Slashdot Mirror

← Back to Stories (view on slashdot.org)

AMI Firmware Source Code, Private Key Leaked

Posted by Soulskill on from the never-trust-others-to-respect-your-property-as-much-as-you-do dept.

Trailrunner7 writes "Source code and a private signing key for firmware manufactured by a popular PC hardware maker American Megatrends Inc. (AMI) have been found on an open FTP server hosted in Taiwan. Researcher Brandan Wilson found the company's data hosted on an unnamed vendor's FTP server. Among the vendor's internal emails, system images, high-resolution PCB images and private Excel spreadsheets was the source code for different versions of AMI firmware, code that was current as of February 2012, along with the private signing key for the Ivy Bridge firmware architecture. AMI builds the AMIBIOS BIOS firmware based on the UEFI specification for PC and server motherboards built by AMI and other manufacturers. The company started out as a motherboard maker, and also built storage controllers and remote management cards found in many Dell and HP computers. 'The worst case is the creation of a persistent, Trojanized update that would allow remote access to the system at the lowest possible level,' researcher Adam Caudill said. 'Another possibility would be the creation of an update that would render the system unbootable, requiring replacement of the mainboard.'"

2 of 148 comments (clear)

  1. Re:Link? by Anonymous Coward · · Score: 2, Informative

    THEN CARE LESS.
    The phrase is "I couldn't care less", you troglodyte.

  2. Re:NOTHING IS LEAKED by dutchwhizzman · · Score: 3, Informative

    md5sum Downloads/018s.zip

    4ebc77526c2ea7c0387cc993252e682b Downloads/018s.zip

    md5sum 018s/Keys/FW/.priKey

    198e238540b93095f02ee763bdadba86 018s/Keys/FW/.priKey

    There are no American tanks in Baghdad. The situation is completely under control.

    --
    I was promised a flying car. Where is my flying car?