Microsoft's Secure Boot, an industry-wide standard designed to protect Windows and Linux devices from firmware infections, has been vulnerable to bypasses for over a decade. This security flaw, uncovered by researchers at ESET, highlights a critical issue with the complex and poorly managed revocation process of 'shims' - secondary trust anchors signed by Microsoft. These shims, used to extend Secure Boot to Linux and utility software, can be exploited by novice hackers to subvert the mandated chain of digitally signed firmware. The threat extends to both Windows and Linux users, as the shim can be installed on devices running either operating system. The vulnerability lies in Microsoft's failure to revoke publicly available, defective shims, which were signed by the company despite known vulnerabilities. This lapse has allowed attackers to bypass Secure Boot, a mechanism designed to protect against bootkits and other malicious firmware. The complexity of Secure Boot's revocation process, involving multiple databases and version-based revocation methods, has contributed to the oversight. The affected shims authorize vulnerable components, such as the Oracle shim, which signs a binary vulnerable to CVE-2015-5381. This vulnerability can be exploited with low skill, and the affected shims fail to support critical protections introduced after their release. The issue is further exacerbated by the expiration of Microsoft's certificate, which is insufficient to revoke the defective shims. The complexity of the Secure Boot model and Microsoft's role as the de facto root of trust have been criticized by experts, who argue that the ecosystem is broken and requires a reboot. This discovery underscores the need for improved management and transparency in the revocation process of shims to ensure the security of Windows and Linux devices.
