- Intel confirms that the source code from the Alder Lake processor has been leaked on 4Chan and GitHub repositories.
- The leaked files contain 5.97GB of source code, private keys, files, and change logs, with the latest timestamp 09.30.2022.
- Intel stated that this code is covered under our bug bounty program within the Project Circuit Breaker campaign.
Intel confirmed that source code from the Alder Lake processor has been leaked on the notorious imageboard 4Chan and uploaded by a user named ‘LCFCASD’ to a code repository named ‘ICE_TEA_BIOS’ on GitHub. The repository contained what was described as the ‘BIOS Code from project C970.’ It contains 5.97GB of source code, private keys, files, and change logs. The latest timestamp on the files is 09.30.2022. Experts believe that the incident can have devastating consequences on the chip supply chain.
12th generation processors
The leaked source code is related to Intel’s 12th generation Intel Core processors, released in November of 2021. Intel has confirmed that the leaked source code for the UEFI BIOS of Alder Lake CPUs is authentic with the following statement:
« Our proprietary UEFI code appears to have been leaked by a third party. We do not believe this exposes any new security vulnerabilities as we do not rely on obfuscation of information as a security measure. This code is covered under our bug bounty program within the Project Circuit Breaker campaign, and we encourage any researchers who may identify potential vulnerabilities to bring them our attention through this program. We are reaching out to both customers and the security research community to keep them informed of this situation. »
Although Intel believes that there is nothing to worry about, cybersecurity researchers state that the leaked source code allows attackers to find vulnerabilities that can be exploited. Source codes are also considered the most important part of a company’s intellectual property. Also, it seems like Intel doesn’t know who is behind the incident.
Due to the recent situation in the semiconductor market, some experts also claim that it can be a state-sponsored attack and the attackers may have stolen more than what is leaked online. In recent years, semiconductor companies became one of the most popular targets of cybercriminals.