Blog

This vulnerability got our attention for many reasons: firstly, the vendor agreed on the critical impact; and secondly, the nature of the vulnerability where an unauthenticated user can remotely trigger the code flow with a simple post request and cause the arbitrary code execution over classical stack overflow (CWE-121).

In this video, Kieran Levin, lead system architect at Framework describes how their partnership with Binarly allows them to audit and validate their firmware and software supply chain across ODM and IBV vendors. 

After discovering PKFail, the Binarly REsearch team went on the hunt for other instances of non-production test keys being used in firmware binaries. In this case, non-production test keys were originally generated by reference implementation vendors sitting at the top of the supply chain and then propagated to downstream vendors which often failed to replace them.

In this blog, we dive deeper into newly discovered data points gathered from our free detection service pk.fail and major vendor acknowledgements and developments since the initial disclosure of PKfail in July.

Binarly Unveils Transparency Platform 2.5 with Advanced Reachability Analysis

PKfail is a zero day disclosure detected by the Binarly REsearch Team. PKfail is a firmware supply-chain issue affecting hundreds of device models in the UEFI ecosystem. The problem arises from the Secure Boot "master key," known as the Platform Key (PK) in UEFI terminology, which is untrusted because it is generated by Independent BIOS Vendors (IBVs) and shared among different vendors.

In this follow-up research 6 months after public disclosure of LogoFAIL, we dive deeper into the shallow waters of the firmware supply chain confusion and the blind trust in the reference code and firmware developers. The Binarly Transparency Platform detects unfixed devices daily.

We've incorporated a year of research and feedback into Binarly Transparency Platform v2

Binarly Research Team shows crucial risks that affect security of BMC firmware supply chain ecosystem. We’ve assigned three Binarly identifiers BRLY-2024-002, BRLY-2024-003, BRLY-2024-004

On March 29, right before Easter weekend, we received notifications about something unusual happening with the open-source project XZ Utils, which provides lossless data compression on virtually all Unix-like operating systems, including Linux.

From day one, we founded Binarly to truly solve the software supply chain security problem. It’s become quite clear that existing solutions and approaches aren’t working...

Uncover the UEFI's dark side with a groundbreaking study on Cross-Silicon Exploitation. Explore ARM's impact on UEFI security in this technical dive.

Discover how BINARLY's Research Team is boosting enterprise device security with coordinated disclosures. Stay informed on patching Dell BIOS vulnerabilities.

BINARLY LogoFAIL: Learn how a firmware parser flaw can jeopardize device security.

Uncover the underestimated potency of decades-old attacks on BMC Security. Learn how BINARLY exposes critical risks for remote server control.

LogoFAIL by BINARLY: Discover the impact of image parsing vulnerabilities on system boot. Learn about LogoFAIL risks across UEFI firmware systems. Stay informed!

Discover how BINARLY revolutionized software supply chain protection in 2023 with groundbreaking discoveries like LogoFAIL

LogoFAIL by BINARLY: Discover how vulnerable image parsing impacts device manufacturers in the UEFI firmware ecosystem. Learn about critical LogoFAIL consequences.

Uncover insights into key misuse in integrated firmware images with BINARLY's analysis of Intel's explanation. Discover the impact on the software supply chain.

Uncover Major Vulnerabilities in Supermicro BMCs. Dive into hidden attack surfaces and exploits found by BINARLY REsearch in Supermicro BMC IPMI firmware.