- Published on
Microsoft’s Secure Boot has been broken for a decade and no one noticed until now
- Authors
- Name
- DeepHorus
Microsoft's Secure Boot, an industry-standard protection embedded in Windows and Linux devices, has been trivially bypassable for 13 of its 14 years of existence, researchers at security firm ESET revealed Tuesday. The discovery stems from 11 firmware images, known as shims, that were signed by Microsoft despite being known as defective since at least 2013. These shims, originally created to extend Secure Boot to Linux devices and utility software, can be exploited by novice hackers using a simple technique to completely circumvent the UEFI (Unified Extensible Firmware Interface) protection.
Secure Boot was introduced in 2012 to defend against bootkits—malicious firmware that loads early in the boot process and persists even after an operating system is reinstalled or a hard drive is replaced. Without Secure Boot, attackers with brief physical access to a device can install bootkits like LoJax, MosaicRegressor, CosmicStrand, or BlackLotus, which have been used by state-sponsored hackers in recent years. ESET's findings show that Microsoft's oversight in failing to revoke these old, publicly available shims has left a decade-long gap in security.
ESET researchers identified 11 firmware images, with the oldest dating back to 2013, that remained signed by Microsoft despite known vulnerabilities. The bypass technique requires no novel exploitation; attackers only need a copy of an old, still-trusted shim binary and a basic understanding of UEFI shims. This simplicity makes the threat accessible to a wide range of malicious actors, endangering both Windows and Linux users.
The implications are severe: an attacker can subvert the mandated chain of digitally signed firmware to install malicious firmware that boots early and survives OS reinstalls or hard drive replacements. This undermines one of the foundational security features of modern computing. The list of in-the-wild bootkits, including ESpecter, FinSpy, and MoonBounce, highlights the real-world risk.
ESET researcher Martin Smolár emphasized that no new vulnerability is needed—just an old, unrevoked binary. “What makes these old shims dangerous is not a novel vulnerability,” he wrote. “It’s that no new vulnerability is needed to bypass UEFI Secure Boot.” He noted that basic understanding of how UEFI shims work is sufficient to bypass this essential security feature.
Microsoft has not yet publicly commented on the findings, but the onus is on the company to revoke the defective shims and implement a more robust process for signing firmware. Users are advised to keep their systems updated and apply any firmware patches released by manufacturers. The discovery underscores the challenge of maintaining security over long periods and the need for constant vigilance in firmware management.
Moving forward, this incident may prompt a reevaluation of how signing authorities handle legacy firmware. ESET's research calls for a proactive approach to revoking known vulnerabilities, as even old, forgotten code can pose a significant threat. For now, the security community awaits Microsoft’s response and hopes for swift action to close this decade-old loophole.
