Forgotten firmware signatures left Windows and Linux vulnerable to bypass for over a decade

Microsoft's Secure Boot—a fundamental security layer designed to prevent firmware-level attacks—has harbored a critical, largely unnoticed weakness for the majority of its operational life. Researchers at ESET uncovered 11 firmware images, some dating back to 2013, that Microsoft continued to trust despite their known flaws, leaving both Windows and Linux systems vulnerable to trivial bypass techniques.

The overlooked gap in Secure Boot#

The problematic components are called shims—utilities originally created to extend Secure Boot capabilities to Linux systems and specialized software. Although these older versions contained documented vulnerabilities, Microsoft never revoked their cryptographic signatures, meaning systems worldwide continued to accept them as legitimate during the boot process. An attacker with access to these publicly archived shims can exploit this trust gap without needing advanced hacking skills or sophisticated exploitation techniques.

The flaw works because the Secure Boot mechanism, embedded into device firmware at the UEFI (Unified Extensible Firmware Interface) level, validates whether code is digitally signed by a trusted authority—but relies entirely on Microsoft keeping its list of trusted signatures current. By failing to remove signatures from vulnerable shims once their flaws were discovered, Microsoft inadvertently preserved a backdoor into its own security system.

Why this matters for system integrity#

An attacker exploiting this weakness gains the ability to install malicious firmware that runs before the operating system itself loads. Once installed, such firmware can persist through OS reinstallations and even hard drive replacements, making it exceptionally difficult to detect and remove. Both Windows and Linux users face this risk equally, since the attack vector works on either system.

ESET researcher Martin Smolár noted that the danger stems not from any cutting-edge attack technique, but rather from the simple fact that dangerous old code remains trusted. "An attacker needs no complicated exploitation primitives," he explained—just access to an old shim binary and basic knowledge of how firmware components work.

A persistent threat landscape#

The vulnerability becomes more serious when considering the documented history of real-world UEFI malware. Since Secure Boot's introduction in 2012 specifically to counter firmware-level threats, various bootkits have emerged in the wild, including (linked to Russian state actors in 2018), (2020), (2022), and (2023), along with other tracked variants such as ESpecter, FinSpy, and . The gap in Secure Boot leaves users exposed to threats that were supposed to be prevented more than a decade ago.