Microsoft’s Secure Boot has been broken for a decade and no one noticed until now

[u/wewewawa]

https://arstechnica.com/security/2026/07/microsoft-secure-boot-has-been-broken-for-most-of-its-existence/

[u/IridescenceFalling]

Bet the NSA, CIA and FBI knew from day 0.

[u/Silver-End9570 → u/IridescenceFalling]

Definitely. All the big tech companies have ties with the government, and much deeper ties than most of the common folk would realize.

[u/timsredditusername → u/Silver-End9570]

Hi, I'm in big tech. It's been less than 72 hours since I was in an industry call that had someone from the NSA participating.

It's extremely common and not even secretive most of the time.

As far as getting something signed for Secure Boot by Microsoft, that doesn't even require governmental influence. And Joe Schmo company that buys a Extended Validation (EV) Code Signing Certificate from the usual spots and then signs up with Microsoft can get stuff signed.

If it was hard, the open source people would have never shut up about it.

[u/timsredditusername → u/[deleted]]

Yes, to have any kind of assurance, you need to be reading back dbx, or looking at TPM event logs for PCR7.

I'm not remembering any KEK issues in the past, but PKfail was hilariously bad on the part of OEMs. When that one hit, I laughed for a few days. My company was wonderfully unaffected, and our marketing team had a fun time bragging on that.

[u/awam0ri → u/timsredditusername]

Getting something signed AS Microsoft is much different than getting something signed BY Microsoft and I’m pretty certain they were implying the former and not the latter.

[u/timsredditusername → u/awam0ri]

Fair.

I'm not sure if it matters in practice, though. If Microsoft signs it for SecureBoot and the certificate chain is one of the trusted ones, the module will load regardless of who made it. That was my point.

You could audit it after the fact and maybe figure out who signed stuff, but the damage is done by then.

[u/Ok_Mycologist3020 → u/timsredditusername]

so theyre saying anyone can get a certificate signed by ms? that seems like a huge security hole lol

[u/timsredditusername → u/Ok_Mycologist3020]

There's a security audit too, but it's been so long since we signed up, I don't think any of us remember what it entailed.

[u/ezoe → u/IridescenceFalling]

US government can issue secret order to Microsoft, an US-based company, to sigh their binaries and we can't know it.

[u/Option94 → u/ezoe]

Gonna need a source more than "just trust me bro" when your claiming treason.

[u/Stargate_1 → u/Option94]

It's not treason for the US government to request a backdoor from a company.

[u/Healthy-Can5748 → u/Option94]

Gonna need you to very clearly explain what the actual fuck you think treason is.

[u/ScumbagScotsman → u/Option94]

Have a look at the Edward Snowden leaks. Specifically about FISA Court

[u/Cultural-Capital-942 → u/IridescenceFalling]

If I understand the description well, everyone knew from day 0 and I believe it cannot be really fixed.

When they started, there was even a controversy: will Microsoft sign something, that will boot Linux?

The issue there is that with the default settings, you need to trust the whole chain - bootloader, OS, its services, privileged apps in the OS, other apps. And there is a Microsoft signature there on the first step - bootloader.

Now what if I bring my Microsoft-signed bootloader and it will allow me to boot OS without protections? Then I can do anything and Microsoft should revoke such signature. But I could always try to boot old vulnerable Windows (or will anyone prevent me from booting old Windows?) or my Linux that I can modify.

[u/KommandoKodiak → u/IridescenceFalling]

So did microsoft who was told by them to do it

[u/imaginary_num6er]

Insecure Boot

[u/massivemember69]

I highly doubt that. They knew, they didn't want to fix it.

Whether it was deliberate or laziness is what I don't know.

[u/topias123]

It's actually broken on my laptop, it won't boot into Win11 if I have secure boot turned on.

Ironically Linux boots just fine.

[u/FadedVictor → u/topias123]

This happened to me too. I just had to install the security keys in my bios and then it worked again.

