Incorrect setting on MSI motherboards breaks Secure Boot

One of the most important security features, which Microsoft has even stipulated as a system requirement for Windows 11, is Secure Boot. Manufacturers are supposed to secure devices – but according to a report, MSI’s Secure Boot settings are wrong.

This incorrect setting is said to have existed for over a year without anyone noticing. This is reported by the Polish security researcher Dawid Potocki. How now that Online magazine Bleeping Computer reported, reveals a huge problem.

According to the security researcher’s findings, more than 290 MSI mainboards are vulnerable if the standard configuration is used. This makes the whole system absurd.

Incorrect adjustment

Secure Boot is designed to prevent malicious software from loading when a system boots up. It does this by verifying signed drivers and authenticating Windows boot files. However, at MSI, it looks like these UEFI Secure Boot settings have been set incorrectly in their motherboards for over a year, preventing them from performing any checks at boot. This goes unnoticed by the user and there are no Windows warnings whatsoever. Potocki discovered the issue on an MSI Pro Z790-A WiFi. All options under the “Image Execution Policy” in the Secure Boot settings are set to “Always Execute”, which means the motherboard will accept any OS image, no matter if it is trusted or not. During his research, the researcher found the problem with many motherboards. His further research revealed that the roots of the problem can be traced back to the third quarter of 2021. At that time the incorrect settings were introduced.

The list of unaffected motherboards is very short so far. The list of Affected motherboards can be found at the security researcher.

See also:

Logo, Msi, chip maker