UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
Summary
BlackX, a UEFI bootkit, reportedly infected Windows systems even after organizations installed Microsoft’s available updates. It exploits a flaw in older Windows boot managers to bypass Secure Boot and run malicious code early in startup; the article describes Microsoft’s gradual effort to block those vulnerable boot managers.Key Facts
- BlackLotus was the first publicly documented in-the-wild UEFI bootkit reported to bypass Secure Boot on fully updated Windows 11 systems.
- BlackLotus and BlackX exploit the Windows boot manager flaw known as Baton Drop, tracked as CVE-2022-21894.
- Microsoft patched the underlying vulnerability in 2022, but the patch did not revoke trust in the certificate used to sign older vulnerable boot managers.
- Microsoft began additional mitigations in 2023, including adding the Windows UEFI CA 2023 certificate to Secure Boot’s trusted-certificate database.
- In 2024, Microsoft introduced a way to add the older Windows Production PCA 2011 certificate to Secure Boot’s forbidden-signatures database.
- The article says organizations infected by BlackX had installed the patches and updates described in the report.
- UEFI bootkits can run before many operating-system defenses start and may persist after Windows is reinstalled if the infected boot partition remains intact.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
