Forgotten Bootloaders Expose Secure Boot Blind Spot

Researchers recently discovered 11 vulnerable but still trusted UEFI shim bootloaders that attackers could have used to bypass Secure Boot on systems that trust Microsoft's third-party UEFI signing certificate. The Unified Extensible Firmware Interface (UEFI) consists of motherboard software that connects that operating system and hardware. Microsoft revoked the vulnerable bootloaders in June through Secure Boot revocation updates after ESET reported the findings, but unpatched systems may continue to trust the components and remain exposed to boot-level attacks. A shim bootloader is a small program launched by Unified Extensible Firmware Interface (UEFI) firmware on Secure Boot-enabled systems that acts as a bridge between the firmware and the operating system bootloader. In Linux environments, shims allow Linux distributions to boot on Secure Boot-enabled UEFI systems by serving as a trusted first-stage bootloader that verifies and launches the rest of the Linux boot process. As ESET explained in a report this week, a UEFI shim bootloader is "a small, minimal first-stage bootloader that Microsoft can vet and sign once, and which then creates a secondary trust anchor for the rest of the Linux distribution-specific boot stack — usually GRUB 2 and the Linux kernel." Shims eliminate the need for Microsoft to sign every Linux bootloader, while maintaining the integrity of the Secure Boot trust chain. The 11 shim bootloaders ESET discovered were version 0.9 or earlier, placing th...