Martin Smolar

Multiple Microsoft-signed UEFI SHIM bootloaders are subject to a Secure Boot bypass due to a lack of enforcement and validation of the Secure Boot Advanced Targeting (SBAT), a mechanism used to revoke vulnerable bootloaders. An attacker with administrative privileges or the ability to modify the boot process can utilize these bootloaders to circumvent Secure Boot protections and execute arbitrary code before the operating system loads.

A vulnerability exists in the Howyar UEFI Application "Reloader" that allows for the execution of unsigned software in a hardcoded path. This flaw, identified as CVE-2024-7344, bypasses UEFI Secure Boot protections, potentially enabling the installation of malicious bootkits. A new ransomware strain, HybridPetya, has been observed exploiting this vulnerability to gain persistence and encrypt systems. HybridPetya mimics the behavior of Petya/NotPetya ransomware, encrypting the NTFS Master File Table (MFT) and demanding a ransom payment. While HybridPetya has not yet been widely deployed in active attacks, its capabilities suggest a significant threat potential. The vulnerability resides in a UEFI application signed by Microsoft, impacting a range of systems. The exploitation of this vulnerability allows attackers to gain control at the boot level, potentially bypassing operating system-level security measures.

A security-feature bypass issue exists in the Windows Secure Boot implementation due to errors in accessing debugging functions during the boot process. This flaw allows an attacker to bypass existing security restrictions. Specifically, the issue can be exploited by triggering a boot error to read the BitLocker decryption key from memory, as the bootloader fails to clear it. Furthermore, attackers can downgrade the bootloader to a vulnerable version to exploit this memory reading flaw, even on fully updated Windows 11 systems with Secure Boot enabled. This vulnerability has been linked to the deployment of UEFI bootkits by the FishMonger threat group to ensure persistence and stealth on targeted government systems.

The issue concerns a vulnerability in the HQSwSmiDxe DXE driver that may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by changing an NVRAM variable. This could potentially be exploited to disable Secure Boot protection, allowing attackers to intercept the OS boot process, load unsigned bootloaders, and deploy malicious payloads with system privileges. The vulnerability can be exploited in low-complexity attacks without requiring user interaction.