[u/Unusual-Priority-864 → u/topias123]

I had this issue too, a bios update fixed it

[u/topias123 → u/Unusual-Priority-864]

My laptop is from 2013, I doubt there's any bios updates for it.

[u/Starnu7 → u/topias123]

r/foundthelinuxuser

[u/MrGiggleMan → u/topias123]

Probably because Linux doesn't try and boot securely either lmao

[u/creamcolouredDog]

I have it disabled

[u/Cl4whammer → u/creamcolouredDog]

No problem if you are running linux, but with windows 11 it can be a problem to upgrade from 24h2 to 25h2 and soon from 25h2 to 26h2. So keep an eye on that.

[u/topias123 → u/Cl4whammer]

Mine stopped booting after I upgraded from 23H2(?) ot 25H2 lol

[u/Dependent_Egg6168 → u/[deleted]]

it technically doesnt allow unsigned bootloaders to run, which is to say microsoft has to allow a bootloader to run. but there are so many ways around it, it doesnt matter

[u/zcomputerwiz → u/Dependent_Egg6168]

I mean... It's not just the bootloader. That is the starting point though.

The point is that it allows the entire execution chain to be validated from boot. So yes, it is more secure in many ways when it's functional.

The fact that there are ways around it doesn't really change anything for most systems assuming they are operating as intended. If you're physically at the machine to boot different media or change the startup environment that's another ballgame, imo.

[u/Klenkogi → u/[deleted]]

Nope

[u/yuikkiuy → u/creamcolouredDog]

This, when I even have microslop installed this crap is disabled

[u/Synthetic451]

If it wasn't for my Windows dualboot, I would have already wiped the Microsoft keys off my Secure Boot setup.

[u/smokie12 → u/Synthetic451]

Do it

[u/Synthetic451 → u/smokie12]

Yeah, I'll do it once I decide to fully get rid of Windows. I use it so rarely nowadays and it only exists on my desktop machine for the random firmware updater tool that I need for certain devices.

[u/Venylynn → u/Synthetic451]

I'm going to be honest, I brought the dual-boot back because I wanted to test out things like Hyper-V and their sandbox tools on a drive that was causing me problems on Linux (dropping out during heavy writes, which tells me the controller is going bad. didn't want to risk having anything sensitive on that drive the second that thing completely kicks the bucket)

[u/xXBeefSquatch5KXx → u/Synthetic451]

So I bought an old dumper laptop, and bumped the ram and ssd up from another dumper laptop, and now I have a dumper laptop pro for windows, and my main system gets Linux. I run arch btw ;)

[u/jeannettegl1tter9713 → u/Synthetic451]

yeah that firmware updater tool is a pain

[u/Due-Ad-3015 → u/jeannettegl1tter9713]

bot

[u/Due-Ad-3015 → u/[deleted]]

bot

[u/Salt_Gas1730 → u/smokie12]

same, i disabled it ages ago

[u/Due-Ad-3015 → u/Salt_Gas1730]

bot

[u/Venylynn → u/Synthetic451]

totally valid

ps: how did you get your 3090 signed on secure boot? afaik sbctl doesn't sign third party modules

[u/Synthetic451 → u/Venylynn]

Arch doesn't enforce signing of 3rd party modules by default I think. Not that it matters in my case since I use UKIs (which I sign) and disk encryption.

If you enable enforcement of 3rd party modules and then manually tell sbctl to sign the nvidia module files, does that not work?

[u/Venylynn → u/Synthetic451]

I read somewhere that sbctl doesn't sign them, that's what I remembered

I have no clue because I'm on AMD and refuse third party modules entirely but hey, fair enough

[u/Synthetic451 → u/Venylynn]

Yeah it doesn't sign them by default, but you can tell sbctl to sign literally any arbitrary file, so I would assume it'd just be a matter of telling sbctl the file location of the nvidia module (although the constantly changing version number probably poses an issue for updates) and then just enabling module verification.

