StageSeed VC | Alive
Last Raised$3.6M | 1 yr ago
Mosaic Score The Mosaic Score is an algorithm that measures the overall financial health and market potential of private companies.
+20 points in the past 30 days
Binarly offers an AI-powered platform to protect devices against emerging firmware threats. The platform performs in-depth introspection of firmware and uses proprietary machine learning and code analysis techniques to find known and unknown threats and vulnerabilities. The platform is designed primarily for cloud providers and data centers, large enterprises, and hardware manufacturers. The company was founded in 2021 and is based in Pasadena, California.
Missing: Binarly's Product Demo & Case Studies
Promote your product offering to tech buyers.
Reach 1000s of buyers who use CB Insights to identify vendors, demo products, and make purchasing decisions.
Missing: Binarly's Product & Differentiators
Don’t let your products get skipped. Buyers use our vendor rankings to shortlist companies and drive requests for proposals (RFPs).
Expert Collections containing Binarly
Expert Collections are analyst-curated lists that highlight the companies you need to know in the most important technology spaces.
Binarly is included in 2 Expert Collections, including Cybersecurity.
This collection includes startups selling AI SaaS, using AI algorithms to develop their core products, and those developing hardware to support AI workloads.
Latest Binarly News
May 11, 2023
With no easy way to revoke compromised key, MSI is in a real pickle. A ransomware intrusion on hardware manufacturer Micro-Star International, better known as MSI, is stoking concerns of devastating supply chain attacks that could inject malicious updates that have been signed with company signing keys that are trusted by a huge base of end-user devices, a researcher said. “It’s kind of like a doomsday scenario where it’s very hard to update the devices simultaneously, and they stay for a while not up to date and will use the old key for authentication,” Alex Matrosov, CEO, head of research and founder of security firm Binarly, said in an interview. “It’s very hard to solve, and I don’t think MSI has any backup solution to actually block the leaked keys.” Leaked key + no revocation = recipe for disaster The intrusion came to light in April when, as first reported by Bleeping Computer, the extortion portal of the Money Message ransomware group listed MSI as a new victim and published screenshots purporting to show folders containing private encryption keys, source code, and other data. A day later, MSI issued a terse advisory saying that it had “suffered a cyberattack on part of its information systems.” The advisory urged customers to get updates from the MSI website only. It made no mention of leaked keys. Since then, Matrosov has analyzed data that was released on the Money Message site on the dark web. To his alarm, included in the trove were two private encryption keys. The first is the signing key that digitally signs MSI firmware updates to cryptographically prove that they are legitimate ones from MSI rather than a malicious impostor from a threat actor. This raises the possibility that the leaked key could push out updates that would infect a computer’s most nether regions without triggering a warning. To make matters worse, Matrosov said, MSI doesn’t have an automated patching process the way Dell, HP, and many larger hardware makers do. Consequently, MSI doesn’t provide the same kind of key revocation capabilities. Advertisement “It’s very bad, it doesn't frequently happen,” he said. “They need to pay a lot of attention to this incident because there are very serious security implications here.” Adding to the concern, MSI to date has maintained radio silence on the matter. Company representatives didn't respond to emails seeking comment and asking if the company planned to issue guidance to its customers. Further Reading Over the past decade, supply chain attacks have delivered malicious payloads to thousands of users in a single incident when the victims did nothing other than install a validly signed update. The 2019 compromise of the software build and distribution system for SolarWinds, a cloud-based network management service. With control of the private key used to certify legitimate updates, the Kremlin-backed hacking unit known as APT29 and Cozy Bear, believed to be part of Russia’s Foreign Intelligence Service, infected more than 18,000 customers with a first stage of malware. Ten federal agencies and about 100 private companies received follow-on payloads that installed backdoors for use in espionage. In March, telephony company 3CX, maker of popular VoIP software used by more than 600,000 organizations in 190 countries, disclosed a breach of its build system. The