Microsoft quiet as researchers spot debug mode flaw that bypasses OS checks.
BY TOM MENDELSOHN (UK)
The company said: "The jailbreak technique described in the researchers’ report on August 10 does not apply to desktop or enterprise PC systems. It requires physical access and administrator rights to ARM and RT devices and does not compromise encryption protections."
Microsoft has inadvertently demonstrated the intrinsic security problem of including a universal backdoor in its software after it accidentally leaked its so-called "golden key"—which allows users to unlock any device that's supposedly protected by Secure Boot, such as phones and tablets.
The key basically allows anyone to bypass the provisions Microsoft has put in place ostensibly to prevent malicious versions of Windows from being installed, on any device running Windows 8.1 and upwards with Secure Boot enabled.
And while this means that enterprising users will be able to install any operating system—Linux, for instance—on their Windows tablet, it also allows bad actors with physical access to a machine to install bootkits and rootkits at deep levels. Worse, according to the security researchers who found the keys, this is a decision Microsoft may be unable to reverse.
The golden keys were found by MY123 and Slipstream in March this year. They've just posted, on a rather funky website, a description both of Microsoft's security errors and of its seeming reluctance to patch the issue. The researchers note that this snafu is a real-world demonstration of the lack of wisdom in the FBI's recent demands for universal backdoors in Apple's devices. They wrote:
A backdoor, which MS put in to Secure Boot because they decided to not let the user turn it off in certain devices, allows for Secure Boot to be disabled everywhere! You can see the irony. Also the irony in that MS themselves provided us several nice "golden keys" (as the FBI would say) ;) for us to use for that purpose :)
About the FBI: are you reading this? If you are, then this is a perfect real world example about why your idea of backdooring cryptosystems with a "secure golden key" is very bad! Smarter people than me have been telling this to you for so long, it seems you have your fingers in your ears.
You seriously don't understand still? Microsoft implemented a "secure golden key" system. And the golden keys got released from MS['s] own stupidity. Now, what happens if you tell everyone to make a "secure golden key" system? Hopefully you can add 2+2...
The researchers seem to have found the golden key—which isn't a PKI-type private key you would use to sign binaries, but rather a way to alter the tasks executed by UEFI at boot—bundled in dormant form on retail devices, left in as a debugging tool by accident. Now apparently available online, it should allow any user to turn off Secure Boot.
Secure Boot works at the firmware level, and is designed only to allow an operating system signed with a key certified by Microsoft to load. It can be disabled on many desktops, but on most other Windows devices, it's hard-coded in. The golden key policy seems to have been designed for internal debugging purposes, to allow OS signature checks to be disabled, apparently so programmers can test new builds. In practice, it could well open up Microsoft's tablets and phones to serious attacks.
At first, Microsoft apparently dismissed the find as a non-issue, before changing its mind, and then slowly applying a patch. The software giant eventually awarded a bug bounty in June, and has since released two patches—MS16-094 and MS16-100—with a third on the way. It's understood that none of them are able to directly shut the back door, and there's a distinct possibility that the hole opened by the golden keys may not be truly closable.
According to the researchers, "it'd be impossible in practise for MS to revoke every bootmgr earlier than a certain point, as they'd break install media, recovery partitions, backups, etc."
In February, in the wake of the San Bernardino shootings in the US, the FBI asked Apple to introduce backdoors into its products, after it had proved difficult to access information on an iPhone belonging to one of the shooters. In a statement, Apple CEO Tim Cook wrote:
We have great respect for the professionals at the FBI, and we believe their intentions are good. Up to this point, we have done everything that is both within our power and within the law to help them. But now the U.S. government has asked us for something we simply do not have, and something we consider too dangerous to create. They have asked us to build a backdoor to the iPhone.
Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software—which does not exist today—would have the potential to unlock any iPhone in someone's physical possession.
The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor. And while the government may argue that its use would be limited to this case, there is no way to guarantee such control.
Ars has sought comment from Microsoft.
This story was updated on August 11 to clarify the nature of the "golden key," which isn't technically a key at all.
This post originated on Ars Technica UK