A security standard developed by Microsoft to safeguard Windows and later Linux devices against firmware-based attacks has been susceptible to a straightforward bypass for 13 of its 14 years in operation, according to new findings from cybersecurity firm ESET.
Researchers identified 11 firmware images—known as shims—that contained known vulnerabilities yet remained digitally signed by Microsoft. At least one of these defective images dates back to 2013, meaning the weakness has been exploitable for over a decade without detection.
Shims were originally created to broaden Secure Boot compatibility to Linux distributions and utility software. They serve as intermediaries that extend the boot security mechanism beyond Microsoft's own ecosystem. However, the same tools designed to enhance security have inadvertently created a persistent backdoor.
How the Bypass Works
The technique required to circumvent Secure Boot through these old shims is remarkably simple. According to ESET researcher Martin Smolár, the attack does not require any novel vulnerability or sophisticated exploitation methods. Instead, an attacker needs only a copy of an old, still-trusted but unrevoked shim binary and a basic understanding of how UEFI shims function.
Secure Boot is embedded directly into the UEFI (Unified Extensible Firmware Interface) on a device's motherboard. Its purpose is to ensure that only digitally signed, trusted firmware loads during the boot process. By using one of the unrevoked shims, an attacker can completely sidestep this protection and install malicious firmware that executes before the operating system even starts.
The root of the problem lies in Microsoft's failure to revoke the compromised shim images after vulnerabilities were discovered in them. As the entity responsible for overseeing the signing of shims, Microsoft had the authority and ability to invalidate these defective images but did not do so.
Threat Extends Across Operating Systems
The vulnerability affects both Windows and Linux users, since the shim mechanism operates at the firmware level, beneath the operating system. Once a malicious actor installs a bootkit using the bypass technique, the malicious firmware loads early in the boot sequence and remains persistent even if the operating system is reinstalled or the hard drive is replaced.
This persistence makes the attack particularly dangerous. Traditional security measures, including OS reinstallation and hardware replacement of storage drives, are insufficient to remove the threat. The malware embeds itself at a level that predates and supersedes the operating system entirely.