Microsoft mishaps apparently exposed 'golden keys' to mobile security
Microsoft engineers appear to have inadvertently released software files that are intended to unlock the security protections built into many of the company's phones and tablets.
The files could allow attackers so much access to protected systems that the researchers who discovered them dubbed the files "golden keys" for access to millions of the tech giant's products.
Anyone with the "keys," according to security researchers using the handles my123 and slipstream, could install any software – including malware – on these devices to steal sensitive data or surveil Microsoft users without their knowledge.
"Microsoft implemented a 'secure golden key' system," the researchers said. And because of an unknown issue at the company, they said, the keys were released into the wild.
The two researchers said the mishap is a prime example of why companies shouldn't maintain master keys for access to security systems or to unlock encrypted communications – a suggestion that some in Washington have made for providing the US government access to private communications during criminal or terrorist investigations.
But many security researchers have warned that creating so-called "golden keys" would only put the public at greater security risk if those keys were ever leaked or mishandled.
"This is a perfect real world example about why your idea of backdooring cryptosystems with a 'secure golden key' is very bad," the researchers said in their blog post.
In this case, the Microsoft "keys" are really a set of rules or policies that the company developed for internal use to make it easier for software developers to test new software on systems running a security program called Secure Boot.
In a statement, a Microsoft spokesman said the issues raised by the two researchers in their report do not apply to Windows desktop or business systems. In order to take advantage of the keys, someone would still need physical access and administrative rights to phones and devices running Windows RT, a now discontinued operating system for mobile devices.
The techniques for getting around Secure Boot described in the report also do not compromise encryption protections, the spokesman said.
Secure Boot ensures that only manufacturer-trusted software and firmware runs on a Windows device when it is starting up. Users cannot make certain changes to their devices, like swapping out the operating system or installing an unapproved graphics card, when Secure Boot is enabled.
Microsoft users have the option of disabling the technology on their own in many cases. With some devices, however, such as phones and tablets running Windows RT operating system, they cannot.
In the case, the so-called golden keys allow users to disable Secure Boot in such instances and essentially give them a way to install another operating system or make device changes that would not have been previously possible. Bad actors with access to the keys can install malware of their choice on these devices.
The two security researchers claimed they first found the policies for getting around Secure Boot between March and April this year and informed Microsoft of their discovery. It is not immediately clear how the keys may have leaked or ended in the security researchers' hands.
After refusing to acknowledge the issue for weeks, Microsoft finally issued an initial fix for the problem in July while also awarding the researchers a bug bounty.
According to the researchers, the initial fix did not fully address the issue prompting Microsoft to release another patch this month. But even with the fixes, certain technical realities make it impossible for Microsoft to close the backdoor on all Windows systems running Secure Boot, they claimed.
