0

As far as I understand, when in CSM mode, UEFI boots using MBR boot sector (from internal hard drive, external USB Flash drive, etc). And when in non-CSM mode, UEFI ignores whole existence of MBR boot sector and boots using special EFI partition. Meaning, that even if MBR boot sector is indeed infected, its code will be completely harmless as long as CSM mode is disabled. Is my understanding correct?

This question is theoretical.

Improve this question

1 Answer 1

Reset to default
1

CSM mode acts like BIOS, i.e. it does boot from the MBR.

UEFI boot uses a boot loader on a System EFI [FAT32] partition, normally EFI/BOOT/BOOTX64.EFI and completely ignores the MBR, so you're correct.

However if you really had an infected MBR you should consider any OS installed on the system compromised and unsafe to use. The best way moving forward is to wipe the entire disk clean and install from known to be clean media which means there's very little chance of low-level malware (e.g. rootkits) running on your system.

To be extra safe, it's highly recommended to enable [EFI] Secure Boot which in most circumstances (there are exceptions) guarantees that the boot loader, the OS kernel and its drivers are all digitally signed.

Improve this answer
3
  • " so you're correct." But does it boot MBR when in CSM mode? Or does it just emulate some functions of BIOS and that is it, without imitating its booting process?
    – KarmaPeasant
    Feb 7 at 2:46
  • CSM mode acts like BIOS, i.e. it does boot from the MBR.
    – Artem S. Tashkinov
    Feb 7 at 4:26
  • Please, incorporate this explicitly into your answer.
    – KarmaPeasant
    Feb 7 at 6:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .