Beelink ME Mini - Secure Boot compromised?

Junior70

I checked the latest M1V307 firmware for the N150 12Gb version of the ME Mini which still holds the pkfail compromised secure boot certificates. I run Ubuntu Server on this device (which I’m very happy with) which gave me this message in the morning:

3 devices have a firmware upgrade available.
Run `fwupdmgr get-upgrades` for more information.

Last login: Wed Sep 24 18:32:08 2025 from 192.168.0.xxx
root@beelink:~# fwupdmgr get-upgrades
WARNING: UEFI capsule updates not available or enabled in firmware setup
See https://github.com/fwupd/fwupd/wiki/PluginFlag:capsules-unsupported for more information.
Devices with no available firmware updates:
 ~ KINGSTON xxx
 ~ Lexar SSD xxx
 ~ Lexar SSD xxx
 ~ Lexar SSD xxx
 ~ Windows Production PCA
AZW ME mini

tqKEK CA:
    Device ID:          b7a1d3d90faa1f6275d9a98da4fb3be7118e61c7
    Current version:    2011
    Vendor:             Microsoft (UEFI:Microsoft)
    GUIDs:              814e950f-1449-566a-a190-42c9d3a3a2df ? UEFI\VENDOR_Microsoft&NAME_Microsoft-KEK-CA
                        dfa66406-6568-5bdf-bb8e-b53ddb4be4cf ? UEFI\CRT_9F402B1CC0243CBEDC58A525789816CCCA7687A9
    Device Flags:       ~ Internal device
                        ~ Updatable
                        ~ Supported on remote server
                        ~ Needs a reboot after installation
                        ~ Device is usable for the duration of the update
                        ~ Signed Payload
                        ~ Can tag for emulation
 
 tqSecure Boot KEK Configuration Update:
      New version:      2023
      Remote ID:        lvfs
      Release ID:       113893
      Summary:          UEFI Secure Boot Key Exchange Key
      Variant:          AMI
      License:          Proprietary
      Size:             2.8 kB
      Created:          2025-04-29
      Urgency:          High
      Vendor:           Linux Foundation
      Release Flags:    ~ Trusted metadata
                        ~ Is upgrade
      Description:
      This updates the UEFI Signature Database (the "KEK") to the latest release from Microsoft, signed by DO NOT TRUST - AMI Test PK.
      Checksum:         103ebd21a803540296daff93fa7e1595bf323b4db78fbc6287aed945ab5965fb

The “DO NOT TRUST - AMI Test PK” is a known compromised firmware (see for instance https://www.binarly.io/blog/pkfail-untrusted-platform-keys-undermine-secure-boot-on-uefi-ecosystem for detailed info).

The M1V305 firmware seemed to suggest this was fixed given the name of the firmware zip file, but also that firmware has the compromised parts in it.

Is Beelink aware? Are you working on getting this structurally fixed?

Beelink CS-George

Hi there, did you enable the secure boot in the BIOS

Junior70

Beelink CS-George I have not yet. Would first like to understand Beelink’s answer to this situation.

poohbear

The maintainers of fwupd describes what is necessary to enable these updates here:
https://github.com/fwupd/fwupd/wiki/PluginFlag:capsules-unsupported

My question is; which setting does this correspond to on a Beelink machine? I have a SER5 but cannot find any setting in the AMI tool that sounds like the one needed to be changed. So Beelink support: which setting do we need to change in our BIOS to enable fwupd to perform these upgrades?

Being unable to perform regular UEFI KEK updates is of course a pretty serious security problem…

Beelink CS-George

poohbear Hello there,

Please press delete key as soon as you turn on the PC, so that you can go to BIOS. Please send us a picture of the Main page.
We will check if you need to update the BIOS.

Beelink CS-George

Junior70 Please enable secure boot in the BIOS to see if it works.

Here is the tutorial https://buildin.ai/lizong/262ce514-3f67-4324-8127-9962a33b1d4d

poohbear

I have always had Secure Boot enabled, but am unable to update the UEFI capsules. See attached screenshots for BIOS main page and Secure Boot page. I need to be able to update insecure keys or the computer is not safely usable. Thanks

Image description

Beelink CS-George

poohbear
Are you referring to the Windows product key or the key required within the BIOS?
If it’s within the BIOS, simply clear the CMOS.
Please try resetting the CMOS:
First, Please turn off the PC , unplug the power supply, and press the CMOS button (if no CMOS button, please put the pin in the CMOS pinhole and press it ) for about 10 seconds , restart the PC after ten minutes. Here is the tutorial https://mega.nz/file/XypwTISY#DVT0BsjOgiPkZ-drQaj88JH9Z7f7qpKGP2E3nMHW8ms or https://url.bee-link.cn/5FdW

poohbear

Hello. No I am not talking about the product key. I am talking about the signing keys in the UEFI firmware. Please look at my earlier link: https://github.com/fwupd/fwupd/wiki/PluginFlag:capsules-unsupported to understand what I mean.

