UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?

In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational.

Microsoft had already patched the vulnerability that BlackLotus exploited in 2022. In 2023 and 2024, Microsoft issued additional updates. The first added a new certificate that no longer trusted the vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers. The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches. So how did they fall victim?

UEFI bootkit refresher

Before discussing the incident further, a brief review of BlackLotus and UEFI malware is in order. Short for Unified Extensible Firmware Interface, UEFI is firmware that runs immediately after a computer is turned on. One of its main jobs is to load system configuration settings, identify and initialize hardware components, and prepare the computer to start its OS.

Another important UEFI function is Secure Boot, a security feature that establishes a chain of trust by verifying the digital signatures of each piece of boot software before allowing it to execute. Its purpose is to prevent attackers who gain control of a device, either physically or through a malware compromise, from running unauthorized boot code in place of legitimate software.

One item that must be digitally signed is the boot manager, a component stored on a small dedicated partition on a drive. The boot manager is responsible for the initial loading of the OS. Both BlackLotus and BlackX exploit “Baton Drop,” a logic flaw in the Windows boot manager that allows attackers to bypass Secure Boot (and, under certain conditions, extract BitLocker encryption keys). The vulnerability, tracked as CVE-2022-21894, came to light in 2022. Microsoft fixed the vulnerability that same year, but it didn’t revoke trust in the certificate used to sign older vulnerable boot managers. BlackLotus exploited this gap and went on to load a malicious kernel-mode driver.

What makes BlackLotus and BlackX so valuable to attackers is that they execute early in the boot process, allowing them to load malicious drivers into the Windows kernel before many OS and security defenses are running. UEFI bootkits can be difficult to detect without specialized security tools and may survive an OS reinstallation if the infected boot partition remains intact. While bootkits require attackers to first compromise a device, they are particularly valuable because they combine stealth, persistence, and extensive control over the OS.

The discovery of BlackLotus marked a major milestone because it transformed bootkits that bypassed Secure Boot from a theoretical threat to a real one. The ability of BlackX to achieve the same feat is similarly notable.

Exploiting a lack of clarity

In May 2023—two months after the discovery of BlackLotus—Microsoft began a yearslong process aimed at closing the vulnerability once and for all. Having patched the underlying bootloader vulnerability in 2022, Microsoft’s May 2023 patch batch included security updates to prevent attackers from loading older vulnerable boot managers. The mitigation process included adding a new signing certificate, Windows UEFI CA 2023, to Secure Boot’s database of trusted certificates. In 2024, Microsoft introduced a broader mitigation that provided a way to add the old certificate, Windows Production PCA 2011, to Secure Boot’s forbidden-signatures database. The latter step would prevent older boot managers signed under the 2011 certificate from running.

But as Ars reported at the time, this second patch didn’t revoke trust in the older vulnerable boot managers either. Fear of rendering potentially millions of devices unbootable if they hadn’t received the necessary updates prevented Microsoft from immediately enforcing the revocations. Unlike most patches, the updates alone didn’t provide complete protection. This state of purgatory has existed ever since and is what allowed BlackX to bypass Secure Boot three years after BlackLotus.

“This patch deployment practice creates a problem—as it is extremely unusual for a system administrator to take extra steps after installing an update,” a researcher from Kaspersky, the security firm that discovered the BlackX infections, wrote recently. “Usually, when applying patches, system administrators take no further action unless an installation failure occurs. These instructions for activating the patch are buried deep on the Microsoft website, and we assess that they are quite hard for an average IT administrator to notice.”

A Microsoft representative said in an email that the company is advising customers to follow guidance in this Knowledge Base post published two weeks ago. Nowhere in it, though, does Microsoft warn that the patches released to date do nothing to protect customers from Baton Drop attacks.

As Kaspersky notes, Microsoft leaves out that after installing the patches, most administrators must take an additional action described in this 2023 Knowledge Base article. (It’s not clear from this article what the status is for home Windows users.)

The BlackX incident underscores the difficult balancing act Microsoft must perform. Revoke the key before the new one has been installed, and a machine becomes little more than an expensive paperweight. Allow the old patch to be trusted for four years and counting, and successful exploitation is almost inevitable. The middle ground, it would seem, would be for Microsoft to be more explicit about the risks that result when the 2011 certificate isn’t manually revoked. Last week’s Knowledge Base article would have been an ideal place to do that, very possibly to the benefit of threat actors.

“It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch,” Kaspersky said. “As such, we believe they decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit.”

Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82.