https://arstechnica.com/security/2025/01/microsoft-patches-windows-to-eliminate-secure-boot-bypass-threat/ Skip to content Ars Technica home Sections Forum Subscribe * AI * Biz & IT * Cars * Culture * Gaming * Health * Policy * Science * Security * Space * Tech * Feature * Reviews * Store * AI * Biz & IT * Cars * Culture * Gaming * Health * Policy * Science * Security * Space * Tech Forum Subscribe Story text Size [Standard] Width * [Standard] Links [Standard] * Subscribers only Learn more Pin to story Theme * HyperLight * Day & Night * Dark * System Search dialog... Sign In Sign in dialog... Sign in CHAIN OF TRUST RESTORED Microsoft patches Windows to eliminate Secure Boot bypass threat File that neutered Secure Boot passed Microsoft's internal review process. Dan Goodin - Jan 16, 2025 8:24 am | 24 [exploit-vulnerability-security-1-300x169] [exploit-vulnerability-security-1] Credit: Getty Images Credit: Getty Images Text settings Story text Size [Standard] Width * [Standard] Links [Standard] * Subscribers only Learn more Minimize to nav For the past seven months--and likely longer--an industry-wide standard that protects Windows devices from firmware infections could be bypassed using a simple technique. On Tuesday, Microsoft finally patched the vulnerability. The status of Linux systems is still unclear. Tracked as CVE-2024-7344, the vulnerability made it possible for attackers who had already gained privileged access to a device to run malicious firmware during bootup. These types of attacks can be particularly pernicious because infections hide inside the firmware that runs at an early stage, before even Windows or Linux has loaded. This strategic position allows the malware to evade defenses installed by the OS and gives it the ability to survive even after hard drives have been reformatted. From then on, the resulting "bootkit" controls the operating system start. In place since 2012, Secure Boot is designed to prevent these types of attacks by creating a chain-of-trust linking each file that gets loaded. Each time a device boots, Secure Boot verifies that each firmware component is digitally signed before it's allowed to run. It then checks the OS bootloader's digital signature to ensure that it's trusted by the Secure Boot policy and hasn't been tampered with. Secure Boot is built into the UEFI--short for Unified Extensible Firmware Interface--the successor to the BIOS that's responsible for booting modern Windows and Linux devices. An unsigned UEFI app lurks Last year, researcher Martin Smolar with security firm ESET noticed something curious about SysReturn, a real-time system recovery software suite available from Howyar Technologies. Buried deep inside was an XOR-encoded UEFI application named reloader.efi, which was digitally signed after somehow passing Microsoft's internal review process for third-party UEFI apps. Rather than invoking the UEFI functions LoadImage and StartImage for performing the Secure Boot process, reloader.efi used a custom PE loader. This custom loader didn't perform the required checks. As Smolar dug further, he found that reloader.efi was present not only in Howyar's SysReturn, but also in recovery software from six other suppliers. The complete list is: * Howyar SysReturn before version 10.2.023_20240919 * Greenware GreenGuard before version 10.2.023-20240927 * Radix SmartRecovery before version 11.2.023-20240927 * Sanfong EZ-back System before version 10.3.024-20241127 * WASAY eRecoveryRX before version 8.4.022-20241127 * CES NeoImpact before version 10.1.024-20241127 * SignalComputer HDD King before version 10.3.021-20241127 The threat posed wasn't limited to devices that had one of the vulnerable system recovery packages installed. Attackers who had already gained administrative control over a Windows device could simply install reloader.efi and, because of the digital signature in the OS, use it to install malicious firmware during boot up. On Tuesday, Microsoft finally neutralized the threat by updating Windows to remove the signature. In 2022 security firm Eclypsium identified three prominent software drivers signed by Microsoft that could be used to bypass secure boot. In a post, Smolar wrote: This raises questions of how common the use of such unsafe techniques is among third-party UEFI software vendors, and how many other such obscure, but signed, bootloaders