These are the keys that can sign binaries etc. to ensure the integrity of the Secure Boot process. If vulnerable keys etc. are in use, as in this case, they must be removed and update. This can be done on Linux with the fwupdmgr tool for example. My system uses old and vulnerable keys and it must be updated, or else I cannot trust it. As written in the link I posted about the BIOS must allow “capsule updates”. My question is; how to I turn these on on this system?

This is a list from my system with the UEFI capsule updates that currently CANNOT BE PERFORMED, since capsule updates are not allowed:
`
AZW SER
│
├─KEK CA:
│ │ Device ID: b7a1d3d90faa1f6275d9a98da4fb3be7118e61c7
│ │ Current version: 2011
│ │ Vendor: Microsoft (UEFI:Microsoft)
│ │ GUIDs: 814e950f-1449-566a-a190-42c9d3a3a2df ← UEFI\VENDOR_Microsoft&NAME_Microsoft-KEK-CA
│ │ dfa66406-6568-5bdf-bb8e-b53ddb4be4cf ← UEFI\CRT_9F402B1CC0243CBEDC58A525789816CCCA7687A9
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Device is usable for the duration of the update
│ │ • Signed Payload
│ │ • Can tag for emulation
│ │
│ ├─Secure Boot KEK Configuration Update:
│ │ New version: 2023
│ │ Remote ID: lvfs
│ │ Release ID: 113893
│ │ Summary: UEFI Secure Boot Key Exchange Key
│ │ Variant: AMI
│ │ License: Proprietary
│ │ Size: 2.8 kB
│ │ Created: 2025-04-29 00:00:00
│ │ Urgency: High
│ │ Vendor: Linux Foundation
│ │ Release Flags: • Trusted metadata
│ │ • Is upgrade
│ │ Description:
│ │ This updates the UEFI Signature Database (the “KEK”) to the latest release from Microsoft, signed by DO NOT TRUST - AMI Test PK.
│ │ Checksum: 103ebd21a803540296daff93fa7e1595bf323b4db78fbc6287aed945ab5965fb
│ │
│ └─Secure Boot KEK Configuration Update:
│ New version: 2023
│ Remote ID: lvfs
│ Release ID: 113905
│ Summary: UEFI Secure Boot Key Exchange Key
│ Variant: ASUS
│ License: Proprietary
│ Size: 2.8 kB
│ Created: 2025-04-29 00:00:00
│ Urgency: High
│ Vendor: Linux Foundation
│ Release Flags: • Trusted metadata
│ • Is upgrade
│ Description:
│ This updates the UEFI Signature Database (the “KEK”) to the latest release from Microsoft, signed by DO NOT TRUST - AMI Test PK.
│ Checksum: 73ea2c69621eec29df454264907a2d3586d57ab2e58b7ff596d013bc37ca1714
│
├─UEFI CA:
│ │ Device ID: 5bc922b7bd1adb5b6f99592611404036bd9f42d0
│ │ Current version: 2011
│ │ Vendor: Microsoft (UEFI:Microsoft)
│ │ GUIDs: 26f42cba-9bf6-5365-802b-e250eb757e96 ← UEFI\VENDOR_Microsoft&NAME_Microsoft-UEFI-CA
│ │ c34a7e6a-bd86-5244-8bd0-7db66fd3c073 ← UEFI\CRT_E30CF09DABEAB32A6E3B07A7135245DE05FFB658
│ │ Device Flags: • Internal device
│ │ • Updatable
│ │ • Supported on remote server
│ │ • Needs a reboot after installation
│ │ • Signed Payload
│ │ • Can tag for emulation
│ │
│ └─Secure Boot Signature Database Configuration Update:
│ New version: 2023
│ Remote ID: lvfs
│ Release ID: 116503
│ Summary: UEFI Secure Boot Signature Database
│ License: Proprietary
│ Size: 10.0 kB
│ Created: 2025-04-29 00:00:00
│ Urgency: High
│ Tested: 2025-10-17 00:00:00
│ Distribution: fedora 42 (workstation)
│ Old version: 2011
│ Version[fwupd]: 2.0.16
│ Tested: 2025-09-17 00:00:00
│ Distribution: fedora 42 (workstation)
│ Old version: 2011
│ Version[fwupd]: 2.0.16
│ Tested: 2025-07-24 00:00:00
│ Distribution: nixos 25.11
│ Old version: 2011
│ Version[fwupd]: 2.0.12
│ Vendor: Linux Foundation
│ Release Flags: • Trusted metadata
│ • Is upgrade
│ Description:
│ This updates the 3rd Party UEFI Signature Database (the “db”) to the latest release from Microsoft.It also adds the latest OptionROM UEFI Signature Database update.
│ Checksum: 6819c8098f09f4332a102194df6a033563aa288073b16315c5b88860fefb7e74
│
└─UEFI dbx:
│ Device ID: 362301da643102b9f38477387e2193e57abaa590
│ Summary: UEFI revocation database
│ Current version: 20230501
│ Minimum Version: 20230501
│ Vendor: UEFI:Microsoft
│ Install Duration: 1 second
│ GUID: f8ba2887-9411-5c36-9cee-88995bb39731 ← UEFI\CRT_A1117F516A32CEFCBA3F2D1ACE10A87972FD6BBE8FE0D0B996E09E65D802A503&ARCH_X64
│ Device Flags: • Internal device
│ • Updatable
│ • Supported on remote server
