Microsoft’s newest Home windows Preview seems to set off a bug on some motherboards made by pc {hardware} producer MSI. It is the most recent motherboard misstep revealed in 2023.
In a pair of statements printed over the weekend, each Microsoft and MSI mentioned they’re conscious that putting in the most recent Home windows Preview causes some computer systems to blue display screen with an unsupported-processor error. The replace, known as KB5029351 Preview, affords new options and different enhancements for a wide range of Home windows 11 elements, together with the search app in addition to the defaults for varied apps.
As of Aug. 28, neither Microsoft nor MSI has uncovered the reason for the difficulty, and neither firm returned a request for remark.
“Each MSI and Microsoft are conscious of the ‘UNSUPPORTED_PROCESSOR’ error and have begun investigating the foundation trigger,” MSI wrote in its assertion. “Whereas the investigation is underway, we suggest that each one customers quickly chorus from putting in the KB5029351 Preview replace in Home windows.”
The difficulty is the most recent mishap in a stream of issues which have impacted motherboard makers up to now 12 months. In January, a set of 5 vulnerabilities in firmware utilized by baseboard administration controllers — distant administration chips included on many server motherboards — might have allowed distant entry over the Web. In late Could, researchers revealed {that a} backdoor in a whole lot of fashions of motherboards from Gigabyte, supposed to permit simpler updating, left computer systems open to assault. The corporate patched the difficulty the following day.
And in March, safety companies warned that the BlackLotus malware was concentrating on the Unified Extensible Firmware Interface (UEFI), which acts because the low-level software program glue between the working system and the motherboard. Unhealthy actors had been utilizing it as a method to bypass Microsoft’s Safe Boot. The US Cybersecurity and Infrastructure Safety Company (CISA) reiterated the warning earlier this month, saying that cyber defenders and firmware builders had been lagging behind menace teams of their capacity to protect towards the issues.
“UEFI is important to most computer systems,” CISA said within the name to motion. “Primarily based on current incident responses to UEFI malware similar to BlackLotus, the cybersecurity neighborhood and UEFI builders seem to nonetheless be in studying mode.”
Blue Screens and Imposed Prices
Whereas crashes typically herald the existence of vulnerabilities, the MSI motherboard challenge doubtless is not going to have safety implications, simply availability considerations, for these impacted corporations, says Nate Warfield, director of menace analysis and intelligence at Eclypsium, a firmware safety agency.
“Blue display screen of loss of life is, in and of itself, not often a vulnerability — it is one thing that people who find themselves creating exploits will run into,” he says. “So it appears like there’s some interoperability miss that occurred right here.”
Motherboards have turn out to be a posh ecosystem of applied sciences, from the Trusted Platform Module (TPM) chips that act as digital lock on the info passing via the chips on the gadgets, to the UEFI customary that permits the working system to manage low-level gadgets via drivers.
Microsoft has made Safe Boot — with its functionality to attest to the state of a machine — the inspiration of its help for zero-trust safety. For comparable causes, attackers are starting to seek for methods to bypass Safe Boot, much less as a method to achieve preliminary entry to gadgets however as a substitute to achieve persistence.
As a result of defenders have imposed extra prices on attackers via higher operating-system and utility safety, menace actors are aiming decrease, Warfield says.
“We have this multi-hundred-billion-dollar-a-year business to safe all the things above the firmware,” he says. “So for attackers, … if it prices extra to unfold to the working system or utility, they’re gonna discover locations the place it takes much less technical funding to evade safety controls.”
Do not Take Motherboard Safety for Granted
In the latest incident, there may be not so much for customers to do however watch out for utilizing preview variations of Home windows on enterprise programs.
Nevertheless, normally, corporations ought to guarantee that basic safety measures, similar to Safe Boot, are enabled on their motherboards. In 2023, this needs to be customary for all motherboards, however a minimum of one researcher found that MSI had turned off Safe Boot on a number of the motherboard fashions. In late 2022, Polish safety researcher Dawid Potocki found that one model of the corporate’s motherboards shipped with out Safe Boot.
“Do not belief that no matter safety features you enabled are working, TEST THEM!” he wrote. “By some means I used to be the primary individual to doc this, regardless that it has been first launched someplace in 2021 Q3 [a year before].”
The corporate acknowledged considerations that the motherboard settings had been too permissive.
“In response to the report of safety considerations with the preset bios settings, MSI will likely be rolling out new BIOS information for our motherboards with ‘Deny Execute’ because the default setting for increased safety ranges,” MSI said on the time. “MSI may also preserve a completely useful Safe Boot mechanism within the BIOS for end-users in order that they will modify it based on their wants.”
Organizations may additionally should develop a finer focus for his or her asset management — not simply figuring out {that a} person is on a Dell or HP laptop computer, however that the gadget is utilizing a specific motherboard and firmware model, Warfield says.
“As soon as one thing occurs, the problem for organizations turns into figuring out how lots of the programs of their fleet are affected,” he says. “That turns into so much tougher simply because it is not as as simply accessible via the instruments that folks use for managing their gadgets.”
