Platform certificates used to sign malware
My understanding is that these certs are vendor-specific (and potentially more finely grained than that - I think it&#x27;d be fine to have a separate cert per model, for instance) and are rooted in the firmware, not the hardware - that is, it&#x27;s not the secure boot signing key, and a new firmware update can simply use a different platform certificate.<p>Having said that, the fact that there appear to be multiple vendors affected by this (looking at those hashes in Virustotal, there are signatures that claim to be owned by Samsung, LG, and Mediatek, at least), and that&#x27;s certainly concerning. My entirely unsupported guess is that they may all share manufacturing for some models, and certificates may have been on site there?<p>But the more significant question is how many phones trust these certificates. As I mentioned before, these could be model specific, and any leaked certificates could be tied to a very small number of phones. Or maybe Samsung used the same platform cert for all phones manufactured in the past decade, and that would be a much larger problem. With the information presently available we simply don&#x27;t know how big a deal this is.<p>Edit to add: given Mediatek certs appear here, and given all the vendors linked to this have shipped low-end phones based on Mediatek SoCs, it wouldn&#x27;t surprise me if it turns out Mediatek were the source.