MSI Board Owners: Check Your UEFI Secure Boot Settings!

[plat]

Content source

https://www.bleepingcomputer.com/news/security/msi-accidentally-breaks-secure-boot-for-hundreds-of-motherboards/

Potocki claims that MSI's firmware update version' 7C02v3C,' released on January 18, 2022, changed a default Secure Boot setting on MSI motherboards so that the system will boot even if it detects security violations.

"I decided to setup Secure Boot on my new desktop with the help of sbctl. Unfortunately, I have found that my firmware was accepting every OS image I gave it, no matter if it was trusted or not," explains the researcher in his writeup.

"As I have later discovered on 2022-12-16, it wasn't just broken firmware; MSI had changed their Secure Boot defaults to allow booting on security violations(!!)."

Potocki explains that users should set the Execution Policy to "Deny Execute" for "Removable Media" and "Fixed Media," which should only allow signed software to boot.

A complete list of the over 290 motherboards affected by this insecure setting is available on GitHub.

Personal note: Windows users w/certain MSI boards who can't update to 11 might be esp. interested. According to the Bleeping article, MSI has not yet responded with an answer on how it plans to address this issue.

 

[Zero Knowledge]

Dissapointed but software has always been MSI's downfall . Their hardware is good to great, reliable and well-made but their software stinks .

 

[plat]

Dissapointed but software has always been MSI's downfall

Interesting. Very recently, the developer of MSI Afterburner (for those who don't know, it's a gpu tuning software) claimed that program was "semi-abandoned" and may be "reaching end-of-life." The reason? MSI has been unable (they claim) to forward his payments due to the Ukraine invasion.

They say they're currently "looking into it." But I cannot blame the dev--he wants his pay just like anybody. But after this revelation, it's prob. no coincidence AFB was on the list for malicious hijacking (like OBS and some others).

Wow.

 

[Zero Knowledge]

I don't blame him either, you need money even in a war zone to either get out and migrate or buy whatever food is left.

 

[entropism]

The reason? MSI has been unable (they claim) to forward his payments due to the Ukraine invasion.

Yes, because they literally can't get the payments to him due to the war, not because they're simply not trying. MSI also went on record saying that they'll make sure the project continues.

 

[Freki123]

I hope they will fix it in a timely manner
Thanks for the post I would have missed it otherwise.

 

[upnorth]

MSI will be rolling out new BIOS files for motherboards with ”Deny Execute” as the default setting for higher security levels.

MSI USA

Welcome to the MSI USA website. MSI designs and creates Mainboard, AIO, Graphics card, Notebook, Netbook, Tablet PC, Consumer electronics, Communication, Barebone, Server, industrial computing, Multimedia, Clean Machine and Car Infotainment.

us.msi.com