│ • Needs a reboot after installation
│ • Device is usable for the duration of the update
│ • Only version upgrades are allowed
│ • Signed Payload
│ • Can tag for emulation
│
├─Secure Boot dbx Configuration Update:
│ New version: 20250902
│ Remote ID: lvfs
│ Release ID: 130035
│ Summary: UEFI Secure Boot Forbidden Signature Database
│ Variant: x64
│ License: Proprietary
│ Size: 24.1 kB
│ Created: 2025-09-02 00:00:00
│ Urgency: High
│ Tested: 2025-12-15 00:00:00
│ Distribution: ubuntu 25.10
│ Old version: 20230501
│ Version[fwupd]: 2.0.16
│ Tested: 2025-12-05 00:00:00
│ Distribution: fedora 42 (workstation)
│ Old version: 20250507
│ Version[fwupd]: 2.0.17
│ Tested: 2025-11-10 00:00:00
│ Distribution: fedora 43 (kde)
│ Old version: 20230501
│ Version[fwupd]: 2.0.16
│ Vendor: Linux Foundation
│ Duration: 1 second
│ Release Flags: • Trusted metadata
│ • Is upgrade
│ • Tested by trusted vendor
│ Description:
│ This updates the list of forbidden signatures (the “dbx”) to the latest release from Microsoft.
│
│ Some insecure versions of the IGEL bootloader were added, due to a security vulnerability that allowed an attacker to bypass UEFI Secure Boot.
│ Issue: CVE-2025-47827
│ Checksum: 7178302fa23fcb875e7540900e299fb30a76758663efb7e1c56edc25cd3f316a
│
├─Secure Boot dbx Configuration Update:
│ New version: 20250507
│ Remote ID: lvfs
│ Release ID: 115586
│ Summary: UEFI Secure Boot Forbidden Signature Database
│ Variant: x64
│ License: Proprietary
│ Size: 24.0 kB
│ Created: 2025-01-17 00:00:00
│ Urgency: High
│ Tested: 2025-10-17 00:00:00
│ Distribution: fedora 42 (workstation)
│ Old version: 20230501
│ Version[fwupd]: 2.0.16
│ Tested: 2025-06-11 00:00:00
│ Distribution: fedora 42 (workstation)
│ Old version: 20241101
│ Version[fwupd]: 2.0.11
│ Vendor: Linux Foundation
│ Duration: 1 second
│ Release Flags: • Trusted metadata
│ • Is upgrade
│ • Tested by trusted vendor
│ Description:
│ This updates the list of forbidden signatures (the “dbx”) to the latest release from Microsoft.
│
│ Some insecure versions of BiosFlashShell and Dtbios by DT Research Inc were added, due to a security vulnerability that allowed an attacker to bypass UEFI Secure Boot.
│ Issues: 806555
│ CVE-2025-3052
│ Checksum: 40d3a4630619b83026f66bc64d97a582bbd9223ad53aa3f519ff5e2121d11ca6
│
└─Secure Boot dbx Configuration Update:
New version: 20241101
Remote ID: lvfs
Release ID: 105821
Summary: UEFI Secure Boot Forbidden Signature Database
Variant: x64
License: Proprietary
Size: 15.1 kB
Created: 2025-01-17 00:00:00
Urgency: High
Tested: 2025-10-31 00:00:00
Distribution: ubuntu 24.04
Old version: 20230501
Version[fwupd]: 1.9.28
Vendor: Linux Foundation
Duration: 1 second
Release Flags: • Trusted metadata
• Is upgrade
Description:
This updates the list of forbidden signatures (the “dbx”) to the latest release from Microsoft.

    An insecure version of Howyar's SysReturn software was added, due to a security vulnerability that allowed an attacker to bypass UEFI Secure Boot.
    Issues:           529659
                      CVE-2024-7344
    Checksum:         093e6913dfecefbdaa9374a2e1caee7bf7e74c7eda847624e456e344884ba5f6

`
Thank you.

Beelink CS-George

poohbear
Your device isn’t an ME MINI, is it?
Please provide a photo showing the SN code on the bottom of the device.

poohbear

Hello. No it is a SER. I have sent you the serial number in a private message.

A bit more background:
Without being able to update SecureBoot keys the secure boot process can no longer be trusted. All parts of the boot chain; firmware, drivers, bootstrap processes etc, are signed with keys trusted by the BIOS. If these keys are compromised somehow the integrity of the boot sequence cannot be trusted. This is why it is so important to only have trusted and updated keys in the BIOS. Thanks again.

Beelink CS-George

poohbear
Thank you for your reply.
I will consult the relevant staff and follow up with you via private message.

poohbear

Hello. Any update here? Still waiting on a reply.

Beelink CS-George

poohbear
I have replied to you via private message.