Motherboard Mishaps Undermine Belief, Safety

Microsoft’s newest Home windows Preview seems to set off a bug on some motherboards made by pc {hardware} producer MSI. It is the most recent motherboard misstep revealed in 2023.

In a pair of statements revealed over the weekend, each Microsoft and MSI stated they’re conscious that putting in the most recent Home windows Preview causes some computer systems to blue display screen with an unsupported-processor error. The replace, known as KB5029351 Preview, presents new options and different enhancements for quite a lot of Home windows 11 elements, together with the search app in addition to the defaults for numerous apps.

As of Aug. 28, neither Microsoft nor MSI has uncovered the reason for the difficulty, and neither firm returned a request for remark.

“Each MSI and Microsoft are conscious of the ‘UNSUPPORTED_PROCESSOR’ error and have begun investigating the foundation trigger,” MSI wrote in its statement. “Whereas the investigation is underway, we suggest that each one customers briefly chorus from putting in the KB5029351 Preview replace in Home windows.”

The problem is the most recent mishap in a stream of issues which have impacted motherboard makers up to now 12 months. In January, a set of 5 vulnerabilities in firmware utilized by baseboard administration controllers — distant administration chips included on many server motherboards — may have allowed distant entry over the Web. In late Might, researchers revealed {that a} backdoor in a whole lot of fashions of motherboards from Gigabyte, supposed to permit simpler updating, left computer systems open to assault. The corporate patched the difficulty the following day.

And in March, safety companies warned that the BlackLotus malware was concentrating on the Unified Extensible Firmware Interface (UEFI), which acts because the low-level software program glue between the working system and the motherboard. Unhealthy actors have been utilizing it as a option to bypass Microsoft’s Safe Boot. The US Cybersecurity and Infrastructure Safety Company (CISA) reiterated the warning earlier this month, saying that cyber defenders and firmware builders have been lagging behind risk teams of their capability to protect towards the issues.

“UEFI is important to most computer systems,” CISA stated in the call to action. “Based mostly on current incident responses to UEFI malware comparable to BlackLotus, the cybersecurity neighborhood and UEFI builders seem to nonetheless be in studying mode.”

Blue Screens and Imposed Prices

Whereas crashes typically herald the existence of vulnerabilities, the MSI motherboard challenge doubtless is not going to have safety implications, simply availability issues, for these impacted corporations, says Nate Warfield, director of risk analysis and intelligence at Eclypsium, a firmware safety agency.

“Blue display screen of demise is, in and of itself, not normally a vulnerability — it is one thing that people who find themselves creating exploits will run into,” he says. “So it feels like there’s some interoperability miss that occurred right here.”

Motherboards have grow to be a posh ecosystem of applied sciences, from the Trusted Platform Module (TPM) chips that act as digital lock on the info passing by the chips on the units, to the UEFI customary that permits the working system to regulate low-level units by drivers.

Microsoft has made Safe Boot — with its functionality to attest to the state of a machine — the muse of its help for zero-trust safety. For comparable causes, attackers are starting to seek for methods to bypass Safe Boot, much less as a option to acquire preliminary entry to units however as an alternative to realize persistence.

As a result of defenders have imposed extra prices on attackers by higher operating-system and software safety, risk actors are aiming decrease, Warfield says.

“We have got this multi-hundred-billion-dollar-a-year business to safe the whole lot above the firmware,” he says. “So for attackers, … if it prices extra to unfold to the working system or software, they’re gonna discover locations the place it takes much less technical funding to evade safety controls.”

Do not Take Motherboard Safety for Granted

In the newest incident, there may be not so much for customers to do however watch out for utilizing preview variations of Home windows on enterprise techniques.

Nonetheless, on the whole, corporations ought to guarantee that basic safety measures, comparable to Safe Boot, are enabled on their motherboards. In 2023, this needs to be customary for all motherboards, however no less than one researcher found that MSI had turned off Safe Boot on a number of the motherboard fashions. In late 2022, Polish safety researcher Dawid Potocki found that one model of the corporate’s motherboards shipped with out Safe Boot.

“Do not belief that no matter security measures you enabled are working, TEST THEM!” he wrote. “By some means I used to be the primary individual to doc this, despite the fact that it has been first launched someplace in 2021 Q3 [a year before].”

The corporate acknowledged issues that the motherboard settings have been too permissive.

“In response to the report of safety issues with the preset bios settings, MSI will likely be rolling out new BIOS recordsdata for our motherboards with ‘Deny Execute’ because the default setting for greater safety ranges,” MSI stated at the time. “MSI can even maintain a completely purposeful Safe Boot mechanism within the BIOS for end-users in order that they’ll modify it in keeping with their wants.”

Organizations can also should develop a finer focus for his or her asset management — not simply understanding {that a} consumer is on a Dell or HP laptop computer, however that the gadget is utilizing a specific motherboard and firmware model, Warfield says.

“As soon as one thing occurs, the problem for organizations turns into understanding how lots of the techniques of their fleet are affected,” he says. “That turns into so much more durable simply because it is not as as simply accessible by the instruments that individuals use for managing their units.”