Windows Secure Boot ‘PKfail’ Disaster Just Got Worse

A few months ago, we reported on the PKfail vulnerability in Secure Boot, a security issue that results from hardware manufacturers shipping devices with known infected software.

After further investigation, security researchers discovered that this was a much more serious problem than they initially thought.

In case you missed the original story, here’s a quick summary: Code that allows you to bypass Secure Boot encryption (so you can load software in a pre-boot environment) was leaked to an open repository in 2022. Despite it being a known issue, manufacturers continued to ship compromised devices. In fact, many of them shipped with pre-production warnings like “DO NOT TRUST” still embedded in the firmware.

As Ars Technica reports, Binarly’s original publisher and other security researchers have found many more devices vulnerable to the PKfail attack. The list of vulnerable devices has grown to nearly four times the number in the original research, now covering nearly a thousand individual models of x86-based desktops, laptops, and other hardware.

The original list included computers and motherboards made by some of the biggest names in the industry, including Dell, Acer, and Intel. Now that the problem is more widely known, the list is expanding to include other manufacturers, such as Fujitsu and Supermicro. Even boutique manufacturers like Beelink and Minisforum are susceptible.

The problem appears to extend far beyond the realm of conventional Windows hardware and computers. According to data from online detection tool Binarly, corporate servers, retail machines, gaming consoles, and even ATMs are all hosting these publicly available Secure Boot keys. Even some medical devices and voting machines have appeared in the system. To say this is all “alarming” would be an understatement.

That said, remotely exploiting Secure Boot would be a huge undertaking for a hacker, so the PKfail vulnerability is mainly relevant to anyone who might be personally targeted for data theft or surveillance. It’s much more likely to be exploited by, say, someone pursuing a multimillionaire or a state-sponsored hacking group hoping to obtain government or industry secrets. Regardless, Binarly warns that the PKfail vulnerability is already being actively exploited in the wild.

If you have an affected machine, the solution to the PKfail problem is nothing more than a BIOS or UEFI update from your computer’s motherboard manufacturer. You can use Binarly’s online detection tool to check if your computer is affected.