Hackers say Microsoft can’t revoke leaked Secure Boot policies

By: Madeleine Dean
2 minute read

Back in July, we reported that Microsoft had managed to fix a major security vulnerability that would have allowed hackers to unlock Windows RT tablets and run non-Windows operating systems. According to recent reports, it appears the security patch wasn’t that successful, with the vulnerability still able to be exploited.

Microsoft’s firmware incorporates a feature called Secure Boot which allows devices to only boot up operating systems cryptographically signed by the tech giant. The Secure Boot feature is activated during early startup by the Windows boot manager. But there is a way to disable Secure Boot check using a special policy known as “the golden backdoor key”. If users manage to get their hands on this policy and install it on their devices, then the Windows boot manager will boot any operating system they want.

The tech giant is desperately trying to patch this vulnerability, but some hackers say it’s impossible for Microsoft to invalidate the leaked keys.

[…] Either way, it’d be impossible in practice for MS to revoke every bootmgr earlier than a certain point, as they’d break install media, recovery partitions, backups, etc.

This major vulnerability also revives the debate around the secure golden key feature started by intelligence and security services. Long story short, security services have long pushed software giants to implement a secure golden key system that could grant investigators full access to user computers. But such universal keys can easily fall into the wrong hands, as ethical hackers warn:

A backdoor, which MS put in to secure boot because they decided to not let the user turn it off in certain devices, allows for secure boot to be disabled everywhere! You can see the irony. Also the irony in that MS themselves provided us several nice “golden keys” (as the FBI would say 😉 for us to use for that purpose 🙂 About the FBI: are you reading this? If you are, then this is a perfect real world example about why your idea of backdooring cryptosystems with a “secure golden key” is very bad! […] You seriously don’t understand still? Microsoft implemented a “secure golden key” system. And the golden keys got released from MS own stupidity. Now, what happens if you tell everyone to make a “secure golden key” system?

For various PC problems, we recommend to use this tool.

This tool will repair most computer errors, protect you from file loss, malware, hardware failure and optimize your PC for maximum performance. Quickly fix PC issues and prevent others from happening with this software:

  1. Download ReimagePlus (100% safe download and endorsed by us).
  2. Click “Start Scan” to find Windows issues that could be causing PC problems.
  3. Click “Repair All” to fix all issues.

For the time being, Microsoft is silent as always and has yet to issue any comment on this matter.

The entire report published by the two white hat hackers who  investigated this vulnerability is available online.

RELATED STORIES YOU NEED TO CHECK OUT:

For various PC problems, we recommend this tool.

This software will repair common computer errors, protect you from file loss, malware, hardware failure and optimize your PC for maximum performance. Fix PC issues now in 3 easy steps:

  1. Download this PC Repair Tool rated "Excellent" on TrustPilot.com.
  2. Click “Start Scan” to find Windows issues that could be causing PC problems.
  3. Click “Repair All” to fix all issues with Patended Technologies (requires upgrade).

Discussions

Next up

Best Windows 10 antivirus software to use in 2018

By: Radu Tyrsina
7 minute read

Update – 2018 will soon come to an end and we already have a guide on what is the best antivirus you should get in […]

Continue Reading

These features are out for good with Windows 10 version 1809

iamsovy@gmail.com' By: Sovan Mandal
2 minute read

Microsoft is all set to launch its next big update, Windows 10 version 1809 in October. While that should be a nice piece of news […]

Continue Reading

Windows 10 18H2 builds no longer receive new features

By: Matthew Adams
3 minute read

The Windows 10 October 2018 Update (otherwise 18H2) rollout might now be two to three weeks away. For the last few months, new build previews […]

Continue Reading