According to research by Binarly, several cryptographic keys from major vendors have been leaked. The research agency is launching an online detection tool to scan firmware files for the relevant keys.

Secure Boot is a security feature that prevents malicious software from booting devices. The tool is built into hundreds of millions of PCs from Dell, Intel, and Acer, among others, and is designed to prevent sophisticated malware from infecting a system’s BIOS. Such malware infections are catastrophic because the malware code is executed before the operating system and associated security software start. Secure Boot must check the firmware to prevent such attacks.

An investigation by security research firm Binarly now shows that cryptographic keys from several major vendors have been leaked. The exploit is named “PKfail”. Binarly has published an online detection tool that can be used to check whether firmware files use the compromised keys in question.

Cryptographic keys

Armed with the keys, hackers can essentially write fraudulent firmware that looks legitimate to Secure Boot. This ruins the entire design of the security functionality.

Security research firm Binarly wrote in a blog that leaked cryptographic keys allegedly compromised the hardware of several major vendors, including Dell, Acer, and Intel. Today, devices are in circulation where Secure Boot uses insecure keys.

The exploit is called “PKfail” by Binarly and is extremely interesting for hackers. They can use such keys to attack certain devices and execute code that is barely detectable under Windows or a similar operating system.

Vulnerable to attacks

Many consumer and B2B devices are currently vulnerable to boot process attacks. Although such attacks must be extremely complex to be successful, they are among the most dangerous methods by which a computer can be compromised. Given the great complexity, users should not immediately fear a large-scale exploit. Rather, the leak ensures that professional hackers with extensive access can theoretically penetrate even deeper into an organization undetected.

Binary has released an online tool that allows users to scan firmware files to find out if the associated devices are using the compromised keys.