this post was submitted on 18 Jan 2025
196 points (99.5% liked)

PC Gaming

9118 readers
751 users here now

For PC gaming news and discussion. PCGamingWiki

Rules:

  1. Be Respectful.
  2. No Spam or Porn.
  3. No Advertising.
  4. No Memes.
  5. No Tech Support.
  6. No questions about buying/building computers.
  7. No game suggestions, friend requests, surveys, or begging.
  8. No Let's Plays, streams, highlight reels/montages, random videos or shorts.
  9. No off-topic posts/comments, within reason.
  10. Use the original source, no clickbait titles, no duplicates. (Submissions should be from the original source if possible, unless from paywalled or non-english sources. If the title is clickbait or lacks context you may lightly edit the title.)

founded 2 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
196
New UEFI vulnerability bypasses Secure Boot — bootkits stay undetected even after OS re-install (www.tomshardware.com)
submitted 2 weeks ago by [email protected] to c/[email protected]
43 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 9 points 1 week ago

They don’t even have to be signed…

Yeah. My understanding is that Microsoft has signed several tools made by other companies that boot as UEFI PE executables and aren't supposed to allow loading arbitrary (including unsigned and malicious) UEFI PE binaries, but due to security vulnerabilities in the tool, they'll load any old UEFI PE binary you give them.

The payload/malicious UEFI PE binaries don't have to be signed. But the third-party tools that contain the vulnerabilities have to be signed by a signer your UEFI firmware trusts. (And the tools are signed by Microsoft, which your UEFI firmware almost definitely trusts, unless you've already applied a fix).

(And I don't know exactly what sort of tools they are. Maybe they're like UEFI Shell software or something? Not sure. Not sure it matters that much for purposes of understanding the impact or remediation strategy for this vulnerability.)

The fix, I'd imagine is:

  • Everyone should untrust the certificates used to sign those vulnerable tools. (And by "untrust", I really mean they need to apply the revocations.)
  • Microsoft needs to issue new certificates to replace the ones with which they signed the vulnerable tools.
  • The companies who made those tools need to release new, fixed, not-vulnerable versions of the same tools.
  • ...and get Microsoft to sign those new versions with the replacement keys.
  • And users need to migrate from the vulnerable versions to the new versions of the tools in question.

Now, I'm not 100% sure if there needs to be yet another step in there where individual users explicitly install/trust the replacement certs. Those replacement certs are signed by Microsoft's root certificate, right? As long as all the certificates in the chain from the root certifcate down to the signature are included with the UEFI PE binary, the firmware should be able to verify the new binary? Or maybe having chains of certs is not how UEFI PE binaries work. Not sure.

Here is an example of something similar that disables Windows Platform Binary Table…(I’m not advocating that anybody actually use this).

Yuck. Thanks for letting me know of that. I'm still firmly in the "learning" phase when it comes to this UEFI stuff. It's good to be aware of this.