Poor firmware implementation can lead to the bypass of advanced technologies created to protect Unified Extensible Firmware Interface (UEFI) BIOS, such as Intel Boot Guard, from illegal modifications, security researchers have discovered.
Initially launched in 2013, Intel Boot Guard is a hardware-assisted BIOS integrity verification mechanism that creates a trusted boot chain so that the integrity of boot components is cryptographically verified. The boot chain uses an RSA public key (its hash is hard-coded inside the CPU) and an OEM private key.
The OEM sets the final configuration and writes it to one-time-programmable Intel chipset fuses during the manufacturing process, thus making it almost impossible for an attacker to modify the BIOS without knowing the private part of the OEM Root Key.
