The researchers discovered that AMD had been using a publicly available example key from NIST documentation since Zen 1,
lol... sigh...
this post was submitted on 11 Mar 2025
17 points (100.0% liked)
cybersecurity
3834 readers
158 users here now
An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!
Community Rules
- Be kind
- Limit promotional activities
- Non-cybersecurity posts should be redirected to other communities within infosec.pub.
Enjoy!
founded 2 years ago
MODERATORS
Just like all the BIOSes that have turned out to be using keys called things like TEST ONLY - NOT FOR PRODUCTION, rendering Secure Boot not. I have a couple of computers like this.
The researchers discovered that AMD had been using a publicly available example key from NIST documentation since Zen 1, which allowed them to forge signatures and deploy arbitrary microcode modifications.
I wish these sorts of errors were not that common.