BlackX bootkit bypassed Secure Boot on fully updated Windows — Ars Technica

The BlackX bootkit infected computers with installed Windows updates and managed to bypass the Secure Boot mechanism. As Ars Technica reports, the infected organizations installed fixes released by Microsoft, but for the protection to be fully applied, administrators had to take an additional manual step — revoke trust in the old digital certificate.

Use of an old vulnerability

BlackX uses Baton Drop, a logic flaw in the Windows boot manager tracked as CVE-2022-21894. The vulnerability makes it possible to bypass Secure Boot and, under certain conditions, obtain BitLocker encryption keys. Microsoft fixed the flaw in 2022 but did not revoke trust in the certificate used to sign the old vulnerable boot managers.

The bootkit launches at an early stage of the computer's boot process — before Windows and many security mechanisms fully start. This allows attackers to load malicious drivers into the Windows kernel. Such programs are difficult to detect without specialized security tools. They can also persist after the operating system is reinstalled if the infected boot partition of the disk remains unchanged.

More current news is available on the UA.News Telegram channel Telegram.

Updates required manual activation

In May 2023, Microsoft added a new Windows UEFI CA 2023 certificate to the Secure Boot trusted certificate database. The following year, the company provided a mechanism for adding the old Windows Production PCA 2011 certificate to the revoked list. This was intended to block the launch of old boot managers signed with the 2011 certificate.

At the same time, the updates alone did not provide full protection: to block old bootloaders, most administrators had to manually activate the relevant mechanism. A researcher at Kaspersky, the company that discovered the BlackX infections, noted that system administrators usually do not take additional actions after installing updates, while activation instructions are located deep within Microsoft's website.

According to Kaspersky, the campaign operators may have taken into account that few organizations understood the importance of manually activating protection against Baton Drop. Researchers believe the attackers studied how BlackLotus — a bootkit discovered in 2023 — works and created its analogue.