Microsoft's Secure Boot, an industry-wide standard designed to protect Windows and Linux devices from firmware infections, has been vulnerable to bypasses for over a decade. This critical flaw, discovered by researchers at ESET, highlights a significant oversight in Microsoft's management of 'shims' - secondary trust anchors that extend Secure Boot to Linux and utility software. The issue lies in the failure to revoke publicly available, defective shims, which can be exploited by novice hackers to circumvent Secure Boot's protection mechanisms. This vulnerability affects both Windows and Linux users, as the shim can be installed on devices running either operating system, allowing attackers to install malicious firmware that persists after OS reinstallation or hard drive replacement.
The complexity of Secure Boot's revocation process, involving multiple databases and version-based targeting, has contributed to the lapse in security. Microsoft's reliance on SBAT (Secure Boot Advanced Targeting) and Secure Boot Security Version Number (SVN) further complicates the situation, as these methods are not sufficient to revoke all vulnerable shims. The Oracle shim, for instance, signs a binary vulnerable to CVE-2015-5381, and other shims fail to support critical protections introduced after their release.
This discovery raises concerns about the effectiveness of Secure Boot as a security mechanism. HD Moore, a firmware security expert, criticizes Microsoft's role as the de facto root of trust for the UEFI platform, the inability of Secure Boot to scale sufficiently, and the ability of components to boot even after top-level certificates expire. The complexity of the system and the oversight in shim management have led to a situation where Secure Boot is effectively bypassed, undermining its intended purpose.
The implications of this vulnerability are significant, as it allows attackers to install bootkits and other malicious firmware, posing a threat to the security of Windows and Linux devices. Users are advised to check for revocation statuses and update their systems accordingly to mitigate the risk. This incident serves as a reminder of the importance of robust security practices and the need for continuous vigilance in the face of evolving threats.
