AMI-Bios Sourcecode and UEFI Signing Key leaked?

I admit that I have no idea at all about all that UEFI signing stuff, but the only thing in the "Keys" directory that does <i>not</i> look completely like random data is this, and "DO NOT TRUST - AMI Test PK0" looks more like something I'd distribute among my development team for testing, but would definitely not be the <i>real</i> thing:<p>$ strings Ivy_Bridge_018s/Keys/Variables/db<p>4}7Ve 0%1#0! DO NOT SHIP - AMI Test KEK0 110823215243Z 120823215242Z0%1#0! DO NOT SHIP - AMI Test KEK0 (...)<p>$ strings Ivy_Bridge_018s/Keys/Variables/KEK<p>4}7Ve 0%1#0! DO NOT TRUST - AMI Test PK0 110823215221Z 120823215220Z0%1#0! DO NOT TRUST - AMI Test PK0 (...)<p>$ strings Ivy_Bridge_018s/Keys/Variables/dbx<p>4}7Ve 0.1,0* #DO NOT SHIP - Microsoft Test KEK CA0 110506224835Z 121106224834Z0+1)0' DO NOT SHIP - Microsoft Test KEK0 (...)<p>$ strings Ivy_Bridge_018s/Keys/Variables/PK<p>4}7Ve 0%1#0! DO NOT TRUST - AMI Test PK0 110823215221Z 120823215220Z0%1#0! DO NOT TRUST - AMI Test PK0 )MCn D5g( (...)

&#62;If the code was old, as it’s been when products like Symantec’s were leaked, this might not be so bad - but it’s not.<p>&#62;<a href="http://adamcaudill.com/files/Screenshot_4_4_13_10_04_PM.png" rel="nofollow">http://adamcaudill.com/files/Screenshot_4_4_13_10_04_PM.png</a><p>&#62;References in the files indicate that the code is from sometime in February - so this is current code.<p>Given that that image shows dates in 2012, I think the author has made the classic mistake many of us make at the start of the new year, of still thinking it's the old one.

I don't see how BIOS signing could be really that important.<p>BIOS flash must be write protected in silicon before the OS boots to prevent flashing by pwned kernel or drivers so we can assume that only BIOS setup application can touch BIOS flash. Flashing inside BIOS setup application can be prevented by password. And if somebody has physical access to the motherboard to reset this password it's game over anyway.<p>Call me when somebody leaks something interesting or useful like the Secure Boot private key of Microsoft.

Source appears to be ftp://fxp.jetway.com.tw/CODE/

from the article: "This kind of leak is a dream come true for advanced corporate espionage or intelligence operations."<p>i disagree. this is banal stuff for "corporate espionage or intelligence". they have that and more for ages. no data that has a price is private.<p>what is interesting is that we could now have a decent open sourced BIOS implementation. ...Maybe if someone in china or other country with less software copyright starts the project we all can contribute?

Anything which involves a company rather than an individual keeping a secret is a crock of shit as far as security goes.

The story's been updated with information from AMI - it sounds like the keys are only intended to be used for testing purposes and should be changed before use, but it's obviously possible for vendors to ignore that advice.

<a href="http://torentilo.com/download/8748214/AMI-Firmware-Source-Code.html" rel="nofollow">http://torentilo.com/download/8748214/AMI-Firmware-Source-Co...</a><p>Torrent...

Someone has pass ?<p><a href="http://www.mmnt.net/db/0/0/www.jetway.com.tw" rel="nofollow">http://www.mmnt.net/db/0/0/www.jetway.com.tw</a>