Secure Boot Deadline Looms: Windows and Linux Users Must Update Cryptographic Keys

A critical deadline is approaching for Windows and Linux users to update their systems' cryptographic keys, which protect against firmware-based UEFI infections. On June 24, three Microsoft-signed certificates that verify the trustworthiness of firmware and software during system boot will expire. These certificates are the foundation of Secure Boot, a chain of trust designed to prevent UEFI bootkits from loading malicious firmware. UEFI bootkits are a type of malware that can alter the Unified Extensible Firmware Interface, loading before the operating system and antimalware protections start.

They can be difficult to detect and can reinfect a system even after the OS has been disinfected. The history of bootkits dates back to the 1980s, with early examples targeting Apple II machines. In recent years, more sophisticated UEFI bootkits have been discovered, including LoJax and MosaicRegressor. In response to these threats, Microsoft developed Secure Boot, which uses cryptographic signatures to ensure that only trusted firmware is loaded during startup.

However, the discovery of the LogoFail vulnerability in 2023 required Microsoft to replace the existing cryptographic signatures with new ones. Windows and Linux users must update their systems to ensure they remain protected against UEFI threats. Users can check the status of their Secure Boot keys on Windows machines by opening the Windows Security settings, and Linux users should watch for the release of new shims. Microsoft recommends staying current with all firmware updates to ensure a smooth update process.

Source: Wired