Cyber Security Featured Article

Hackers Break Microsoft Secure Boot, Say All Encryption Backdoors are Breachable

August 10, 2016

It's not every day you wake up to a small-scale disaster, but new reports from a pair of hackers who sent said report to, among others, the Federal Bureau of Investigation (FBI), noted that not only is Secure Boot less secure than expected, but the notion of an “encryption backdoor” may be breached almost universally in a similar fashion.

Essentially, the researchers—going under hacker names Slipstream and MY123—noted that they found the cryptographic key to Secure Boot, a feature that allows users operating outside of a piece of hardware to boot the operating system of that hardware remotely. Built specifically to address some kinds of malware known as “rootkits,” which typically operate in such a fashion that most security features can't find it implanted on a system, Secure Boot effectively allows anyone with a Microsoft-issued key to boot a system, even when a rootkit prevents access. 

Many systems allow Secure Boot to be turned on and off, but not all do. Devices like tablets and smartphones are often unable to turn off Secure Boot, and that's got folks like Slipstream and MY123 very concerned.  The researchers noted that, thanks to this discovery, it might be possible to gain access to a lot of systems, meaning that previously unbreakable encryption could effectively be broken.

The report commented: “Microsoft implemented a 'secure golden key' system. And the golden keys got released from [Microsoft's] own stupidity. Now, what happens if you tell everyone to make a 'secure golden key' system? Hopefully you can add 2+2.”

To Microsoft's credit, it's responded to the discoveries with attempted patches. The problem, of course, is that “attempted” is all Microsoft's been able to do as the patches have yet to actually work. Worse, the “key-disabling key” that was found as part of Slipstream and MY123's research has been publicly posted, meaning anyone who wants to bypass Secure Boot can now do so. This means that rootkits are once again a threat, and illustrates why the notion of a backdoor for encryption is a bad idea.

The old saying holds true: what one can do, another can undo. Establishing this backdoor method into encryption just means that someone would start looking for a way to breach the system at the backdoor level, instead of trying to break encryption with an encryption key, a process that would have been much more difficult. The most secure setup for any operation is a room with no doors or windows, but since that means it can't be used in reality, we settle for one door, and watch that door carefully. When we add other doors, we simply add other potential points of failure for security.

The revelation that backdoors on encryption isn't a good idea might be a valuable one, valuable enough to make the effective loss of Secure Boot worthwhile. We have likely learned a great lesson here, but at a terrible price.

Edited by Peter Bernstein

Article comments powered by Disqus
Free Subscription