Researcher boots custom OS on locked-down corporate laptops by borrowing Microsoft's signed shim
Borrowing a Microsoft-signed shim to abuse Secure Boot on corporate hardware
Secure Boot only checks that the bootloader carries an accepted signature, not that the OS is trusted. Leo Smith shows how to grab a Microsoft-signed shim from distro packages like Ubuntu or Fedora, sign a custom kernel and GRUB with self-generated MOK keys, and enroll those keys through the shim's MOK manager on a target machine. No BIOS password is needed: just pick the USB drive from the boot menu and the attacker's OS loads on hardware with Secure Boot enabled.
To me it seems a bit trivial well if I can pick the keys during mok enrollment why not just pick my own keys? From there it's jackpot I booted my OS on hardware that has secure boot enabled!
- Graziano_M
What I do is seal the disk encryption key against PCR 7 (among others) so even if it secure boots up, unless it boots with grub verified with a specific key, it won’t be able to decrypt the disk.
- huslage
This is not a hack. It's working as designed.
- p4p1
Secure Boot’s MOK enrollment lets you enroll arbitrary keys without a BIOS password. By borrowing a Microsoft-signed shim from a package like ubuntu’s shim-signed, you can boot any OS on a corporate machine that has 3rd party certificates installed — which most do.