[German]A firmware analysis by security vendor Binarly has revealed that devices from Dell, HP and Lenovo use outdated versions of the OpenSSL encryption library in their UEFI implementations. This poses a risk, as encryption could be broken and the update supply chain compromised. The outdated OpenSSL versions gets onto these machines through an EFI Development Kit (EDK). Currently, however, there doesn't seem to be a solution for how device manufacturers can get a handle on the problem of using up to three outdated (some dating back to 2014) OpenSSL versions even in updated UEFI firmware.
Continue reading →