Firmware signing-key compromise as a class: Firmware trust anchors (Boot Guard KM/BPM, UEFI PK/KEK, BMC image-signing

Impact

Firmware trust anchors (Boot Guard KM/BPM, UEFI PK/KEK, BMC image-signing keys) are held by ODMs with weaker security postures than the clouds that deploy their hardware, and several have been breached. A neocloud inherits the ODM's key hygiene

Who can reach it

Supply chain

What to do

Requires diligence on ODM key custody at purchase time and an independent measured-boot / firmware-integrity baseline so a signed-but-malicious image is still detectable. Cannot be remediated after the fact

References

Related entries

• Redfish implementations (all vendors): Redfish replaced IPMI but reintroduced the same class of flaws at the HTTP layerNCVD-0000-009-redfish-implementations-all-vend · Redfish implementations (all vendors)Unscored
• KVM-over-IP / virtual media: The BMC's virtual-media function can mount an arbitrary ISO as the host's boot deviceNCVD-0000-010-kvm-over-ip-virtual-media · KVM-over-IP / virtual mediaUnscored
• Serial console servers / out-of-band access appliances: Console servers (Opengear, Lantronix, Digi and similar) holdNCVD-0000-011-serial-console-servers-out-of-ba · Serial console servers / out-of-band access appliancesUnscored
• ATA Secure Erase / NVMe Sanitize / Format NVM across SSD vendorsNCVD-2011-001-ata-secure-erase-nvme-sanitize-f · ATA Secure Erase / NVMe Sanitize / Format NVM across SSD vendors - drives that report sanitization success while…Unscored
• ATA Secure Erase / NVMe Sanitize / Format NVM across SSD vendorsNCVD-2011-002-ata-secure-erase-nvme-sanitize-f · ATA Secure Erase / NVMe Sanitize / Format NVM across SSD vendors - drives that report sanitization success while…Unscored
• HDD and SSD controller firmware as a persistence surfaceNCVD-2015-001-hdd-and-ssd-controller-firmware · HDD and SSD controller firmware as a persistence surface - demonstrated against Seagate, Western Digital, Toshiba…Unscored