Inertia War is a personal site whose notable piece covers Intel CPU microcode updates, written by Ben Hawkes of Google Project Zero.
HN links its microcode notes as the best public discussion of the update format, including the RSA signing and encryption of updates.
The microcode updates that people have been mentioning are not updates to your motherboard's firmware, EFI or otherwise. They are updates to the code that runs inside your central processor chip, the so-called microcode, that does the work of understanding and enacting processor instructions (in all programs, from the programs in your firmware to the programs that you download and run from the WWW).
Firmware updates are largely irrelevant to this issue, only being involved in the sense that one way to perform microcode updates is for your machine's firmware to upload the new microcode image file. But that is just one way for that to be done; your operating system can do it, too.
* http://inertiawar.com/microcode/
* https://news.ycombinator.com/item?id=16081366
* https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analysis-of-Speculative-Execution-Side-Channels.pdf (https://news.ycombinator.com/item?id=16079910)
I think they are mostly undocumented, but here is some research I found online: http://inertiawar.com/microcode/
I'm guessing the private RSA keys are extremely well guarded, probably stored in a HSM that only allows signing, not key extraction, so that the keys cannot even be revealed to Intel.
On the other hand, who knows. There's certainly been cases of code signing keys on the loose (Adobe, etc) and even a compromised HSM host (Fedora, someone managed to sign compromised openssh .rpms)
> But if you have a way to pop the machine into redstate you can exfiltrate the secret key and actually sign microcode changes that will be accepted as legit.
No. The article mentions that the key required to decrypt microcode updates can be extracted. http://inertiawar.com/microcode/ indicates that the encrypted microcode image is also signed, and being able to decrypt the image doesn't mean you can also generate an appropriate signature.
Ben Hawkes from Google Project Zero has an excellent blog post on Intel CPU Microcode:
http://www.inertiawar.com/microcode/
He even extracted and posted the RSA public keys used to verify the microcode. Though he later removed them, they're still available on the internet archive:
https://web.archive.org/web/20140403200048/http://inertiawar.com/microcode/microcode_rsa_modulus.txt
SMM and closed source hardware drivers means that it can happen from anywhere. I wouldn't be surprised but I would be surprised that nobody has bothered doing deep inspection of network packets or Microsoft binaries since the time when Microsoft doing an update without asking a user was considered a big deal... Now nobody cares about that.
http://inertiawar.com/microcode/
microcode updates are volatile - after a reboot the CPU is back to its programmed state. BIOS installs updates (which is why some CPU bugs are fixable by BIOS updates), and the OS can do this, too: Linux has drivers to update microcode on CPUs. The microcode files comes from Intel and are mostly incomprehensible blobs (see http://inertiawar.com/microcode/)