Millions of Windows 10 PCs exposed by nasty security vulnerability

Security researchers have found a flaw in Microsoft’s implementation of the Microsoft Windows Platform Binary Table (WPBT) mechanism, which can be exploited to compromise computers running Windows 8 and Windows 10 operating systems.

Microsoft describes WPBT as a fixed firmware Advanced Configuration and Power Interface (ACPI) table that was introduced with Windows 8 to enable OEMs and vendors to execute programs every time the Windows device boots up.

“The Eclypsium research team has identified a weakness in Microsoft’s WPBT capability that can allow an attacker to run malicious code with kernel privileges when a device boots up,” note the researchers.

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window <<

Protect your devices with these best antivirus software
Here's our choice of the best malware removal software on the market
These are the best ransomware protection tools

The researchers backed their claims with a video demonstrating the attacks on a secured-core PC running the latest boot protections.

OEM rootkit

The researchers claim that while WPBT has been adopted by popular vendors including Lenovo, ASUS, and several others, security researcher and co-author of Windows Internals, Alex Ionescu has flagged the dangers of WPBT as a rootkit as early as 2012.

Eclypsium found the vulnerability in WPBT while working on the BIOSDisconnect vulnerabilities it reported earlier this year in June, which exposed Dell devices to remote execution attacks.

The WPBT issue stems from the fact that while Microsoft requires a WPBT binary to be signed, it will accept an expired or revoked certificate, giving attackers the opportunity to sign malicious binaries with “any readily available expired certificate.”

“This weakness can be potentially exploited via multiple vectors (e.g. physical access, remote, and supply chain) and by multiple techniques (e.g. malicious bootloader, DMA, etc),” the researchers reason.