Borrowing a Microsoft-signed shim to abuse Secure Boot on corporate hardware
This technical deep dive exposes a clever method to bypass UEFI Secure Boot, leveraging Microsoft-signed shims to run arbitrary code on corporate hardware. The author meticulously details how to 'borrow' these trusted components to enroll custom keys, turning a supposed security feature into an unexpected boot vector. It's a compelling read for anyone interested in low-level system security and the practical implications of trust in the boot chain.
The Lowdown
This blog post, a continuation of the author's p3ng0s research series, unveils a method for effectively circumventing UEFI Secure Boot by exploiting legitimate Microsoft-signed shim loaders. The author demonstrates how this technique allows for the execution of custom operating systems, even on machines with Secure Boot enabled and protected, which has significant implications for corporate security.
- The author first addresses common misconceptions about Secure Boot, clarifying that its primary purpose is ensuring boot integrity rather than strictly locking down operating systems to specific vendors.
- It explains the role of the Microsoft Corporation UEFI CA 2011, which signs third-party bootloaders (shins) for Linux distributions, enabling them to boot on systems with Microsoft keys installed.
- The core 'shim borrowing' technique involves obtaining a legitimate Microsoft-signed
shim-signedpackage, often found in Linux distribution repositories. - Detailed steps are provided for generating custom keys, signing a kernel and GRUB bootloader, and configuring the EFI partition with the borrowed shim and MOK (Machine Owner Key) enrollment software.
- The abuse scenario involves plugging in a prepared USB drive, booting the Microsoft-signed shim, which then fails to validate the custom-signed GRUB, and consequently presents the MOK enrollment screen. Here, the attacker can enroll their custom key, allowing their arbitrary OS to boot.
- The post concludes by connecting this technique to the author's
p3ng0sproject, offering instructions for integrating this secure boot bypass into a custom Live ISO build.
Ultimately, the research highlights that Secure Boot, while designed for integrity, can be compromised through its own mechanisms by borrowing trusted components, revealing a fascinating and somewhat unsettling aspect of modern system security.