In 2023, the malware tracked as BlackLotus became the first publicly documented wild UEFI boot kit capable of bypassing Secure Boot on fully updated Windows 11 systems. Once the industry-wide chain of trust mechanism was subverted, the malware was able to execute malicious code before Windows was fully loaded and many security defenses were operational.
Microsoft had already patched the vulnerability exploited by BlackLotus in 2022. In 2023 and 2024, Microsoft released additional updates. The first added a new certificate that no longer trusted vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign vulnerable old Windows boot managers. Organizations infected with the new bootkit, tracked as BlackX, had installed all of these patches. So how were they victims?
UEFI Boot Kit Refresh
Before discussing the incident further, a brief review of BlackLotus and UEFI malware is in order. Short for Unified Extensible Firmware Interface, UEFI is firmware that runs immediately after turning on a computer. One of its primary tasks is to load system configuration settings, identify and initialize hardware components, and prepare the computer to boot its operating system.
Another important feature of UEFI is Secure Boot, a security feature that establishes a chain of trust by verifying the digital signatures of each boot software before allowing it to run. Its goal is to prevent attackers who take control of a device, either physically or via malware, from running unauthorized startup code in place of legitimate software.
One item that must be digitally signed is the boot manager, a component stored on a small, dedicated partition on a drive. The boot manager is responsible for initial loading of the operating system. Both BlackLotus and BlackX exploit “Baton Drop”, a logic flaw in Windows Boot Manager that allows attackers to bypass Secure Boot (and, under certain conditions, extract BitLocker encryption keys). The vulnerability, identified as CVE-2022-21894, was discovered in 2022. Microsoft patched the vulnerability that same year, but did not revoke trust in the certificate used to sign vulnerable legacy boot managers. BlackLotus exploited this loophole and then loaded a malicious kernel-mode driver.
Gn tech
