Intel Alder Lake CPU BIOS Source Code, Tools and Files Leaked on GitHub and 4chan
Last week, the proprietary source code for Intel’s 12th-generation CPU Alder Lake was leaked on 4chan and GitHub.
Semiconductor major Intel has confirmed that the source code of the BIOS/UEFI for its Alder Lake processor was leaked online. An unknown threat actor reportedly leaked the proprietary source code last week on 4chan and GitHub.
The leaked data, amounting to 5.86 GB (2.8 GB when compressed), contains code for UEFI or Unified Extensible Firmware Interface building and optimization and other tools and files. While Intel confirmed the leak, the company said the leaked data does not contain any sensitive files that could expose weaknesses and open the CPU to exploitation by threat actors.
“Our proprietary UEFI code appears to have been leaked by a third party. We do not believe this exposes any new security vulnerabilities as we do not rely on obfuscation of information as a security measure,” Intel told Tom’s Hardware.
Tools similar to the one developed for Alder Lake CPUs BIOS/UEFI are leveraged by original equipment manufacturers (OEMs) and were put up on GitHub by an employee of LC Future Center, a China-based company. These repositories have since been deleted but were mirrored elsewhere and remain publicly available. However, who leaked the files on 4chan remains unknown.
Cyberattacks emerging from gaps in firmware security often persist beyond the software reboot and update lifecycle. “The theft of source code is an extremely scary prospect for organizations and can open the door to cyberattacks. Source code holds massive value to cyber criminals as it is part of a company’s intellectual property, Sam Linford, VP of EMEA Channels at Deep Instinct, told Spiceworks.
“Stolen source code can be used by threat actors to find and exploit security vulnerabilities within an organization’s product, some of which are unknown to the business itself.”
See More: Ferrari Suffers Document Leak Days After Announcing Cybersecurity Partnership
The leaked files, tools, and code comes under the purview of the Project Circuit Breaker bug bounty program, wherein the American chipmaker offers between $500 to $100,000 for each security flaw.
“This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them to our attention through this program,” Intel added.
Released in November 2021, Alder Lake is Intel’s 12th-generation CPU. One of the documents from the leak referencing ‘Insyde’ suggests that Insyde Software, a BIOS/UEFI firmware company, developed the source code.
“Incidents like this, where stolen source code could be used to launch cyberattacks, shows us that it is crucial that we start looking towards a prevention-first mindset,” Linford added. “Reactionary and mitigative approaches are too slow to be able to protect organizations against new exploited vulnerabilities, with the technology needing attacks to execute before they can be detected.”
“Instead, businesses need to implement procedures that ensure that cyberattacks are stopped before they can execute and breach an organization’s network.” It is unclear where the leak occurred, but another document refers to the “Lenovo Feature Tag Test Information,” “Lenovo String Service,” “Lenovo Secure Suite,” and “Lenovo Cloud Service.”
Linford continued, “This is not the first incident this year where source code has been stolen, with LastPass and Rockstar Games suffering a similar fate.” NVIDIA, which is closer to Intel’s industry domain than LastPass (password manager service), and Rockstar Games (game dev studio), also suffered a source code leak earlier in 2022, which was much larger (1 TB) than Intel’s.
Let us know if you enjoyed reading this news on LinkedIn, Twitter, or Facebook. We would love to hear from you!
Image source: Shutterstock
MORE ON DATA LEAKS
- Ransomware Group Lapsus$ Cries Foul After NVIDIA Allegedly Does a Tit-for-Tat
- After NVIDIA, Hacker Group Lapsus$ Targets Samsung, Leaks Stolen Data Online
- Back from “Vacation,” Lapsus$ Leaks 70GB of Globant and Its Clients’ Data
- Lapsus$ Ringleader Breached T-Mobile’s Systems Ahead of Betrayal by Fellow Hackers
