In 2023, the malware known as BlackLotus became the first publicly documented UEFI bootkit found in the wild that could bypass Secure Boot on fully updated Windows 11 systems. Although Microsoft had patched the exploited vulnerability in 2022 and issued further updates in 2023 and 2024, a related bootkit tracked as BlackX still infected organizations that had installed all of those patches. The incident highlights how weaknesses in the certificate-based chain of trust can allow malicious code to run before Windows and its security defenses have fully loaded.
Updating the UEFI bootkit
To understand the incident, it helps to examine BlackLotus and UEFI-based malware. The Unified Extensible Firmware Interface (UEFI) is firmware that runs immediately after a computer is powered on. It loads system configuration settings, identifies and initializes hardware components, and prepares the machine to boot its operating system.
UEFI also supports Secure Boot, a security feature that establishes a chain of trust by checking the digital signature of each piece of boot software before allowing it to run. The goal is to prevent an attacker who has gained control of a device—either physically or through malware—from replacing legitimate boot software with unauthorized code.
The boot manager is one of the components that must have a valid digital signature. Stored in a small, dedicated partition on the drive, it is responsible for beginning the operating system’s startup process.
Both BlackLotus and BlackX exploit “Baton Drop,” a logical flaw in Windows Boot Manager that can allow attackers to bypass Secure Boot and, under certain conditions, extract BitLocker encryption keys. The vulnerability is tracked as CVE-2022-21894.
Microsoft fixed the vulnerability in 2022, but the certificates used to sign older, vulnerable boot managers were not revoked. BlackLotus exploited that gap to continue loading malicious kernel-mode drivers.
Microsoft later issued additional updates in 2023 and 2024. One update added a new certificate that no longer trusts vulnerable boot managers. Another provided a way to revoke trust in the digital certificate used to sign the older, vulnerable Windows Boot Manager. The emergence of BlackX despite organizations installing all of these patches shows that updating the vulnerability alone was not enough to eliminate the underlying trust in previously signed boot components.
Source: arstechnica.com