Microsoft’s newest Home windows Preview seems to set off a bug on some motherboards made by pc {hardware} producer MSI. It is the most recent motherboard misstep revealed in 2023.
In a pair of statements printed over the weekend, each Microsoft and MSI stated they’re conscious that putting in the most recent Home windows Preview causes some computer systems to blue display screen with an unsupported-processor error. The replace, known as KB5029351 Preview, affords new options and different enhancements for quite a lot of Home windows 11 elements, together with the search app in addition to the defaults for numerous apps.
As of Aug. 28, neither Microsoft nor MSI has uncovered the reason for the problem, and neither firm returned a request for remark.
“Each MSI and Microsoft are conscious of the ‘UNSUPPORTED_PROCESSOR’ error and have begun investigating the foundation trigger,” MSI wrote in its assertion. “Whereas the investigation is underway, we advocate that every one customers quickly chorus from putting in the KB5029351 Preview replace in Home windows.”
The difficulty is the most recent mishap in a stream of issues which have impacted motherboard makers up to now 12 months. In January, a set of 5 vulnerabilities in firmware utilized by baseboard administration controllers — distant administration chips included on many server motherboards — might have allowed distant entry over the Web. In late Might, researchers revealed {that a} backdoor in lots of of fashions of motherboards from Gigabyte, meant to permit simpler updating, left computer systems open to assault. The corporate patched the problem the following day.
And in March, safety corporations warned that the BlackLotus malware was focusing on the Unified Extensible Firmware Interface (UEFI), which acts because the low-level software program glue between the working system and the motherboard. Unhealthy actors had been utilizing it as a method to bypass Microsoft’s Safe Boot. The US Cybersecurity and Infrastructure Safety Company (CISA) reiterated the warning earlier this month, saying that cyber defenders and firmware builders had been lagging behind menace teams of their capacity to protect towards the issues.
“UEFI is important to most computer systems,” CISA acknowledged within the name to motion. “Primarily based on current incident responses to UEFI malware equivalent to BlackLotus, the cybersecurity group and UEFI builders seem to nonetheless be in studying mode.”
Blue Screens and Imposed Prices
Whereas crashes typically herald the existence of vulnerabilities, the MSI motherboard challenge probably is not going to have safety implications, simply availability considerations, for these impacted corporations, says Nate Warfield, director of menace analysis and intelligence at Eclypsium, a firmware safety agency.
“Blue display screen of loss of life is, in and of itself, not normally a vulnerability — it is one thing that people who find themselves creating exploits will run into,” he says. “So it appears like there’s some interoperability miss that occurred right here.”
Motherboards have change into a posh ecosystem of applied sciences, from the Trusted Platform Module (TPM) chips that act as digital lock on the info passing by means of the chips on the units, to the UEFI commonplace that allows the working system to regulate low-level units by means of drivers.
Microsoft has made Safe Boot — with its functionality to attest to the state of a machine — the inspiration of its help for zero-trust safety. For related causes, attackers are starting to seek for methods to bypass Safe Boot, much less as a method to achieve preliminary entry to units however as an alternative to achieve persistence.
As a result of defenders have imposed extra prices on attackers by means of higher operating-system and software safety, menace actors are aiming decrease, Warfield says.
“We have this multi-hundred-billion-dollar-a-year business to safe the whole lot above the firmware,” he says. “So for attackers, … if it prices extra to unfold to the working system or software, they’re gonna discover locations the place it takes much less technical funding to evade safety controls.”
Do not Take Motherboard Safety for Granted
In the newest incident, there’s not lots for customers to do however watch out for utilizing preview variations of Home windows on enterprise methods.
Nonetheless, normally, corporations ought to guarantee that elementary safety measures, equivalent to Safe Boot, are enabled on their motherboards. In 2023, this ought to be commonplace for all motherboards, however no less than one researcher found that MSI had turned off Safe Boot on among the motherboard fashions. In late 2022, Polish safety researcher Dawid Potocki found that one model of the corporate’s motherboards shipped with out Safe Boot.
“Do not belief that no matter safety features you enabled are working, TEST THEM!” he wrote. “Someway I used to be the primary particular person to doc this, despite the fact that it has been first launched someplace in 2021 Q3 [a year before].”
The corporate acknowledged considerations that the motherboard settings had been too permissive.
“In response to the report of safety considerations with the preset bios settings, MSI will probably be rolling out new BIOS recordsdata for our motherboards with ‘Deny Execute’ because the default setting for greater safety ranges,” MSI acknowledged on the time. “MSI can even maintain a completely practical Safe Boot mechanism within the BIOS for end-users in order that they’ll modify it based on their wants.”
Organizations may should develop a finer focus for his or her asset management — not simply figuring out {that a} consumer is on a Dell or HP laptop computer, however that the system is utilizing a specific motherboard and firmware model, Warfield says.
“As soon as one thing occurs, the problem for organizations turns into figuring out how most of the methods of their fleet are affected,” he says. “That turns into lots tougher simply because it isn’t as as simply accessible by means of the instruments that individuals use for managing their units.”