hackers behind that intrusion, who work on behalf of the North Korean government, according to researchers, used their foothold to deliver malicious updates to an unknown number of customers. Security firm Mandiant later reported that the compromise of 3CX resulted from it being infected through a supply chain attack on software developer Trading Technologies, maker of the X_Trader financial trading program 3CX used. There are no reports of any supply chain attacks targeting MSI customers. Gaining the kind of control required to compromise a software build system is generally a non-trivial event that requires a great deal of skill and possibly some luck. Because MSI doesn’t have an automated update mechanism or a revocation process, the bar would probably be lower, though. Whatever the difficulty, possession of the signing key MSI uses to cryptographically verify the authenticity of its installer files significantly lowers the effort and resources required to pull off an effective supply chain attack. “The worst scenario is if the attackers gain not only access to the keys but also can distribute this malicious update [using those keys]," Matrosov said. Advertisement In an advisory , the Netherlands-based National Cybersecurity Center didn’t rule out the possibility. “Because successful abuse is technically complex and in principle requires local access to a vulnerable system, the NCSC considers the risk of abuse to be small,” NCSC officials wrote. “However, it is not inconceivable that the leaked keys will be misused in targeted attacks. The NCSC is not yet aware of any indications of misuse of the leaked key material.” Compounding the threat, the Money Message hackers also acquired a private encryption key used in a version of the Intel Boot Guard that MSI distributes to its customers. Many other hardware makers use different keys that aren’t affected. In an email, an Intel spokesperson wrote: Intel is aware of these reports and actively investigating. There have been researcher claims that private signing keys are included in the data including MSI OEM Signing Keys for Intel BootGuard. It should be noted that Intel BootGuard OEM keys are generated by the system manufacturer, and these are not Intel signing keys. Far-reaching access Intel Boot Guard is built into modern Intel hardware and is designed to prevent the loading of malicious firmware usually in the form of a UEFI bootkit. This malware resides in silicon embedded into a motherboard, is difficult, if not impossible, to detect, and is the first thing to execute each time a computer is switched on. UEFI infections allow malware to be loaded before the operating system begins running, making it possible to bypass protections and better hide from security endpoint protection. Possession of both keys further ratchets up the threat in a worst-case scenario. Wednesday’s advisory from the NCSC explained: Intel Boot Guard is technology developed by Intel. Intel Boot Guard verifies that a motherboard's firmware has been digitally signed by the vendor during a system's boot process. The leak of MSI's Intel Boot Guard and firmware keys enables an attacker to self-sign malicious firmware. An attacker with (in principle local) access to a vulnerable system can then install and run this firmware. This gives the attacker far-reaching access to the system, bypassing all overlying security measures. For example, the attacker gains access to data stored on the system or can use the access to carry out further attacks. Chip manufacturer Intel has informed the NCSC that the leaked private keys are MSI-specific and can therefore only be used for MSI systems. However, MSI motherboards may be incorporated into products from other vendors. As a result, abuse of the leaked keys may also take place on these systems. See "Possible Solutions" for more information on affected systems. For now, people using affected hardware—which so far seems to be limited only to MSI customers or possibly third parties that resell MSI hardware—should be extra wary of any firmware updates, even if they are validly signed.
Binarly Frequently Asked Questions (FAQ)
When was Binarly founded?
Binarly was founded in 2021.
Where is Binarly's headquarters?
Binarly's headquarters is located at 401 E California Blvd, Pasadena.
What is Binarly's latest funding round?
Binarly's latest funding round is Seed VC.
How much did Binarly raise?
Binarly raised a total of $3.6M.
Who are the investors of Binarly?
Investors of Binarly include Michael Sutton, Bryson Bort, Acrobator Ventures, Chris Ueland, Ryan Permeh and 7 more.
Discover the right solution for your team
The CB Insights tech market intelligence platform analyzes millions of data points on vendors, products, partnerships, and patents to help your team find their next technology solution.