From Ars Technica · · 2m
BlackX bootkit defeats Windows patches meant to stop it
A new UEFI bootkit infected fully patched Windows machines by exploiting a gap in Microsoft's three-year mitigation strategy.
In brief
A new UEFI bootkit infected fully patched Windows machines by exploiting a gap in Microsoft's three-year mitigation strategy. BlackX, a new UEFI bootkit, infected fully patched Windows machines by exploiting a flaw Microsoft patched in 2022 but never fully revoked, exposing a gap in the company's three-year mitigation…
BlackX bootkit breaks through
In 2023, BlackLotus became the first documented UEFI bootkit to bypass Secure Boot on fully updated Windows 11 systems, running malicious code before Windows loaded.
Microsoft patched, but incompletely
Microsoft patched the vulnerability in 2022, then added updates in 2023 and 2024. Yet organizations that installed all patches still fell victim to the new BlackX bootkit.
What UEFI firmware does
UEFI, Unified Extensible Firmware Interface, runs immediately after a computer turns on. It loads system settings, initializes hardware, and prepares the computer to start its operating system.
Secure Boot's chain of trust
Secure Boot verifies digital signatures of each piece of boot software before allowing it to execute, preventing attackers from running unauthorized boot code instead of legitimate software.
The Baton Drop flaw
Both BlackLotus and BlackX exploit Baton Drop, a logic flaw in the Windows boot manager tracked as CVE-2022-21894. It allows attackers to bypass Secure Boot and extract BitLocker encryption keys.
Why bootkits are dangerous
Bootkits execute early in the boot process, loading malicious drivers before many OS and security defenses run. They are difficult to detect and may survive OS reinstallation.
Microsoft's incomplete mitigation
In May 2023, Microsoft added Windows UEFI CA 2023 certificate to Secure Boot. In 2024, it provided a way to revoke the old Windows Production PCA 2011 certificate. But it never enforced revocation.
The hidden extra step
Microsoft's patches alone did not provide complete protection. Administrators had to take additional manual steps described in a 2023 Knowledge Base article buried deep on Microsoft's website.
“This patch deployment practice creates a problem, as it is extremely unusual for a system administrator to take extra steps after installing an update.”
Why administrators missed it
Kaspersky, which discovered BlackX infections, noted that system administrators typically take no further action after installing patches unless installation fails. The revocation instructions were hard to notice.
Microsoft's impossible choice
Revoking the old certificate too early would render millions of unpatched machines unbootable. Allowing it to remain trusted for four years made exploitation almost inevitable, as BlackX proved.
The one thing
BlackX, a new UEFI bootkit, infected fully patched Windows machines by exploiting a flaw Microsoft patched in 2022 but never fully revoked, exposing a gap in the company's three-year mitigation effort.
