Did Microsoft Leak Their Secure Boot “Golden Key?”
It was widely reported recently, by tech news outlets, that Microsoft leaked the Window’s 10 secure boot “Golden Key”. Just do a google search for “microsoft golden key leak”. You’ll find pages of results.
Steve Gibson on his Security Now show on TwiT this last Tuesday reported as follows:
Okay. So the big news is the massive misreporting across the entire industry of this Microsoft secure boot golden key. That did not happen, not in any way, shape, or form.
It was complete, completely wrongly reported. Threatpost said, “Microsoft mistakenly leaks secure boot key.” 9to5Mac says, “Proof Apple was right to fight the FBI.” Ars Technica, “Microsoft secure boot firmware snafu leaks golden key.” None of that is true. Complete misreporting.
Steve straightens out the facts of the story that hackers had discovered the Windows 10 secure boot “Golden Key.” For the full episode, visit https://twit.tv/sn/573. Instead of listening to the entire show you can watch a youtube video of his entire explanation here https://www.youtube.com/watch?v=634vYLaGhh0
So here’s what happened. What they did was uncover a mistake. And again, I want to make it clear. These guys are good. They did a great job. Unfortunately, they mixed a little of their own personal agenda in with reality, trying to draw a conclusion that was unwarranted. So, but again, great reverse-engineering and cleverness. Just not what — essentially, they used the term “golden key.” And because their write-up was itself very confusing and dense, I had to just, like, go back and forth and make notes and leave a trail of crumbs and, like, okay, wait a minute now, and, like, basically decode what they published because it was really, I mean, these guys are not technical authors. They’re hackers.
So what this actually was, was an implementation design error in the handling of boot permission policies which can be used to trick older version of the UEFI secure boot manager using some components of an update. So the so-called Redstone version of Windows 10, which is 1607, version 1607…
I hope I’ve provided you with information that has given you a better understanding of what happened.
Sadly, it doesn’t appear that any of the news outlets are going to update their reporting on this matter.