there might be out there. We reached out to Microsoft about the situation, hoping it could bring more transparency into what third-party UEFI applications they sign, so that anyone can quickly discover and report such obviously unsafe UEFI applications if they mistakenly pass (or passed a long time ago) Microsoft's UEFI third-party code-signing review. We believe that Microsoft's planned rollout of new UEFI certificates provides a great opportunity to make this happen, pushing UEFI third-party signing transparency and UEFI security one step forward. ESET reported the vulnerability to the CERT Coordination Center last June. It's unclear why Microsoft didn't issue a patch until this week. It's also not yet clear if Linux systems were also vulnerable and, if so, whether a patch has been issued. Red Hat, Suse, and Ubuntu didn't immediately answer questions sent by email. Photo of Dan Goodin Dan Goodin Senior Security Editor Dan Goodin Senior Security Editor Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82. 24 Comments Staff Picks mygeek911 mygeek911 If you are interested in checking your systems (Windows or Linux), you can follow the guidelines from WeLiveSecurity.com. Use the following PowerShell commands (run with elevated permissions) to check whether you're affected by the vulnerability and if the necessary revocations were installed on your system: # UEFI systems; returns True if your system is affected by the CVE-2024-7344 [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft Corporation UEFI CA 2011' # 64-bit UEFI systems; returns True if you're protected (the vulnerable driver is revoked on your system) [BitConverter]::ToString((Get-SecureBootUEFI dbx).bytes) -replace '-' -match 'cdb7c90d3ab8833d5324f5d8516d41fa990b9ca721fe643fffaef9057d9f9e48' # 32-bit UEFI systems; returns True if you're protected (the vulnerable driver is revoked on your system) [BitConverter]::ToString((Get-SecureBootUEFI dbx).bytes) -replace '-' -match 'e9e4b5a51f6a5575b9f5bfab1852b0cb2795c66ff4b28135097cba671a5491b9' For Linux systems, updates should be available through the Linux Vendor Firmware Service. Use the following commands to check whether the necessary revocations are installed on your system: dbxtool --list | grep 'cdb7c90d3ab8833d5324f5d8516d41fa990b9ca721fe643fffaef9057d9f9e48' dbxtool --list | grep 'e9e4b5a51f6a5575b9f5bfab1852b0cb2795c66ff4b28135097cba671a5491b9' January 16, 2025 at 1:58 pm M Matthew J. If you are interested in checking your systems (Windows or Linux), you can follow the guidelines from WeLiveSecurity.com. Uggh. I just ran these on my win 10 & win 11 systems, both are showing vulnerable (first check) and unprotected (driver is not revoked). And Windows Update has nothing for me--on either system. I guess we just wait? Some more? January 16, 2025 at 2:23 pm Comments Forum view Loading Loading comments... Prev story Next story Most Read 1. Listing image for first story in Most Read: Blue Origin reaches orbit on first flight of its titanic New Glenn rocket 1. Blue Origin reaches orbit on first flight of its titanic New Glenn rocket 2. 2. Civilization VII preview: The most complete package since IV 3. 3. ChargePoint develops uncuttable charging cables to stop thieves 4. 4. A NASA astronaut may have just taken the best photo from space--ever 5. 5. It's official: Take a first look at the Switch 2 Customize Ars Technica has been separating the signal from the noise for over 25 years. With our unique combination of technical savvy and wide-ranging interest in the technological arts and sciences, Ars is the trusted source in a sea of information. After all, you don't need to know everything, only what's important. More from Ars * About Us * Staff Directory * Newsletters * Ars Videos * General FAQ * RSS Feeds Contact * Contact us * Advertise with us * Reprints Do Not Sell My Personal Information (c) 2025 Conde Nast. All rights reserved. Use of and/or registration on any portion of this site constitutes acceptance of our User Agreement and Privacy Policy and Cookie Statement and Ars Technica Addendum and Your California Privacy Rights. Ars Technica may earn compensation on sales from links on this site. Read our affiliate link policy. The material on this site may not be reproduced, distributed, transmitted, cached or otherwise used, except with the prior written permission of Conde Nast. Ad Choices