BlackLotus became the first publicly documented UEFI bootkit found in the wild that could bypass Secure Boot on fully updated Windows 11 systems. Although Microsoft had patched the underlying vulnerability in 2022 and issued additional updates in 2023 and 2024—including new certificates and a mechanism for revoking the certificates used to sign vulnerable boot managers—another bootkit, tracked as BlackX, was still able to infect systems that had received those patches.
Refreshing the UEFI bootkit
To understand the incident, it helps to review how BlackLotus and other UEFI malware work. The Unified Extensible Firmware Interface (UEFI) is firmware that runs immediately after a computer is turned on. It configures the system, identifies and initializes hardware, and prepares the computer to start the operating system.
UEFI also supports Secure Boot, a security feature that establishes a chain of trust by checking the digital signature of each piece of boot software before allowing it to run. The goal is to prevent an attacker who has gained control of a device—either physically or through malware—from replacing legitimate boot code with unauthorized software.
The boot manager is one of the components that must carry a valid digital signature. It is stored in a small, dedicated partition on the drive and is responsible for beginning the operating system’s startup process.
Both BlackLotus and BlackX exploit “Baton Drop,” a logical flaw in Windows Boot Manager that can allow attackers to bypass Secure Boot and, under certain conditions, extract BitLocker encryption keys. The vulnerability is tracked as CVE-2022-21894.
Microsoft fixed the vulnerability in 2022, but the certificates used to sign older, vulnerable boot managers were not revoked at the time. BlackLotus exploited that gap to continue loading malicious kernel-mode drivers.
Source: arstechnica.com
