Microsoft’s Secure Boot has been broken for a decade and no one noticed until now

A critical security flaw has been identified within Microsoft's Secure Boot mechanism, allowing attackers to bypass system protections. According to reports from Ars Technica and The Hacker News, the vulnerability stems from 11 old, Microsoft-signed Linux UEFI shims and forgotten bootloaders. These specific applications were capable of undermining the Secure Boot process on affected devices. The breach remained unnoticed for over ten years, with TechSpot reporting that these bypasses had been hiding in plain sight since 2013. The flaw essentially created a blind spot in the boot process, exposing systems to potential exploitation by hackers using these forgotten, signed bootloaders. Extensive coverage from multiple technical outlets highlights the severity of the discovery. ESET Research is credited by The Manila Times and WeLiveSecurity as the entity that discovered the vulnerable UEFI shims.

Dark Reading and SC Media focus on how these forgotten bootloaders and old Microsoft-signed UEFI applications could be utilized to circumvent security protocols. The reporting emphasizes a significant gap in oversight, as HotHardware explicitly notes that the ability for hackers to bypass Secure Boot had existed for 11 years. The consensus across these outlets is that the vulnerability was a pervasive issue that escaped detection for over a decade despite the ubiquity of the affected software. To understand the context of this event, one must recognize the role of Secure Boot in establishing a chain of trust during the startup process. By using Microsoft-signed shims, the system ensures that only trusted code is executed. However, the existence of old, vulnerable shims meant that an attacker could use a legitimately signed but flawed bootloader to gain unauthorized access. This undermines the primary purpose of UEFI security, which is to prevent unauthorized software from loading before the operating system starts.

The fact that these shims remained valid for so long illustrates a failure in the revocation or updating process of signed boot components over the last decade. Moving forward, users must monitor for specific software updates to mitigate this risk. Neowin reports that Microsoft has released patches to address this major flaw, specifically naming Windows 11 updates KB5101650 and KB5094126. These updates are designed to fix the vulnerabilities that went unnoticed for more than ten years. The immediate priority for administrators and users is the deployment of these specific KB patches to close the Secure Boot blind spot. Future coverage will likely focus on whether these updates successfully revoke the compromised shims across all affected hardware platforms and if any active exploits of these 11 old shims have been detected in the wild.