About 300 MSI Motherboard Models Have a Faulty Secure Boot Implementation with Certain UEFI Firmware Versions

[BatRastard]

I actually discovered MSI's Secure Boot issues in October 2021 when I tried to get enroll Ventoy's MOK Manager to no avail on my B550 A-PRO. The BIOS that shipped with the board was from January and when I updated to AGESA 1.2.0.3c, Secure Boot stopped Ventoy dead. I gave up until I flashed to AGESA 1.2.0.6 and this BIOS triggered a language corruption bug in the BIOS if an ExFat USB was inserted, so I didn't trust testing to see if Ventoy would enroll. Finally, MSI released AGESA 1.2.0.7 in June and later re-released another AGESA 1.2.0.7 in August and this BIOS enrolled Ventoy's MOK Manager right out of the gate. The changelog on these BIOS releases were the same: "Windows 11 Support. Change the default setting for Secure Boot" This is where MSI blanket changed the default policy from "Query User" to "Always Execute" but never said a peep about that in the changelog ...

EDIT: ROFLMAO

MSI Statement on Secure Boot
by u/MSI_TechK in MSI_Gaming

 

[dawidpotocki]

If it’s indeed an issue with only beta firmware, then this feels like a tempest in a thimble. Props to the dude for self marketing I guess.

It's not an issue with beta firmware, it's just where it has been introduced first for a lot of motherboards. A lot of stable firmware released after September 2021 is affected.

How did he test ~300 motherboards?

I have mentioned this in my blog post.

MSI's (in)Secure Boot - Dawid Potocki

dawidpotocki.com

TL;DR: Extracting information from firmware files.

In his original article he has added this:


I see this story is everywhere now. Did none of them read the original article? https://dawidpotocki.com/en/2023/01/13/msi-insecure-boot/

Hah, only The Register has read my original article. Their reporter also contacted me via email about the issue and was very responsive. Overall he has done a really good job. They ended up publishing the article later than others, but they noticed my article on 13th, the day I have published it, they just had some other story come up and had to delay it.
Most sites have copied from BleepingComputer which had the same mistakes as some other smaller site which made an article earlier by like 12 hours… weird, isn't it?

 

[DrCR]

It's not an issue with beta firmware, it's just where it has been introduced first for a lot of motherboards. A lot of stable firmware released after September 2021 is affected.

Gotcha, makes some of the statements make a lot more sense.

Welcome to the forum.

 

[eidairaman1]

Msi, failing since 2010...

 

[AusWolf]

If secure boot wasn't worthless (on a home PC at least), this flaw would have been discovered a long time ago.