Exploiting signed bootloaders to circumvent UEFI Secure Boot

guest · Apr 1, 2019

Exploiting signed bootloaders to circumvent UEFI Secure Boot
April 1, 2019
https://habr.com/en/post/446238/

I wanted to make a bootable USB flash drive with various computer recovery software that would boot without disabling Secure Boot. Let's see how this can be achieved.
Signed bootloaders
I was wondering is it possible to bypass first boot key enrollment through shim. Could there be some signed bootloaders that allow you to do more than the authors expected?
[...]
As it turned out—there are such loaders. One of them is used in Kaspersky Rescue Disk 18—antivirus software boot disk. GRUB from the disk allows you to load modules (the insmod command), and module in GRUB is just an executable code. The pre-loader on the disk is a custom one.

There are two ways to create a universal bootable flash drive that would not require adding the keys of each executable file to the trusted files: [...] This is how Super UEFIinSecureBoot Disk has been made. [...]
Click to expand...

The end
In this article we proved the existence of not enough reliable bootloaders signed by Microsoft key, which allows booting untrusted code in Secure Boot mode.

Using signed Kaspersky Rescue Disk files, we achieved a silent boot of any untrusted .efi files with Secure Boot enabled, without the need to add a certificate to UEFI db or shim MOK.
These files can be used both for good deeds (for booting from USB flash drives) and for evil ones (for installing bootkits without computer owner consent).
Click to expand...

EASTER · Apr 1, 2019

Thanks for the link.

Log in or Sign up

Exploiting signed bootloaders to circumvent UEFI Secure Boot

guest Guest

EASTER Registered Member

Log in or Sign up

Exploiting signed bootloaders to circumvent UEFI Secure Boot

guest Guest

EASTER Registered Member

Useful Searches