Microsoft released the keys that can unlock Windows tablets, phones and other devices which are sealed by Secure Boot. Now, they are picking up the pieces from the disaster.
The keys can be used by users to install different Operating systems on locked computers. In short, devices in which secure boot couldn’t be disabled can now be unlocked with these keys.
This also brings up the point that Law Enforcement will be able to easily unlock devices, with or without the proper Documentation.
Microsoft’s mistake was discovered by MY123 and Slipstream. These two researches wrote down their findings in a write-up published on August 9th. They believe that it will be impossible for Microsoft to undo the leak.
When a certain device is locked to Secure Boot, it will only boot up an operating system that is signed by Microsoft. This basically stops you from loading systems such as Android or Linux onto Secure Boot Devices.
The Secure Boot Policies are a series of rules which are loaded by the Windows boot manager during System Startup. The Vulnerability came about when Microsoft decided to add special Secure Boot policies for development purposes. The special rules disable the signature checks on the operating system, and this is the main vulnerability.
If you manage to install this policy into your firmware, Windows will not verify your operating system and will continue to boot anything you provide it with.
When the researchers reported their findings to Microsoft for the first time, they declined to follow up on it. More than a month had passed before they decided that it was a real issue, and paid the Researches a finder’s fee.
Ever since July Microsoft has been working on Security patches which aim to fix this problem. Only time will tell if they will ever manage to plug up the holes they have left.