[Windows 10, 8, 7, XP etc.] notNSA:
BACKGROUND

: ACPI carries major security risks.

Ubuntu founder Mark Shuttleworth has likened ACPI to Trojan horses. He has described proprietary firmware (ACPI-related or any other firmware) as a security risk, saying that "firmware on your device is the NSA's best friend" and calling firmware (ACPI or non-ACPI) "a Trojan horse of monumental proportions". He has pointed out that low quality, closed source firmware is a major threat to system security:[12] "Your biggest mistake is to assume that the NSA is the only institution abusing this position of trust — in fact, it's reasonable to assume that all firmware is a cesspool of insecurity, courtesy of incompetence of the highest degree from manufacturers, and competence of the highest degree from a very wide range of such agencies." As a solution to this problem, he has called for open-source, declarative firmware (ACPI or non-ACPI),[12] which instead of containing executable code, only describes "hardware linkage and dependencies".

VULNERABILITY

: Windows 10 packages a Windows management interface for ACPI (wmiacpi.sys).

It's a way for low firmware/BIOS to communicate with Windows. Most consumers do not have BIOS code in general and at runtime - so this is a security risk. Bad actors may utilize this interface to gain full access to Windows by modifying low-level code of BIOS, for example. I have seen a BIOS rootkit, Ubuntu founder is spot on. It is safe to hypothesize BIOS rootkits are endemic and are used by intelligence agencies and countless really bad actors who may live nextdoor.

SOLUTION

: Remove Windows management interface and Microsoft System Management BIOS driver from a Windows 10 machine BEFORE installation.

It is crucial this interface driver is removed BEFORE installation, not after. This is key. If it's removed post install you have already opened your machine up to manipulation during installation, with damage already done. This removal requires using DISM to unpackage the installation media's boot and install disks, deleting every file (and folder) with "wmiacpi" and "mssmbios" mention in it (see sample code below), repackaging the disks and only then installing Windows.

COMMENTS

: Your computer is still vulnerable but less so. Closing as many unneeded Windows services, running a tight firewall, minimizing the machine operational footprint are indispensable for security.

Here's the sample code for file deletion within unpacked boot and install disks from Windows installation media:

Rem delete files

set files=C:\temp\Windows\INF\wmiacpi.inf

set files=%files%;C:\temp\Windows\System32\drivers\wmiacpi.sys

set files=%files%;C:\temp\Windows\WinSxS\Manifests\amd64_dual_wmiacpi.inf_31bf3856ad364e35_10.0.19041.1_none_96ee9c20ffe98c11.manifest

set files=%files%;C:\temp\Windows\System32\DriverStore\en-US\wmiacpi.inf_loc

set files=%files%;C:\temp\Windows\WinSxS\Manifests\amd64_wmiacpi.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_2d0bb86732bc23a8.manifest

set files=%files%;C:\temp\Windows\WinSxS\Manifests\amd64_wmiacpi.inf-languagepack_31bf3856ad364e35_10.0.19041.1_en-us_8fc1e10debc33cb9.manifest

set files=%files%;"C:\temp\Windows\INF\wmiacpi.PNF"

for %%a in (%files%) do (

takeown /f %%a

ICACLS %%a /grant %username%:F

del /q /f %%a

)