BlackLotus – Bypasses Windows Secure Boot

Researchers discovered a malware dubbed BlackLotus, which bypasses Microsoft’s Secure Boot, will spawn copycats that were available on the Dark Web and attracts firmware attackers to increase their activity.

Starting this month, March 2023 researchers published an analysis of the BlackLotus boot kit, which bypasses UEFI Secure Boot.  

UEFI is the lowest level of firmware on a system finding a vulnerability in the interface code allows an attacker to execute malware before the OS kernel, security apps, and other software. This ensures the implantation of persistent malware that normal security agents will not detect. It also offers the ability to execute in kernel mode, to control and subvert every other program on the machine even after OS reinstalls and hard drive replacements and load additional malware at the kernel level.

The US DHS and DoC recently warned about the persistent threat posed by firmware rootkits and boot kits in a draft report on supply chain security issues. Here with BlackLotus, the stakes are set high while

Microsoft patched the flaw that BlackLotus targets aka Baton Drop, tracked as CVE-2022-21894. The patch only makes exploitation more difficult not impossible, and the impact of the vulnerability will be hard to measure because affected users will likely not see signs of compromise. The certificate of the vulnerable version remains valid

With this, an attacker can foothold the machine they can turn off logging, and essentially lie to every kind of defensive countermeasure that might have on the system to tell it’s safe. Due to its increasing adoption nature, threat actors’ goal is persistence on the system, and with UEFI persistence, they can operate much stealthier than with any other kind of OS-level persistent.

Microsoft maintains a list of cryptographic hashes of legitimate Secure Boot bootloaders. To prevent the vulnerable boot loader from working, the company would have to revoke the hash, but that would also prevent legitimate — although unpatched — systems from working.

It is recommended that organization to do update their firmware and revocation lists on a regular basis and monitor endpoints for indications that an attacker has made modifications.

This research was documented by researchers from ESET

Indicators of Compromise

• 05846D5B1D37EE2D716140DE4F4F984CF1E631D1
• A5A530A91100ED5F07A5D74698B15C646DD44E16
• D82539BFC2CC7CB504BE74AC74DF696B13DB486A
• 16B12CEA54360AA42E1120E82C1E9BC0371CB635
• DAE7E7C4EEC2AC0DC7963C44A5A4F47D930C5508
• 45701A83DEC1DC71A48268C9D6D205F31D9E7FFB
• 2CE056AE323B0380B0E87225EA0AE087A33CD316
• 5A0074203ABD5DEB464BA0A79E14B7541A033216
• 5DC9CBD75ABD830E83641A0265BFFDDD2F602815
• 97AEC21042DF47D39AC212761729C6BE484D064D
• ADCEEC18FF009BED635D168E0B116E72096F18D2
• DBC064F757C69EC43517EFF496146B43CBA949D1
• 06AF3016ACCDB3DFE1C23657BF1BF91C13BAA757
• 0C0E78BF97116E781DDE0E00A1CD0C29E68D623D
• 6D8CEE28DA8BCF25A4D232FEB0810452ACADA11D
• 74FF58FCE8F19083D16DF0109DC91D78C94342FA
• ACC74217CBE3F2E727A826B34BDE482DCAE15BE6
• 111C4998F3264617A7A9D9BF662D4B1577445B20
• 17FA047C1F979B180644906FE9265F21AF5B0509
• 1F3799FED3CF43254FE30DCDFDB8DC02D82E662B
• 4B882748FAF2C6C360884C6812DD5BCBCE75EBFF
• 91F832F46E4C38ECC9335460D46F6F71352CFFED
• 994DC79255AEB662A672A1814280DE73D405617A
• FFF4F28287677CAABC60C8AB36786C370226588D
• 71559C3E2F3950D4EE016F24CA54DA17D28B9D82
• D6D3F3151B188A9DA62DEB95EA1D1ABEFF257914
• 547FAA2D64B85BF883955B723B07635C0A09326B
• D1BBAA3D408E944C70B3815471EED7FA9AEE6425
• 0E6DD7110C38464ECAA55EE4E2FA303ADA0EDEFB
• D6BB89D8734B3E49725362DAE9A868AE681E8BD6
• 164BB587109CFB20824303AD1609A65ABB36C3E9