Security researchers at ESET identified a significant vulnerability in Microsoft’s Secure Boot mechanism that has existed for the majority of its 14-year history. The researchers discovered 11 firmware images known as shims that were vulnerable to bypass techniques but remained signed and trusted by Microsoft despite being publicly known as defective. Some of these shims dated back to 2013, meaning the vulnerability persisted for more than a decade without being addressed.
Shims are secondary components designed to extend Secure Boot protections to Linux devices and utility software. An attacker with basic technical knowledge can use one of these old, still-trusted shims to completely circumvent Secure Boot protections embedded in device motherboards. Once bypassed, Secure Boot can no longer prevent the installation of malicious firmware that executes during the boot process and persists even after operating system reinstallation or hard drive replacement. Both Windows and Linux devices running these shims are vulnerable to such attacks.
Secure Boot was introduced in 2012 to defend against bootkits, which are firmware-level malicious programs capable of infecting devices with brief physical access. The protection works through a chain of digitally signed components, with Microsoft’s signature serving as the foundation of trust. When vulnerabilities are discovered in shims, Microsoft is responsible for revoking them to prevent their use. However, the company failed to revoke the 11 identified shims despite their known defects, a lapse Microsoft has not yet publicly explained.
The complexity of Secure Boot’s implementation likely contributed to this oversight. The system uses multiple revocation mechanisms including certificate revocation lists and version-based targeting methods to manage the large number of Linux components involved in the boot process. The revocation process involves embedded metadata, generation numbers, and policy mechanisms that interact in intricate ways. Microsoft finally revoked the vulnerable shims in its June patch release after ESET informed the company and CERT about the issue.
Security experts have characterized the discovery as a fundamental critique of the Secure Boot model itself, pointing to its complexity, Microsoft’s role as the de facto root of trust for all UEFI platforms, and the difficulty in managing and revoking the numerous signed components within the system. Windows users who installed the June update are no longer vulnerable, while Linux users are advised to check revocation statuses through the Linux Vendor Firmware Service or their distributor.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI