Microsoft's Secure Boot feature, intended to protect systems from malicious code during startup, was effectively compromised for approximately ten years due to vulnerable UEFI shim bootloaders. These vulnerabilities allowed old system images to bypass motherboard-level protection, enabling the execution of dubious code during the boot process. A significant concern is that any malicious firmware installed through this exploit could persist even after the hard drive was swapped or the operating system was reinstalled, rendering the protection largely redundant.
The affected components were UEFI shim bootloaders, initially introduced to extend Secure Boot compatibility to Linux devices. Researchers at ESET identified and reported 11 such vulnerable shims in February. In response, Microsoft has revoked the permissions associated with these specific shims, preventing their further exploitation. Unifying Extensible Firmware Interface (UEFI) is a firmware specification that initializes hardware and transfers control to the operating system. Secure Boot mandates cryptographically signed certificates from UEFI applications before execution to prevent boot kits.
Shims act as intermediaries, enabling communication between a motherboard's UEFI firmware and operating systems like Linux. This allows Linux to boot with Secure Boot enabled without the need to register a specific key for each distribution in the motherboard's NVRAM. Third-party boot components, including these shims, are often signed with the 'Microsoft Corporation UEFI CA 2011' certificate to ensure compatibility with Secure Boot. This issue comes to light not long after other 2011 certificates used by anti-cheat software expired.
The vulnerabilities impacted both Linux and Windows users. The 11 identified shims were part of various software packages, including Linux distributions and PC diagnostic tools. Evidence suggests that malicious actors could have introduced their own copies of these vulnerable shims onto susceptible systems. Microsoft only revoked the permissions for these shims in its June patch release. ESET highlighted that at least one of the reported vulnerabilities was known for a decade, indicating a significant oversight in addressing the issue promptly.