MSI accidentally breaks Secure Boot for hundreds of motherboards

guest · Jan 18, 2023

By Bill Toulas @billtoulas - January 16, 2023

Over 290 MSI motherboards are reportedly affected by an insecure default UEFI Secure Boot setting settings that allows any operating system image to run regardless of whether it has a wrong or missing signature.
Click to expand...

This discovery comes from a Polish security researcher named Dawid Potocki, who claims that he did not receive a response despite his efforts to contact MSI and inform them about the issue.

The issue, according to Potocki, impacts many Intel and AMD-based MSI motherboards that use a recent firmware version, affecting even brand-new MSI motherboard models.
Click to expand...

UEFI Secure Boot
Secure Boot is a security feature built into the firmware of UEFI motherboards that ensures only trusted (signed) software can execute during the boot process.

"When the PC starts, the firmware checks the signature of each piece of boot software, including UEFI firmware drivers (also known as Option ROMs), EFI applications, and the operating system," explains Microsoft in an article about Secure Boot.
If the software is unsigned or its signature has changed, possibly because it was modified, the boot process will be stopped by Secure Boot to protect the data stored on the computer.
Click to expand...

Default MSI settings cause insecure boots
Potocki claims that MSI's firmware updates released between September 2021 and January 2022 changed a default Secure Boot setting on MSI motherboards so that the system will boot even if it detects security violations.

"I decided to setup Secure Boot on my new desktop with the help of sbctl. Unfortunately, I have found that my firmware was accepting every OS image I gave it, no matter if it was trusted or not," explains the researcher in his writeup.
"As I have later discovered on 2022-12-16, it wasn't just broken firmware; MSI had changed their Secure Boot defaults to allow booting on security violations(!!)."
This effectively breaks the Secure Boot feature as untrusted images can still be used to boot the device
Click to expand...

The researcher says MSI never documented the change, so he had to trace back the introduction of the insecure default using IFR (UEFI Internal Form Representation) to extract configuration options information.

Potocki then used this information to determine which MSI motherboards were impacted by the issue. A complete list of the over 290 motherboards and the firmware versions affected by this insecure setting is available on GitHub.
Click to expand...

If you're using an MSI motherboard in that list, go over to BIOS settings and check that the "Image Execution Policy" is set to a safe option.
Click to expand...

guest · Jan 18, 2023

mood said: ↑

By Bill Toulas @billtoulas - January 16, 2023
Click to expand...

Important Update:

Update 1/18 - BleepingComputer has received clarifications from Dawid Potocki about the vulnerable firmware versions for each MSI motherboard model and performed the required corrections on the article.
Click to expand...

TairikuOkami · Jan 19, 2023

Thanks for info. That explains why I always got BSOD after updating to the latest BIOS, I had to revert to the default from 2019.

guest · Jan 26, 2023

mood said: ↑

By Bill Toulas @billtoulas - January 16, 2023
Click to expand...

Update (MSI Statement on Reddit):

Update 1/20 - MSI is yet to respond to BleepingComputer's request for a comment, but the company posted the following statement on Reddit:

MSI implemented the Secure Boot mechanism in our motherboard products by following the design guidance defined by Microsoft and AMI before the launch of Windows 11.
We preemptively set Secure Boot as Enabled and "Always Execute" as the default setting to offer a user-friendly environment that allows multiple end-users flexibility to build their PC systems with thousands (or more) of components that included their built-in option ROM, including OS images, resulting in higher compatibility configurations.
[...]
In response to the report of security concerns with the preset bios settings, MSI will be rolling out new BIOS files for our motherboards with ”Deny Execute” as the default setting for higher security levels. MSI will also keep a fully functional Secure Boot mechanism in the BIOS for end-users so that they can modify it according to their needs.
Click to expand...

Log in or Sign up

MSI accidentally breaks Secure Boot for hundreds of motherboards

guest Guest

guest Guest

TairikuOkami Registered Member

guest Guest

Log in or Sign up

MSI accidentally breaks Secure Boot for hundreds of motherboards

guest Guest

guest Guest

TairikuOkami Registered Member

guest Guest

Useful Searches