Microsoft Secure Boot Vulnerability Existed for 13 Years

Microsoft's Secure Boot, a standard designed to protect Windows and Linux devices from firmware infections, has been found to be trivially bypassable for 13 of its 14 years of existence. Security researchers at ESET discovered this vulnerability after identifying 11 firmware images, with at least one dating back to 2013, that were known to be defective yet were still signed by Microsoft. These images, known as shims, were created to extend Secure Boot's protection to Linux devices and utility software. The technique to exploit these old shims is simple enough for novice hackers to use, allowing them to completely circumvent the protection embedded within a device's UEFI (Unified Extensible Firmware Interface). The core issue stems from Microsoft's failure to revoke publicly available shims after vulnerabilities were discovered in them. This oversight means the threat extends to both Windows and Linux users, as the compromised shim can be installed on devices running either operating system. Once installed, an attacker can subvert the chain of digitally signed firmware to introduce malicious firmware that loads early in the boot process. This malicious firmware can persist even after the operating system is reinstalled or the hard drive is replaced, posing a significant and long-standing security risk.