The deadline for Windows and Linux users to update critical cryptographic keys protecting their systems from UEFI-based malware is fast approaching, with the expiration date set for June 24. These keys are vital for Secure Boot, a feature designed to verify the integrity of firmware and software loaded during the system boot process.
Secure Boot seeks to thwart UEFI bootkits, malicious software that operates before the operating system and standard anti-virus measures, making detection challenging. Once installed, these bootkits can infect the system, store malware, and survive even after OS reinstalls, leading to significant security vulnerabilities.
Bootkit history traces back to the 1980s when they first targeted Apple II systems. Windows bootkits gained attention in the early 2000s, with various kinds of malware shaping their evolution. Notable mentions include BootRoot, Vbootkit, the Stoned Bootkit, and Mebroot. By 2012, new forms of bootkits emerged, targeting advanced firmware like UEFI and EFI, leading to real-world attacks such as the emergence of malware like LoJax and MosaicRegressor.
In reaction to escalating threats, Microsoft and device manufacturers developed Secure Boot to maintain a chain of trust at startup, which prevents unauthorized firmware from loading. However, recent vulnerabilities, such as LogoFail, which affects almost all Windows and Linux devices, prompted a crucial update to the Secure Boot keys. Older certificates will be replaced with new ones effective from June 24.
For users to remain secure, it is essential to check that the new Secure Boot keys have been properly updated. Windows users can do this via the Device Security settings, while Linux users should look out for updated shims. Users are advised to stay current with firmware updates to ensure smooth updates to Secure Boot certificates.
For further details about applying firmware updates, you can refer to Microsoft’s guidance.
