AMI’s Aptio UEFI BIOS source code and its unique UEFI signing key has been leaked onto a publicly accessible FTP server in Taiwan, an event that may have compromised the security of every motherboard running AMI Aptio. The release of the latter item malware gives developers the ability to develop “signed” malicious BIOS updates, replace legitimate system BIOS updates, and gain access to most ring-0 OS functions.
Adam Caudill, who discovered the open FTP server along with Brandon Wilson, characterized the leak as a “dream come true for advanced corporate espionage or intelligence operations” and further added that “the ability to create a nearly undetectable, permanent hole in a system's security is an ideal scenario for covert information collection.”
The industry blogger also cited motherboard vendor, Jetway, as being responsible for placing the files on the unsecured FTP server, a claim that has yet to be conclusively verified. In AMI’s official statement, the company confirmed that the leak took place and noted that the "leaky FTP server" was run by one of AMI's customers. Therefore, the leak of the data was not "the fault of AMI and by extension not a result of a security lapse on AMI’s behalf."
With regard to the severity of the threat, AMI seemed to disagree with Adam Caudill, as they do not view it as a "general security threat" which could “create a nearly undetectable, permanent hole in a system’s security" and advised all concerned parties to contact an AMI Sales Representative or AMI Technical Marketing for further information.
Subramonian Shankar, American Megatrends CEO and President, further commented that “while today’s news is certainly distressing, AMI would like to reassure its customers and partners in no uncertain terms that this should not be a security concern for them. If they follow standard operating procedure for BIOS signing, the security features in our BIOS source code and secure signing process will function as designed and remain 100% secure.”
