There are only five days left until computers with Windows either Linux update the cryptographic keys that protect them against infections UEFI firmware-based, a particularly harmful form of malware that loads before the operating system and anti-malware protections boot.
The reason is that then, on June 24, three certificates that cryptographically verify each piece of firmware and software will expire that starts during system boot, ensuring that they come from trusted providers. These Microsoft-signed certificates are key pieces of ‘Secure Boot’, a chain of security checks designed by Microsoft.
Secure Boot is designed to stop UEFI ‘bootkits’a type of malware that attacks the Unified Extensible Firmware Interface, successor to the BIOS. Both BIOS and UEFI are the basic software that comes built into a device and initializes the hardware before handing control to the operating system. Since these bootkits are loaded at this stage of boot, they are difficult to detect.
Once installed, they usually upload malware to the operating system to steal credentials, open backdoors or perform other malicious actions. Even if the operating system is disinfected, the bootkit can reinfect it. They also survive OS reinstallations.
In response to this type of threat, Microsoft developed together with device manufacturers Secure Boot, an industry standard that since Windows 8in 2012, uses cryptographic signatures to ensure that each piece of firmware loaded during boot is considered trusted by the computer manufacturer. Secure Boot is designed to create a chain of trust that Prevent attackers from replacing intended boot firmware with malicious firmware. If a single link in the startup chain is not recognized, Secure Boot prevents the device from booting.
But in 2023 was discovered LogoFaila series of critical vulnerabilities present in UEFI. A bug in software image analysis that displayed hardware manufacturers’ logos during boot allowed attackers to bypass Secure Boot and infect UEFI with malicious firmware.
The discovery of LogoFail forces Microsoft to replace the current cryptographic signatures that support Secure Boot with new ones. Three old signatures, dated 2011, will be removed. Others dated 2023 will be used in their place. Microsoft is in the process of updating Windows 10 and Windows 11 computers. Linux distributions are also updating their ‘shims’small pieces of software that load at startup and allow Secure Boot to trust the Linux boot loader.
Computers that do not update Secure Boot-related keys will continue to work, but will not be protected against LogoFail and other similar threats.
How to know if your computer has updated Secure Boot keys
To check the status of the keys on Windows computers, follow the path Settings > Privacy and security > Windows Security > Device security > Secure Boot. In this section it should appear a green check mark along with the message that ‘secure boot is enabled and all necessary certificate updates have been applied. No further changes to the certificate are necessary.’
Most Windows computers automatically update keys during Microsoft’s monthly patch distributions, but older equipment may require manual attention. Linux users should keep an eye out for new shims being released.
If the green check mark does not appear, Microsoft indicates how to fix it here.