The media are buzzing that Microsoft has finally proven what everyone’s been talking about for quite some time now – creating backdoors is too risky and could have dire consequences.
The software giant has something of a golden key, allowing people to unlock Windows-powered smartphones, tablets and other devices which were locked by Secure Boot.
With the key, people could install other operating systems, such as Android or Linux, on locked-down computers – even on devices which do not allow the disabling of Secure Boot.
Now – it managed to leak that key. The news was first broken by a group of researchers going by the names MY123 and Slipstream. Apparently, they contacted Microsoft after figuring out what happened, but the company ignored them. That’s when they published a post on a fancy retro-looking site, which you can check out here.
Let me try and explain how this works: Security Boot relies on a particular set of policies which it reads and obeys. Among them is an early-loading policy which disables operating systems checks. This policy leaked online (curious people can find it here).
"You can see the irony. Also the irony in that MS themselves provided us several nice "golden keys" (as the FBI would say ;) for us to use for that purpose :)," the duo wrote in the blog post.
“About the FBI: are you reading this? If you are, then this is a perfect real world example about why your idea of backdooring cryptosystems with a "secure golden key" is very bad! Smarter people than me have been telling this to you for so long, it seems you have your fingers in your ears. You seriously don't understand still? Microsoft implemented a "secure golden key" system. And the golden keys got released from MS own stupidity. Now, what happens if you tell everyone to make a "secure golden key" system? Hopefully you can add 2+2... “
Microsoft has already released two patches trying to fix this, with another one apparently coming next month. The researchers, however, say that this mistake is irreversible.
“Either way, it'd be impossible in practise for MS to revoke every bootmgr earlier than a certain point, as they'd break install media, recovery partitions, backups, etc.,” the post concludes.
Image Credit: Juliannedev / Shutterstock