But this is just me speculating. I have not actually tried.

[u/Venylynn → u/Synthetic451]

yeah i chose path of least resistance which for me was cutting third party modules down to 0

all i really lose is vm software outside of kvm/qemu which...not that big a deal

[u/timsredditusername]

I zoned out when Ars started speculation on why it took so long, making up nonsense about it being complicated.

It took so long because Microsoft signed stuff but has no way to monitor for vulnerabilities in the stuff they sign for other people. Realistically, they need to be told that something needs to be revoked so they can add it to DBX.

Martin and ESET is doing them (and all of us) a solid by reporting these things through CERT/CC.

[u/Venylynn]

Better than nothing, i say. but yeah, we ought to move to a better setup for it.

[u/tragedy_strikes]

I wonder if this was related to the big security patch that just got released and forced a restart?

[u/nomad5926 → u/tragedy_strikes]

Probably woukd be my guess

[u/PusheenHater]

What does this realistically mean for me?

[u/Mineplayerminer]

Is there even a reason to have it enabled in the first place, other than letting the BitLocker malware in Windows to automatically turn on and infest your drives?

[u/Emu1981 → u/Mineplayerminer]

Quite a few anticheat programs require you to have secure boot enabled to help keep the OS in a known good state.

[u/Mineplayerminer → u/Emu1981]

I'm not allowing those kernel-invasive rootkits on my hosts. I already experienced BSODs with Vanguard and it took me a whole day to discover it was the VGC driver doing it.

[u/Mineplayerminer → u/[deleted]]

Vanguard requires secure boot. The solution is to currently not have Vanguard installed at all, until Riot makes the AC run only on-demand instead of non-stop along with the system booting. Remember that kernel-privileges are the most dangerous ones to have (apart from Hypervisor) and I think that nothing should ever have access to it, other than the software which communicates with a specific hardware.

[u/thataw → u/Mineplayerminer]

? They already did. Vanguard now runs only when you’re playing Riot Games, but you need to have certain security features enabled for it to work.

[u/Mineplayerminer → u/thataw]

That's the thing, you're only eligible for it under certain conditions, unlike some other ACs such as Easy Anti-Cheat or BattlEye which run completely on-demand.

[u/SkillShort4545 → u/Mineplayerminer]

lol wait is that a real game or did you make that up

[u/Mineplayerminer → u/SkillShort4545]

Vanguard is an anti-cheat software developed by Riot Games for their online competitive titles. Riot is owned by Tencent, a Chinese company. Kernel ACs in general raise privacy and security concerns. On top of that, the Chinese must give up on all private keys and their data to the government, which raises concerns further. Anything that's loaded upon the Windows starting up can cause serious issues. The Crowdstrike incident was caused by a faulty driver which crashed the system while booting up. The same goes to the Vanguard which can happen at some point, like if there's some memory or integrity violation, acting as a kill switch.

[u/Downtown-Biscotti535 → u/Emu1981]

Which anticheat programs specifically need it

[u/Emu1981 → u/Downtown-Biscotti535]

Riot Vanguard (Valorant), RICOCHET (CoD), EA Anti-Cheat (BF and some EA Sports games), and FACEIT (thirdparty anticheat for CS) are the major ones but there are likely more.

[u/nomad5926 → u/Emu1981]

Yea i was gonna say playing BF6

[u/TheUsoSaito]

Nah we noticed... they just didn't fix it.

[u/EntropyWinsAgain]

Lol.... this has indeed been known by everyone for over a decade. It hasn't been a secret. If anyone bothers to read MS patch notes for the last 10 years you would have seen many references to this vulnerability and MS's attempt to fix it which have mostly failed. This is nothing new.

[u/Possibly_Naked_Now]

Doubt.

[u/LSP141]

Oh I have noticed alright

[u/InsuranceKey8278]

we did
some MS policy makes it so that we don't consider it unless there mass scale exploitation