UEFI Bootkit: BlackLotus Bypasses Microsoft Patches on Fully Updated Windows 11 Systems
2023: BlackLotus becomes the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems.
In 2023, the malware known as BlackLotus became a significant security concern, demonstrating its ability to bypass Microsoft's Secure Boot feature on fully patched Windows 11 systems.
Microsoft had addressed the vulnerability exploited by BlackLotus in 2022 by introducing a new certificate that distrusts vulnerable Windows boot managers.
In 2023 and 2024, Microsoft issued additional updates that provided means to revoke trust in the digital certificate used to sign older Windows boot managers.
Despite the patches, organizations affected by the BlackX variant of BlackLotus had already installed all of the updates.
How Did Organizations Fall Victim to BlackLotus?
The incident raises questions about the effectiveness of Microsoft's security measures on fully updated systems.
- The BlackX variant of BlackLotus demonstrates the ability to bypass Secure Boot on fully patched Windows 11 systems.
- Microsoft introduced a new certificate in 2022 that distrusts vulnerable Windows boot managers.
- Microsoft issued updates in 2023 and 2024 to revoke trust in the digital certificate used to sign older Windows boot managers.
- Organizations affected by BlackLotus had already installed all of the updates.
- The incident highlights the need for continuous security monitoring and improvement.
The vulnerability was exploited by BlackLotus, a variant of the BlackLotus malware, which demonstrated the ability to bypass Microsoft's Secure Boot feature on fully updated Windows 11 systems.
In 2022, Microsoft introduced a new certificate that distrusted vulnerable Windows boot managers.
A series of updates were released by Microsoft in 2023 and 2024 to revoke trust in the digital certificate used to sign older Windows boot managers.
Despite having installed all the updates, organizations affected by BlackLotus had already fallen victim to the malware.
The incident underscores the importance of continuous security monitoring and improvement.
</body> </html><small>Source: Ars Technica — read the original story there.</small>
