news
'Secure' Boot Redundant and Only a Net Loss for Security
-
Security Week ☛ Old UEFI Shims Expose Systems to Secure Boot Bypass
Signed by Microsoft, the vulnerable UEFI shim bootloaders could be abused on any system, regardless of the OS.
-
Secure Boot vulnerability put Windows and Linux users at risk for ten years
Software development, much like making a stew that's a perfect umami bomb in every bite, is a tricky business. Every major commercial product is touched by many hands, and sometimes the chefs leave cardamom and bay leaves in the mix. Okay, perhaps I've overstretched the metaphor—what you need to know is that apparently Microsoft's Secure Boot was basically busted for the last decade.
Rather than leftover bones in the broth, old system images could be exploited to bypass a system's motherboard-level protection to execute dubious code during system boot. It's bad enough that this effectively makes Secure Boot redundant, but worse still, any malicious firmware installed this way could then survive swapping out the hard drive or persist past reinstalling your operating system.