.

Summary:

Hundreds of UEFI products from 10 vendors are vulnerable to the PKfail supply-chain issue, allowing attackers to bypass Secure Boot and install malware. The issue has been present for over 12 years and affects nearly 900 devices. Vendors should follow cryptographic key management best practices and replace test keys. Users should apply firmware updates and security patches promptly. To check if your device is affected, run a command in PowerShell or use an online tool. To protect your device, apply security patches, monitor devices, follow cryptographic key management practices, and replace test keys. The PKfail vulnerability poses risks such as bypassing Secure Boot, execution of malicious code, persistent threats, wide impact, and data breach risks. Disconnect devices with leaked AMI PK from critical networks until a firmware upgrade is available.

Here are the key points:

• Critical Firmware Issue: Hundreds of UEFI products from 10 vendors are vulnerable due to a supply-chain issue known as PKfail, allowing attackers to bypass Secure Boot and install malware.
• Untrusted Keys: Devices shipped with a test Secure Boot “master key” from AMI, which should have been replaced by OEMs with secure keys.
• Long-Lasting Vulnerability: The issue has persisted for over 12 years, affecting nearly 900 devices.
• Mitigation: Vendors should follow cryptographic key management best practices and replace test keys2. Users should apply firmware updates and security patches promptly.

What are the risks of this vulnerability?

How you can check if your device is affected?

• You can check if your device is affected by the PKfail vulnerability by following these steps:
• Windows Users: Run the following command in an elevated PowerShell:
• [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI PK).bytes) -match “DO NOT TRUST|DO NOT SHIP”
• If it returns true, then your device is affected. If it returns false, then your device is not affected.
• Online Tool: Binarly has provided an online tool to check whether the firmware is affected by PKfail2. Devices affected by PKfail will have the Platform Key certificate’s subject and issuer fields containing the string DO NOT TRUST or DO NOT SHIP.
• PKfail Scanner: Use tools like the PKfail scanner provided by Binarly to detect vulnerable devices and malicious payloads.
• Remember to regularly check for and apply firmware updates from your device vendors to address PKfail vulnerabilities. If you find that your device is affected, it’s recommended to disconnect it from critical networks until you are able to deploy a firmware upgrade.

How can I protect my device from PKfail attacks?

To protect your device from PKfail attacks, you can follow these steps:

1. Apply Security Patches: Regularly check for and apply firmware updates from your device vendors to address PKfail vulnerabilities.
2. Monitor Devices: Use tools like the PKfail scanner provided by Binarly to detect vulnerable devices and malicious payloads.
3. Cryptographic Key Management: Vendors are advised to generate and manage the Platform Key by following cryptographic key management best practices, such as Hardware Security Modules.
4. Replace Test Keys: It’s essential to replace any test keys provided by independent BIOS vendors like AMI with their own safely generated keys.
5. Remember, the fix for PKfail is straightforward: the compromised key needs to be replaced, and device vendors need to ship a firmware update. If your device is affected, it’s recommended to disconnect it from critical networks until you are able to deploy a firmware upgrade.

About the author: Kevin Harrys