regions without triggering a warning. The first is the signing key that digitally signs MSI firmware updates to cryptographically prove that they are legitimate ones from MSI rather than a malicious impostor from a threat actor. To his alarm, included in the trove were two private encryption keys. ![]() Since then, Matrosov has analyzed data that was released on the Money Message site on the dark web. A day later, MSI issued a terse advisory saying that it had “suffered a cyberattack on part of its information systems.” The advisory urged customers to get updates from the MSI website only. The intrusion came to light in April when, as first reported by Bleeping Computer, the extortion portal of the Money Message ransomware group listed MSI as a new victim and published screenshots purporting to show folders containing private encryption keys, source code, and other data. “It’s very hard to solve, and I don’t think MSI has any backup solution to actually block the leaked keys.” Leaked key + no revocation = recipe for disaster “It’s kind of like a doomsday scenario where it’s very hard to update the devices simultaneously, and they stay for a while not up to date and will use the old key for authentication,” Alex Matrosov, CEO, head of research, and founder of security firm Binarly, said in an interview. A ransomware intrusion on hardware manufacturer Micro-Star International, better known as MSI, is stoking concerns of devastating supply chain attacks that could inject malicious updates that have been signed with company signing keys that are trusted by a huge base of end-user devices, a researcher said. ![]()
0 Comments
Leave a Reply. |