A critical deadline is approaching for Windows and Linux security. Beginning June 24, three Microsoft-signed certificates that cryptographically verify each piece of firmware and software loaded during system boot will expire. According to an article published by WIRED and authored by Dan Goodin of Ars Technica, these certificates are the linchpins of Secure Boot, a Microsoft-designed chain of trust that checks digital signatures of all firmware during startup to ensure it originates from a trusted provider, such as the motherboard manufacturer.
The expiration opens the door to UEFI bootkits, a pernicious form of malware that alters the Unified Extensible Firmware Interface (UEFI), the successor to the BIOS. These bootkits load before the operating system and most antimalware protections, making them difficult to detect. Once installed, they typically load malware that steals credentials, backdoors the system, or performs other malicious actions. Even after the OS is disinfected, the bootkit can reinfect the system and survive OS reinstallations, the article notes.
The History of Bootkits
Bootkits are not a new threat. The article traces their genesis to the early 1980s with malware targeting Apple II machines via floppy disks containing pirated games. Windows bootkits gained notice in the early 2000s with proof-of-concept (PoC) attacks demonstrated by offensive security researchers. A timeline of notable bootkits includes:
| Year | Bootkit / Event | Target / Description |
|---|---|---|
| 2005 | BootRoot (Black Hat) | Windows; infected Network Driver Interface |
| 2005+ | Vbootkit, Stoned Bootkit, Mebroot | Various Windows PoCs |
| 2012 | Mac OS X EFI bootkit | Attacked Mac systems via EFI firmware |
| 2012 | Primitive UEFI bootkit for Windows 8 | Infected predecessor to UEFI |
| 2013 | Dreamboat (UEFI bootkit) | Advanced PoC for Windows |
| 2018 | LoJax (attributed to Fancy Bear/APT28) | First known real-world UEFI attack; repurposed LoJack anti-theft software |
| 2020 | MosaicRegressor (discovered by Kaspersky) | UEFI malware that reinstalled malicious files at each reboot |
| Post-2020 | ESpecter, FinSpy, MoonBounce | Additional UEFI bootkits identified |
As the article explains, the first known real-world attack targeting UEFI came in 2018 with the discovery of LoJax, created by the Kremlin-backed hacking group tracked under names including Sednit, Fancy Bear, and APT 28. The malware was installed remotely using tools that can read and overwrite parts of UEFI firmware’s flash memory. In 2020, researchers from Kaspersky uncovered MosaicRegressor, which checked for a malicious file in the Windows startup folder each time an infected device rebooted and installed it if absent. Researchers have yet to determine how the compromised UEFIs became infected.
Why Secure Boot Exists—and What the Expiration Means
In response to the growing threat of UEFI bootkits, Microsoft worked with device makers to develop Secure Boot, an industry-wide standard that uses cryptographic signatures to ensure each piece of firmware loaded during startup is trusted by the computer’s manufacturer. Secure Boot creates a chain of trust that prevents attackers from replacing the intended bootup firmware with malicious code. If a single link in the startup chain isn’t verified, the boot process should halt.
The upcoming expiration of the three Microsoft-signed certificates means that after June 24, systems relying on these certificates will no longer verify the authenticity of boot components. While major operating system vendors are expected to provide updated certificates, IT administrators must ensure that all devices under their management receive the updates before the deadline to avoid potential compromise. The article underscores that because bootkits survive OS reinstallation and disinfecting, prevention is far more effective than remediation.
For enterprise technology decision-makers, the takeaway is clear: immediate action is required to update the cryptographic keys on all Windows and Linux devices before June 24. Failure to do so exposes organizations to stealthy, persistent threats that can undermine even the most robust endpoint security measures.
Sources:
