Microsoft Patches Surface Firmware Flaw That Could Brick Devices
Microsoft has been quietly patching a firmware flaw in its Surface devices that allowed hardware to be rendered inoperable, or "bricked," by a single data packet. This vulnerability primarily affected devices where Secure Core and Secure Boot features were disabled. The flaw was inadvertently identified by Australian security researcher Jack Darcy using Microsoft's Copilot AI software, which generated a Python script that overwrote the embedded controller firmware. Microsoft has released updates for most impacted devices and is transitioning the Surface stack to a more secure architecture based on Rust code.
Microsoft has addressed a firmware flaw in its Surface devices that, under specific conditions, allowed the hardware to be bricked with a single packet. This vulnerability affected devices where Secure Core and Secure Boot security features had been disabled.
The issue was discovered by security researcher Jack Darcy in Australia. His instance of Microsoft Copilot, when asked to adjust screen backlighting on a Surface device, inadvertently generated a Python script. This script then rendered the researcher's laptop inoperable by overwriting the embedded controller firmware, sending raw SSAM ioctl commands directly to the SAM microcontroller.
Microsoft confirmed that an investigation found a deprecated UEFI interface could trigger a boot loop on some devices. To exploit this, a user would need administrator privileges and the Secure Boot feature disabled. The company has released updates to address this issue for most affected devices.
Managed devices are not considered at risk. However, individuals using Linux, Windows users who have disabled Secure Core and Secure Boot (e.g., for gaming), those using custom Windows drivers, or users with USB boot enabled, may still be vulnerable if their systems have not yet received the necessary updates.
The flaw appears to affect a range of Surface models, including Surface Laptops 3-6 and Surface Book 1-3, but not Surface Go models. ARM variants were not tested for this vulnerability.
In response to security concerns and for future reliability, Microsoft plans to shift the Surface stack to a more secure architecture. This new foundation will be based on Rust code, with initiatives like Secure EC for embedded controller firmware and Project Patina for rewriting the UEFI DXE Core. Microsoft is also developing Windows Drivers in Rust (WDR) to enhance security and reliability across its hardware ecosystem.
According to Slashdot, these efforts are open-source, promoting transparency as a key security principle for Microsoft.
Advertisement
AdSense slot • inline
