Microsoft’s newest Home windows Preview seems to set off a bug on some motherboards made by laptop {hardware} producer MSI. It is the most recent motherboard misstep revealed in 2023.
In a pair of statements printed over the weekend, each Microsoft and MSI mentioned they’re conscious that putting in the most recent Home windows Preview causes some computer systems to blue display screen with an unsupported-processor error. The replace, known as KB5029351 Preview, provides new options and different enhancements for quite a lot of Home windows 11 parts, together with the search app in addition to the defaults for numerous apps.
As of Aug. 28, neither Microsoft nor MSI has uncovered the reason for the problem, and neither firm returned a request for remark.
“Each MSI and Microsoft are conscious of the ‘UNSUPPORTED_PROCESSOR’ error and have begun investigating the basis trigger,” MSI wrote in its assertion. “Whereas the investigation is underway, we advocate that every one customers quickly chorus from putting in the KB5029351 Preview replace in Home windows.”
The problem is the most recent mishap in a stream of issues which have impacted motherboard makers prior to now yr. In January, a set of 5 vulnerabilities in firmware utilized by baseboard administration controllers — distant administration chips included on many server motherboards — may have allowed distant entry over the Web. In late Might, researchers revealed {that a} backdoor in lots of of fashions of motherboards from Gigabyte, meant to permit simpler updating, left computer systems open to assault. The corporate patched the problem the subsequent day.
And in March, safety corporations warned that the BlackLotus malware was focusing on the Unified Extensible Firmware Interface (UEFI), which acts because the low-level software program glue between the working system and the motherboard. Unhealthy actors had been utilizing it as a technique to bypass Microsoft’s Safe Boot. The US Cybersecurity and Infrastructure Safety Company (CISA) reiterated the warning earlier this month, saying that cyber defenders and firmware builders had been lagging behind menace teams of their capability to protect towards the issues.
“UEFI is important to most computer systems,” CISA acknowledged within the name to motion. “Based mostly on latest incident responses to UEFI malware similar to BlackLotus, the cybersecurity neighborhood and UEFI builders seem to nonetheless be in studying mode.”
Blue Screens and Imposed Prices
Whereas crashes typically herald the existence of vulnerabilities, the MSI motherboard situation doubtless is not going to have safety implications, simply availability considerations, for these impacted corporations, says Nate Warfield, director of menace analysis and intelligence at Eclypsium, a firmware safety agency.
“Blue display screen of loss of life is, in and of itself, not often a vulnerability — it is one thing that people who find themselves growing exploits will run into,” he says. “So it seems like there’s some interoperability miss that occurred right here.”
Motherboards have turn into a posh ecosystem of applied sciences, from the Trusted Platform Module (TPM) chips that act as digital lock on the information passing by the chips on the units, to the UEFI normal that allows the working system to manage low-level units by drivers.
Microsoft has made Safe Boot — with its functionality to attest to the state of a machine — the inspiration of its assist for zero-trust safety. For comparable causes, attackers are starting to seek for methods to bypass Safe Boot, much less as a technique to acquire preliminary entry to units however as an alternative to achieve persistence.
As a result of defenders have imposed extra prices on attackers by higher operating-system and software safety, menace actors are aiming decrease, Warfield says.
“We have this multi-hundred-billion-dollar-a-year trade to safe all the things above the firmware,” he says. “So for attackers, … if it prices extra to unfold to the working system or software, they’re gonna discover locations the place it takes much less technical funding to evade safety controls.”
Do not Take Motherboard Safety for Granted
In the newest incident, there’s not so much for customers to do however watch out for utilizing preview variations of Home windows on enterprise methods.
Nevertheless, typically, corporations ought to ensure that basic safety measures, similar to Safe Boot, are enabled on their motherboards. In 2023, this ought to be normal for all motherboards, however not less than one researcher found that MSI had turned off Safe Boot on among the motherboard fashions. In late 2022, Polish safety researcher Dawid Potocki found that one model of the corporate’s motherboards shipped with out Safe Boot.
“Do not belief that no matter safety features you enabled are working, TEST THEM!” he wrote. “By some means I used to be the primary individual to doc this, though it has been first launched someplace in 2021 Q3 [a year before].”
The corporate acknowledged considerations that the motherboard settings had been too permissive.
“In response to the report of safety considerations with the preset bios settings, MSI shall be rolling out new BIOS recordsdata for our motherboards with ‘Deny Execute’ because the default setting for greater safety ranges,” MSI acknowledged on the time. “MSI will even preserve a completely useful Safe Boot mechanism within the BIOS for end-users in order that they’ll modify it in line with their wants.”
Organizations might also need to develop a finer focus for his or her asset management — not simply understanding {that a} person is on a Dell or HP laptop computer, however that the machine is utilizing a specific motherboard and firmware model, Warfield says.
“As soon as one thing occurs, the problem for organizations turns into understanding how lots of the methods of their fleet are affected,” he says. “That turns into so much more durable simply because it isn’t as as simply accessible by the instruments that individuals use for managing their units.”
