Thursday, January 19th 2023

About 300 MSI Motherboard Models Have a Faulty Secure Boot Implementation with Certain UEFI Firmware Versions

The UEFI Secure Boot feature is designed to prevent malicious code from executing during the system boot process, and has been a cybersecurity staple since the late-2000s, when software support was introduced with Windows 8. Dawid Potocki, a New Zealand-based IT student and cybersecurity researcher, discovered that as many as 300 motherboard models by MSI have a faulty Secure Boot implementation with certain versions of their UEFI firmware, which allows just about any boot image to load. This is, however, localized to only certain UEFI firmware versions, that are released as beta versions.

Potocki stumbled upon this when he found that his PRO Z790-A WiFi motherboard failed to verify the cryptographic signature boot-time binaries at the time of system boot. "I have found that my firmware was… accepting every OS image I gave it, no matter if it was trusted or not." He then began examining other motherboard models, and discovered close to 300 MSI motherboard models with a broken Secure Boot implementation. He clarified that MSI laptops aren't affected, and only their desktop motherboards are. Potocki says that affected MSI motherboards have an "always execute" policy set for Secure Boot, which makes the mechanism worthless, and theorized a possible reason. "I suspect this is because they probably knew that Microsoft wouldn't approve of it and/or that they get less tickets about Secure Boot causing issues for their users."
Source: The Register
Add your own comment

29 Comments on About 300 MSI Motherboard Models Have a Faulty Secure Boot Implementation with Certain UEFI Firmware Versions

#26
dawidpotocki
DrCRIf it’s indeed an issue with only beta firmware, then this feels like a tempest in a thimble. Props to the dude for self marketing I guess.
It's not an issue with beta firmware, it's just where it has been introduced first for a lot of motherboards. A lot of stable firmware released after September 2021 is affected.
BjørgerssonHow did he test ~300 motherboards?
I have mentioned this in my blog post.
dawidpotocki.com/en/2023/01/13/msi-insecure-boot/
TL;DR: Extracting information from firmware files.
JuventasIn his original article he has added this:


I see this story is everywhere now. Did none of them read the original article? dawidpotocki.com/en/2023/01/13/msi-insecure-boot/
Hah, only The Register has read my original article. Their reporter also contacted me via email about the issue and was very responsive. Overall he has done a really good job. They ended up publishing the article later than others, but they noticed my article on 13th, the day I have published it, they just had some other story come up and had to delay it.
Most sites have copied from BleepingComputer which had the same mistakes as some other smaller site which made an article earlier by like 12 hours… weird, isn't it?
Posted on Reply
#27
DrCR
dawidpotockiIt's not an issue with beta firmware, it's just where it has been introduced first for a lot of motherboards. A lot of stable firmware released after September 2021 is affected.
Gotcha, makes some of the statements make a lot more sense.

Welcome to the forum.
Posted on Reply
#28
eidairaman1
The Exiled Airman
Msi, failing since 2010...
Posted on Reply
#29
AusWolf
If secure boot wasn't worthless (on a home PC at least), this flaw would have been discovered a long time ago.
Posted on Reply
Add your own comment
Dec 19th, 2024 19:09 EST change timezone

New Forum Posts

Popular Reviews

Controversial News Posts