12-Year-Old Secure Boot Blunder: Hundreds of Devices at Risk
A supply chain vulnerability, dubbed PKfail, has been hiding in plain sight for 12 years. This flaw, stemming from an untrusted Secure Boot “master key,” affects over 800 products and allows hackers to take over devices and install malware. Major vendors like Dell, HP, and Lenovo are implicated.
Hot Take:
Imagine if your 12-year-old self left the front door open and you only just found out now. That’s pretty much what just happened with this supply chain vulnerability. Except instead of letting in stray cats, it’s letting in cybercriminals. Oops!
Key Points:
- PKfail vulnerability has been hiding in plain sight for 12 years.
- Allows threat actors to take over endpoints and install malicious code.
- Found by Binarly Research Team, originating from Secure Boot “master key”.
- Over 800 products from vendors like Acer, Dell, HP, and Lenovo are affected.
- This is one of the longest-lasting supply-chain vulnerabilities ever discovered.
Already a member? Log in here