
Secure Boot, a critical security feature designed to ensure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM), has been completely compromised on over 200 models from major device manufacturers including Acer, Dell, Gigabyte, Intel, and Supermicro. The breach is attributed to a cryptographic key leak that occurred in 2022, where the platform key was leaked on GitHub. The repository containing the private portion of the platform key was encrypted, but it was protected by a weak four-character password. According to Binarly, an additional 300 more models use keys marked 'DO NOT TRUST'. This vulnerability undermines the security of the UEFI ecosystem and raises concerns about the integrity of the software supply chain across the industry.
Secure Boot key compromised in 2022 is still in use in over 200 models — an additional 300 more use keys are marked ‘DO NOT TRUST’ https://t.co/kWg38qQGx6 https://t.co/qAoxNAXhfL
Compromising the Secure Boot Process: https://t.co/s7I7jWcPr1 by Schneier on Security #infosec #cybersecurity #technology #news
Secure Boot is busted on hundreds of PCs from Dell, Acer, Intel, and others https://t.co/QyXOKymtPo by @MichaelCrider



