Cybersecurity researchers have identified 11 outdated Microsoft-signed UEFI shim bootloaders that can be exploited to circumvent Secure Boot protections. This vulnerability allows attackers with administrative access to execute untrusted code early in the boot process, facilitating the deployment of persistent UEFI bootkits like BlackLotus and Bootkitty before the operating system or endpoint detection and response (EDR) solutions can initialize.
The issue stems from older shim versions that remain trusted by the Microsoft Corporation UEFI CA 2011 certificate. Despite security updates, the absence of specific hash-based revocations in the DBX list means these binaries can still be used in "Bring Your Own Vulnerable Driver" (BYOVD) style attacks. This effectively subverts modern security mechanisms like the Machine Owner Key (MOK) denylist and Secure Boot Advanced Targeting (SBAT), creating a long-term supply chain exposure for fully patched systems.
Top comments (0)