BlackLotus UEFI bootkit: Myth confirmed

    BlackLotus UEFI bootkit: Myth confirmed

    BlackLotus UEFI bootkit: Myth confirmed


    Posted: 02 Mar 2023

    The number of UEFI vulnerabilities discovered in recent years and the failures in patching them or revoking vulnerable binaries within a reasonable time window hasn’t gone unnoticed by threat actors. As a result, the first publicly known UEFI bootkit bypassing the essential platform security feature – UEFI Secure Boot – is now a reality. In this blogpost we present the first public analysis of this UEFI bootkit, which is capable of running on even fully-up-to-date Windows 11 systems with UEFI Secure Boot enabled. Functionality of the bootkit and its individual features leads us to believe that we are dealing with a bootkit known as BlackLotus, the UEFI bootkit being sold on hacking forums for $5,000 since at least October 2022.

    UEFI bootkits are very powerful threats, having full control over the OS boot process and thus capable of disabling various OS security mechanisms and deploying their own kernel-mode or user-mode payloads in early OS startup stages. This allows them to operate very stealthily and with high privileges. So far, only a few have been discovered in the wild and publicly described (e.g., multiple malicious EFI samples we discovered in 2020, or fully featured UEFI bootkits such as our discovery last year – the ESPecter bootkit – or the FinSpy bootkit discovered by researchers from Kaspersky).

    UEFI bootkits may lose on stealthiness when compared to firmware implants – such as LoJax; the first in-the-wild UEFI firmware implant, discovered by our team in 2018 – as bootkits are located on an easily accessible FAT32 disk partition. However, running as a bootloader gives them almost the same capabilities as firmware implants, but without having to overcome the multilevel SPI flash defenses, such as the BWE, BLE, and PRx protection bits, or the protections provided by hardware (like Intel Boot Guard). Sure, UEFI Secure Boot stands in the way of UEFI bootkits, but there are a non-negligible number of known vulnerabilities that allow bypassing this essential security mechanism. And the worst of this is that some of them are still easily exploitable on up-to-date systems even at the time of this writing – including the one exploited by BlackLotus.

    Our investigation started with a few hits on what turned out to be the BlackLotus user-mode component – an HTTP downloader – in our telemetry late in 2022. After an initial assessment, code patterns found in the samples brought us to the discovery of six BlackLotus installers (both on VirusTotal and in our own telemetry). This allowed us to explore the whole execution chain and to realize that what we were dealing with here is not just regular malware.

    Read more: BlackLotus UEFI bootkit: Myth confirmed | WeLiveSecurity
    Brink's Avatar Posted By: Brink
    02 Mar 2023


  1. Posts : 16,573
    Windows 10 Home x64 Version 22H2 Build 19045.3930
       #1

    Thanks for posting this.

    I'm confused by two parts of the Eset description:
    1 The third item in the section Following are the key points about BlackLotus and a timeline summarizing the series of events related to it
    Although the vulnerability was fixed in Microsoft’s January 2022 update, its exploitation is still possible as the affected, validly signed binaries have still not been added to the UEFI revocation list. BlackLotus takes advantage of this, bringing its own copies of legitimate – but vulnerable – binaries to the system in order to exploit the vulnerability.
    2 Under the heading Mitigations and remediation
    First of all, of course, keeping your system and its security product up to date is a must – to raise a chance that a threat will be stopped right at the beginning, before it’s able to achieve pre-OS persistence.
    I think they are saying that an MS update fixed the problem of future infiltration but did not fix the problem for systems that have already been infiltrated.
    But I'm not sure.
    Perhaps my interpretation is too optimistic.

    I also noticed, under the heading Step 3 – Disabling BitLocker, "... would lead to a BitLocker recovery screen at the next bootup and would tip the victim off that the system had been compromised".
    There have been some Ten/ElevenForums reports of this recovery screen appearing unexpectedly.

    All very worrying,
    Denis
      My Computer


  2. NMI
    Posts : 1,095
    Windows 11 Pro, Version 22H2
       #2

    Try3 said:
    I think they are saying that an MS update fixed the problem of future infiltration but did not fix the problem for systems that have already been infiltrated.
    But I'm not sure.
    Perhaps my interpretation is too optimistic.
    I think they can't block it properly for anyone because they would lock out those who haven't updated:

    Further down, under Exploiting CVE-2022-21894;

    Although the vulnerability was fixed in Microsoft’s January 2022 update, its exploitation is still possible because the affected binaries have still not been added to the UEFI revocation list. As a result, attackers can bring their own copies of vulnerable binaries to their victims’ machines to exploit this vulnerability and bypass Secure Boot on up-to-date UEFI systems.
    But perhaps my interpretation is pessimistic!


    Try3 said:
    I also noticed, under the heading Step 3 – Disabling BitLocker, "... would lead to a BitLocker recovery screen at the next bootup and would tip the victim off that the system had been compromised".
    There have been some Ten/ElevenForums reports of this recovery screen appearing unexpectedly.
    That's a very good point.
      My Computer


  3. Posts : 7,829
    Windows 11 Pro 64 bit
       #3

    I expect the NSA and GCHQ are fully aware of the techniques!
      My Computers


  4. Posts : 1,204
    11 Home
       #4

    Try3 said:
    Thanks for posting this.

    I'm confused by two parts of the Eset description:
    1 The third item in the section Following are the key points about BlackLotus and a timeline summarizing the series of events related to it 2 Under the heading Mitigations and remediation I think they are saying that an MS update fixed the problem of future infiltration but did not fix the problem for systems that have already been infiltrated.
    But I'm not sure.
    Perhaps my interpretation is too optimistic.

    I also noticed, under the heading Step 3 – Disabling BitLocker, "... would lead to a BitLocker recovery screen at the next bootup and would tip the victim off that the system had been compromised".
    There have been some Ten/ElevenForums reports of this recovery screen appearing unexpectedly.

    All very worrying,
    Denis
    Windows Measured Boot - How It Helps To Secure Windows OS Platform HTMD Blog
      My Computers


  5. Posts : 16,573
    Windows 10 Home x64 Version 22H2 Build 19045.3930
       #5

    How does that link relate to what I posted?

    Denis
      My Computer


  6. Posts : 1,204
    11 Home
       #6

    Try3 said:
    How does that link relate to what I posted?
    It helps to clarify how M$ still hasn't fixed the root of the problem. It's still possible for malware to bypass Secure Boot because the affected signatures haven't been revoked: these signatures haven't been added to the DBX file yet. As a result from this, proper detection via Measured Boot has become a necessity, now more than ever. This is how Secure Boot looks like:

      My Computers


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 20:19.
Find Us




Windows 10 Forums