Security researchers have found a flaw in Microsoft’s implementation of the Microsoft Windows Platform Binary Table (WPBT) mechanism, which can be exploited to compromise computers running Windows 8 and Windows 10 operating systems.
Microsoft describes WPBT as a fixed firmware Advanced Configuration and Power Interface (ACPI) table that was introduced with Windows 8 to enable OEMs and vendors to execute programs every time the Windows device boots up.
“The Eclypsium research team has identified a weakness in Microsoft’s WPBT capability that can allow an attacker to run malicious code with kernel privileges when a device boots up,” note the researchers.
- Protect your devices with these best antivirus software
- Here's our choice of the best malware removal software on the market
- These are the best ransomware protection tools
The researchers backed their claims with a video demonstrating the attacks on a secured-core PC running the latest boot protections.
OEM rootkit
The researchers claim that while WPBT has been adopted by popular vendors including Lenovo, ASUS, and several others, security researcher and co-author of Windows Internals, Alex Ionescu has flagged the dangers of WPBT as a rootkit as early as 2012.
Eclypsium found the vulnerability in WPBT while working on the BIOSDisconnect vulnerabilities it reported earlier this year in June, which exposed Dell devices to remote execution attacks.
The WPBT issue stems from the fact that while Microsoft requires a WPBT binary to be signed, it will accept an expired or revoked certificate, giving attackers the opportunity to sign malicious binaries with “any readily available expired certificate.”
“This weakness can be potentially exploited via multiple vectors (e.g. physical access, remote, and supply chain) and by multiple techniques (e.g. malicious bootloader, DMA, etc),” the researchers reason.
- These are the best endpoint protection tools
