* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Wednesday, July 9, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Monumental Sports & Entertainment’s Samantha Brady on the Power of the RSN’s Direct-to-Consumer Streaming Service Monumental+ – Sports Video Group

    Samantha Brady Reveals How Monumental+ is Transforming Sports Streaming with Direct-to-Consumer Access

    Moses Singer Welcomes Entertainment and Intellectual Property Partner Frederick Bimbler – Yahoo Finance

    Moses Singer Expands Team with New Entertainment and Intellectual Property Partner Frederick Bimbler

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Magicians and Battlebots light up Las Vegas entertainment scene – KSNV

    Magicians and Battlebots Take Las Vegas Entertainment by Storm

    Max-Matching Entertainments & Longhua District form partnership for new entertainment complex – Blooloop

    Max-Matching Entertainments and Longhua District Unite to Launch Thrilling New Entertainment Complex

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Google Fiber puts Nokia network slicing technology to the test – Fierce Network

    Google Fiber Puts Nokia’s Network Slicing Technology to the Ultimate Test

    Kaseya Extends Community Investment with Addition of Technology Marketing Toolkit – Kaseya

    Kaseya Extends Community Investment with Addition of Technology Marketing Toolkit – Kaseya

    AI and the Trust Revolution: How Technology Is Transforming Human Connections – Foreign Affairs

    AI and the Trust Revolution: How Technology Is Transforming Human Connections – Foreign Affairs

    Technology And Construction Names Join Top Stock Lists: Check Out Additions To IBD 50, Big Cap 20 And More – Investor’s Business Daily

    Technology and Construction Leaders Surge Into Top Stock Rankings: See the Latest Additions to IBD 50, Big Cap 20, and More

    Column: Teach kupuna new technology skills – Honolulu Star-Advertiser

    Empowering Kupuna: Unlocking New Technology Skills for a Connected Future

    EIFO invests $5 million in D3, the Ukraine-focused defence technology venture fund – sUAS News

    EIFO Pledges $5 Million to Supercharge Ukraine-Focused Defense Technology Fund

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Monumental Sports & Entertainment’s Samantha Brady on the Power of the RSN’s Direct-to-Consumer Streaming Service Monumental+ – Sports Video Group

    Samantha Brady Reveals How Monumental+ is Transforming Sports Streaming with Direct-to-Consumer Access

    Moses Singer Welcomes Entertainment and Intellectual Property Partner Frederick Bimbler – Yahoo Finance

    Moses Singer Expands Team with New Entertainment and Intellectual Property Partner Frederick Bimbler

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Longhua District and Max-Matching Entertainments, supported by RWS Global forge strategic partnership to develop international IP-themed entertainment complex – Amusement Today

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Government whip to withdraw Entertainment Complex Bill on July 9 – Nation Thailand

    Magicians and Battlebots light up Las Vegas entertainment scene – KSNV

    Magicians and Battlebots Take Las Vegas Entertainment by Storm

    Max-Matching Entertainments & Longhua District form partnership for new entertainment complex – Blooloop

    Max-Matching Entertainments and Longhua District Unite to Launch Thrilling New Entertainment Complex

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Google Fiber puts Nokia network slicing technology to the test – Fierce Network

    Google Fiber Puts Nokia’s Network Slicing Technology to the Ultimate Test

    Kaseya Extends Community Investment with Addition of Technology Marketing Toolkit – Kaseya

    Kaseya Extends Community Investment with Addition of Technology Marketing Toolkit – Kaseya

    AI and the Trust Revolution: How Technology Is Transforming Human Connections – Foreign Affairs

    AI and the Trust Revolution: How Technology Is Transforming Human Connections – Foreign Affairs

    Technology And Construction Names Join Top Stock Lists: Check Out Additions To IBD 50, Big Cap 20 And More – Investor’s Business Daily

    Technology and Construction Leaders Surge Into Top Stock Rankings: See the Latest Additions to IBD 50, Big Cap 20, and More

    Column: Teach kupuna new technology skills – Honolulu Star-Advertiser

    Empowering Kupuna: Unlocking New Technology Skills for a Connected Future

    EIFO invests $5 million in D3, the Ukraine-focused defence technology venture fund – sUAS News

    EIFO Pledges $5 Million to Supercharge Ukraine-Focused Defense Technology Fund

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Technology

PKfail Secure Boot bypass lets attackers install UEFI malware

July 27, 2024
in Technology
PKfail Secure Boot bypass lets attackers install UEFI malware
Share on FacebookShare on Twitter

PKfail

Hundreds of UEFI products from 10 vendors are susceptible to compromise due to a critical firmware supply-chain issue known as PKfail, which allows attackers to bypass Secure Boot and install malware.

As the Binarly Research Team found, affected devices use a test Secure Boot “master key”—also known as Platform Key (PK)—generated by American Megatrends International (AMI), which was tagged as “DO NOT TRUST” and that upstream vendors should’ve replaced with their own securely generated keys.

“This Platform Key, which manages the Secure Boot databases and maintains the chain of trust from firmware to the operating system, is often not replaced by OEMs or device vendors, resulting in devices shipping with untrusted keys,” the Binarly Research Team said.

The UEFI device makers who used untrusted test keys across 813 products include Acer, Aopen, Dell, Formelife, Fujitsu, Gigabyte, HP, Intel, Lenovo, and Supermicro.

Vulnerable Intel firmwareVulnerable Intel firmware (BleepingComputer)

In May 2023, Binarly discovered a supply chain security incident involving leaked private keys from Intel Boot Guard, impacting multiple vendors. As first reported by BleepingComputer, the Money Message extortion gang leaked MSI source code for firmware used by the company’s motherboards.

The code contained image signing private keys for 57 MSI products and Intel Boot Guard private keys for another 116 MSI products.

Earlier this year, a private key from American Megatrends International (AMI) related to the Secure Boot “master key” was also leaked, affecting various enterprise device manufacturers. The impacted devices are still in use, and the key is being used in recently released enterprise devices.

PKfail impact and recommendations

As Binarly explains, successfully exploiting this issue allows threat actors with access to vulnerable devices and the private part of the Platform Key to bypass Secure Boot by manipulating the Key Exchange Key (KEK) database, the Signature Database (db), and the Forbidden Signature Database (dbx).

After compromising the entire security chain, from firmware to the operating system, they can sign malicious code, which allows them to deploy UEFI malware like CosmicStrand and BlackLotus.

“The first firmware vulnerable to PKfail was released back in May 2012, while the latest was released in June 2024. Overall, this makes this supply-chain issue one of the longest-lasting of its kind, spanning over 12 years,” Binarly added.

“The list of affected devices, which at the moment contains almost 900 devices, can be found in our BRLY-2024-005 advisory. A closer look at the scan results revealed that our platform extracted and identified 22 unique untrusted keys.”

To mitigate PKfail, vendors are advised to generate and manage the Platform Key by following cryptographic key management best practices, such as Hardware Security Modules.

It’s also essential to replace any test keys provided by independent BIOS vendors like AMI with their own safely generated keys.

Users should monitor firmware updates issued by device vendors and apply any security patches addressing the PKfail supply-chain issue as soon as possible.

Binarly also published the pk.fail website, which helps users scan firmware binaries for free to find PKfail-vulnerable devices and malicious payloads.

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : BleepingComputer – https://www.bleepingcomputer.com/news/security/pkfail-secure-boot-bypass-lets-attackers-install-uefi-malware/

Tags: PKfailsecuretechnology
Previous Post

Italy’s flagbearer issues grovelling apology to wife after losing wedding ring in opening ceremony

Next Post

Russian ransomware gangs account for 69% of all ransom proceeds

Google Fiber puts Nokia network slicing technology to the test – Fierce Network

Google Fiber Puts Nokia’s Network Slicing Technology to the Ultimate Test

July 9, 2025
Ball State is the worst team in EA Sports College Football 26. Could that be a good thing? – Yahoo Sports

Is Being the Worst Team in EA Sports College Football 26 Actually an Advantage for Ball State?

July 9, 2025
Academics critique Farming Simulator’s portrayal of ‘good farming’ and praise modders for agro-ecology add-ons – PC Gamer

Academics critique Farming Simulator’s portrayal of ‘good farming’ and praise modders for agro-ecology add-ons – PC Gamer

July 9, 2025
Why is the Earth spinning faster? Is time speeding up? Australia’s experts give us their second opinion – The Guardian

Why is the Earth spinning faster? Is time speeding up? Australia’s experts give us their second opinion – The Guardian

July 9, 2025
200 million year-old jawbone revealed as new species – BBC

200 million year-old jawbone revealed as new species – BBC

July 9, 2025
Off-grid homeowner dispels common misconceptions about his lifestyle: ‘Doesn’t mean I live primitively’ – Yahoo

Off-Grid Living Uncovered: How One Homeowner Thrives Without Sacrificing Modern Comforts

July 9, 2025
Fluminense Is the Big Winner of the Controversial 2025 Club World Cup – Sportico.com

Fluminense Is the Big Winner of the Controversial 2025 Club World Cup – Sportico.com

July 9, 2025
A Masterclass on Status, Power, & the Economy with Tressie M… – Kottke.org

Unlocking Status, Power, and the Economy: A Masterclass with Tressie M

July 9, 2025
Monumental Sports & Entertainment’s Samantha Brady on the Power of the RSN’s Direct-to-Consumer Streaming Service Monumental+ – Sports Video Group

Samantha Brady Reveals How Monumental+ is Transforming Sports Streaming with Direct-to-Consumer Access

July 9, 2025
Tuesday’s Station Research Advancing Crew Health as Crew Unpacks Cargo – NASA (.gov)

Tuesday’s Station Research Advancing Crew Health as Crew Unpacks Cargo – NASA (.gov)

July 9, 2025

Categories

Archives

July 2025
MTWTFSS
 123456
78910111213
14151617181920
21222324252627
28293031 
« Jun    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (712)
  • Economy (737)
  • Entertainment (21,625)
  • General (15,795)
  • Health (9,774)
  • Lifestyle (742)
  • News (22,149)
  • People (737)
  • Politics (745)
  • Science (15,954)
  • Sports (21,235)
  • Technology (15,721)
  • World (718)

Recent News

Google Fiber puts Nokia network slicing technology to the test – Fierce Network

Google Fiber Puts Nokia’s Network Slicing Technology to the Ultimate Test

July 9, 2025
Ball State is the worst team in EA Sports College Football 26. Could that be a good thing? – Yahoo Sports

Is Being the Worst Team in EA Sports College Football 26 Actually an Advantage for Ball State?

July 9, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version