bootloader, bypass, secure boot, uefi, microsoft

Some signed third-party bootloaders for the Unified Extensible Firmware Interface (UEFI) could allow attackers to execute unauthorized code in an early stage of the boot process, before the operating system loads.

Vendor-specific bootloaders used by Windows were found to be vulnerable while the status of almost a dozen others is currently unknown.

Threat actors could exploit the security issue to establish persistence on a target system that cannot be removed by reinstalling the operating system (OS).

Eclypsium security researchers Mickey Shkatov and Jesse Michael discovered vulnerabilities affecting UEFI bootloaders from third-party vendors that could be exploited to bypass the Secure Boot feature on Windows machines.

Secure Boot is part of the UEFI specification designed to ensure that only trusted code – signed with a specific, vendor-supplied certificate – is executed to start the OS booting process.

The firmware bootloader runs immediately after turning on the system to initialize the hardware and to boot the UEFI environment responsible for launching the Windows Boot Manager.

bootloader, bypass, secure boot, uefi, microsoft

Overview of the boot process on UEFI systems source: Microsoft

Eclypsium researchers found that three UEFI bootloaders that were approved by Microsoft had vulnerabilities that permitted bypassing the Secure Boot feature and executing unsigned code:

The three Microsoft-approved UEFI bootloads that were found to bypass the Windows Secure Boot feature and execute unsigned code are:

  • New Horizon Datasys Inc: CVE-2022-34302 (bypass Secure Boot via custom installer)
  • CryptoPro Secure Disk: CVE-2022-34301 (bypass Secure Boot via UEFI Shell execution)
  • Eurosoft (UK) Ltd: CVE-2022-34303 (bypass Secure Boot via UEFI Shell execution)

Microsoft has worked with the last two vendors in the list above and released security update KB5012170 to fix the problem in the provided bootloader.

As part of this fix, Microsoft has blocked all of their required certificates that were issued with the Security Update Release from July 2022.

“This security update addresses the vulnerability by adding the signatures of the known vulnerable UEFI modules to the DBX” – Microsoft

In an advisory this week about the vulnerabilities, the Carnegie Mellon CERT Coordination Center warns that code executed in the early boot stages could “also evade common OS-based and EDR security defenses.”

Carnegie Mellon CERT CC has provided a list with 23 UEFI bootloader vendors, a clear status being available for just three of them: Microsoft (impacted), Phoenix Technologies (not impacted), and Red Hat (not impacted).

The rest of the 20 vendors have also been informed about the issues but it is currently unknown if their products are affected or not.

The list includes names like Acer, AMD, American Megatrends, ASUSTeK, DELL, Google, Hewlett Packard Enterprise, HP, Lenovo, Toshiba, and VAIO Corporation.

A fix for these vulnerabilities should be delivered either by the Original Equipment Manufacturer (OEM) or the OS vendor by updating the UEFI Revocation List – the Secure Boot Forbidden Signature Database (DBX), a database of revoked signatures for previously approved firmware and software that starts systems with UEFI Secure Boot.

TECH NEWS RELATED

How to leave a team on Microsoft Teams

Microsoft’s popular business collaboration platform is a common choice for companies, volunteer projects, and more — especially if you’re already using Office 365 features. The ability to quickly join a group; find the right teams; and start discussion channels, chats, or video is a bonus for all users. Contents How ...

View more: How to leave a team on Microsoft Teams

Microsoft Flight Simulator pilots are flying through Hurricane Ian

Once again the realistic flight sim is giving virtual pilots a safe way to observe an extreme weather event.

View more: Microsoft Flight Simulator pilots are flying through Hurricane Ian

How to change Decimal places in Excel

Depending on what a person is doing in Microsoft Excel, there may come a time when they have to work with decimal places. If this is indeed the case, then one must learn how to change the number of decimal places in an Excel spreadsheet.We should point out that the ...

View more: How to change Decimal places in Excel

How to Easily Work With Excel Tables in the Mobile App

slyellow/Shutterstock.com If you find yourself working on-the-go in the Excel mobile app, you might struggle when it comes to tables. That tiny screen isn’t always sufficient for viewing table data, much less editing it. Luckily, there’s a feature that can help. Microsoft introduced what’s called Cards View for working ...

View more: How to Easily Work With Excel Tables in the Mobile App

Spotify app is automatically getting installed on Windows 10 & Windows 11

According to many users on social media platforms and individual reports received by us, Spotify – the popular streaming app – was automatically installed on Windows 10 and Windows 11 computers without warning. We don’t know if this was an intentional decision by Microsoft or a bug, but the ...

View more: Spotify app is automatically getting installed on Windows 10 & Windows 11

Ubisoft’s biggest 2022 game delayed for sixth time in five years

Other delays out of 2022 leave Ubisoft with an unusually quiet holiday season.

View more: Ubisoft’s biggest 2022 game delayed for sixth time in five years

How to Open .dmg File in Windows

If you have both Windows and Mac devices and use two of them in the course of the day, you might know how difficult it is to transfer files between the devices. Even though there are hundreds of data transfer tools available for both operating systems for file transferring, ...

View more: How to Open .dmg File in Windows

DALL-E 2 AI Image Generator Doesn’t Have a Waitlist Anymore

OpenAI DALL-E 2 is arguably responsible for the booming popularity of AI image generators in 2022. However, it’s been one of the more difficult tools to use. OpenAI has been slowly adding people from a waitlist, but that’s finally over. Starting September 28th, 2022, OpenAI has removed the waitlist ...

View more: DALL-E 2 AI Image Generator Doesn’t Have a Waitlist Anymore

Best Webcam Tips and Tricks for Ultimate Privacy and Security

How to Block Incognito Mode in Google Chrome

Active matter, curved spaces: Mini robots learn to 'swim' on stretchy surfaces

Microsoft Edge Now Gives Desktop Apps a Native Feel

Microsoft Excel: Everything New in September

MESSENGER reveals a more dynamic Mercury surface

Amazon’s New Kindle Scribe Isn’t Just for Reading

Californian Regulator Files Cease-and-Desist Order on 11 Crypto Firms

12 Default Microsoft Excel Settings You Should Change

Xbox Game Pass Will Lose 12 Games On September 30

How to add comments in PowerPoint from Android device

Rumour: Microsoft talking to "major Japanese publishers" about acquisitions

OTHER TECH NEWS

Top Car News Car News