As the June 24 deadline approaches, Windows and Linux users must update their cryptographic keys to protect against firmware-based UEFI infections. The expiration of three Microsoft-signed certificates, which verify the trustworthiness of firmware and software during system boot, necessitates this update. Secure Boot, a chain of trust designed by Microsoft, relies on these certificates to prevent UEFI bootkits from loading malicious firmware. These bootkits, which can steal credentials and backdoor systems, are notoriously difficult to detect and can survive OS reinstallations. The history of bootkits dates back to the 1980s, with recent instances including LoJax, MosaicRegressor, and LogoFail, which exploited vulnerabilities in UEFI firmware. In response, Microsoft and device makers developed Secure Boot, which uses cryptographic signatures to ensure trusted firmware. However, the discovery of LogoFail requires the replacement of existing cryptographic signatures with new ones. Users can check their Secure Boot status on Windows machines by opening Windows Security settings, and Linux users should watch for new shim releases. Failing to update these keys will leave systems vulnerable to new UEFI threats, although they will continue to function. To mitigate this risk, it is essential to update the Secure Boot-related keys and stay current with firmware updates, as recommended by Microsoft.

Source: Wired