Home / Technology / New BlackX Bootkit Exploits Microsoft's Secure Boot Gaps
New BlackX Bootkit Exploits Microsoft's Secure Boot Gaps
3 Nov
Summary
- BlackX, a UEFI bootkit, bypasses Secure Boot on updated Windows 11.
- It exploits a logic flaw in the Windows boot manager, "Baton Drop".
- Microsoft's phased patch rollout created a vulnerability window.
A sophisticated UEFI bootkit named BlackX has emerged, successfully circumventing Microsoft's Secure Boot protections on fully updated Windows 11 systems. This discovery highlights a critical gap that allows malicious code to execute before the operating system fully loads and its defenses become active.
The BlackX bootkit exploits a logic flaw within the Windows boot manager, termed "Baton Drop" (CVE-2022-21894). This vulnerability, known since 2022, allows attackers to bypass Secure Boot and potentially extract BitLocker encryption keys.
Microsoft had attempted to address this issue through a series of updates starting in 2023. However, the company's strategy of gradually revoking trust in older signing certificates, to prevent rendering machines unbootable, inadvertently created a persistent vulnerability. This approach requires system administrators to take additional manual steps to fully activate the security patches.
Kaspersky, the security firm that identified BlackX, noted that many organizations likely overlooked the necessity of these extra steps. The threat actor behind BlackX appears to have capitalized on this lack of clarity, leading to infections even on systems that had received Microsoft's latest security bulletins.
