Vulnerability in bootloader allowed other OSes on Surface

Jul 18, 2016 09:18 GMT  ·  By

The original Surface RT was launched with much fanfare by Microsoft in October 2012, and it was running Windows RT, a highly praised operating system specifically designed for tablets and that was all about apps published in the Windows Store.

Windows RT, however, failed to become a hit, and Microsoft was one of the few companies that actually supported it, so despite the obvious low adoption, Redmond even launched a second Surface running the same operating system one year later.

And yet, Windows RT devices have remained rather outdated, even though Microsoft keeps rolling out security patches for these tablets. And one of these security patches released earlier this month comes to fix a vulnerability that nobody ever knew about.

The Register claims that MS16-094 fixes a loophole that allowed users to install other operating systems on Windows RT devices, including here Linux. With Windows RT becoming an OS with no future, many have looked into ways to install a different operating system on the Surface RT, but most attempts failed because of the locked bootloader and the other security systems that Microsoft put in place.

Linux on the Surface RT

But it turns out that there was actually a way to do that, only that nobody knew about it. And with this recent patch, Microsoft has fixed it anyway, so there’s practically no other method of installing Linux or a different OS on the Surface RT anymore.

According to Microsoft’s official bulletin page, this is what the new patch does on your Windows RT device:

“A security feature bypass vulnerability exists when Windows Secure Boot improperly applies an affected policy. An attacker who successfully exploited this vulnerability could disable code integrity checks, allowing test-signed executables and drivers to be loaded on a target device. In addition, an attacker could bypass the Secure Boot Integrity Validation for BitLocker and the Device Encryption security features.”

As a Surface RT owner, I must admit that a different OS version might actually bring the device to life, especially because Microsoft is no longer improving the platform, but only patching security issues.

Linux seems to be the only choice for the time being, and we’re pretty sure that the dev community will once again start looking into this now that it’s known that a security vulnerability allowed the installation of different operating systems.