Black Arrow Cyber Alert 07 March 2023 – Black Lotus UEFI Bootkit Malware Bypasses Secure Boot

Executive Summary

A new UEFI bootkit called BlackLotus (not to be confused with Black Lotus Labs) has become the first publicly known malware with the capability of bypassing secure boot defences, rendering it a serious threat. A bootkit is a malicious program designed to load as early as possible during the boot process, before other security components are loaded and BlackLotus does this by targeting the UEFI which is low level firmware, responsible for booting up most modern computers.

What’s the risk to my business?

Successful exploitation allows an attacker to effectively control the computer and allow them to remotely execute code and gain the highest level of privilege. Successful exploitation requires the attacker to either have remote privileged access, or physical access to the target computer.

Technical Summary

The bootkit exploits CVE-2022-21894, which is a Secure Boot vulnerability. Although patched by Microsoft in January, the vulnerable signed binaries are not on the UEFI revocation list which flags boot files that should not be trusted and as such the malware can run on “patched” systems. Once the bootkit has run successfully, it is engineered to communicate with a command-and-control server, allowing the bootkit to retrieve additional user-mode or kernel-mode malware.

What can I do?

There is currently no known patch and the bootkit can run even on fully patched Windows 11 systems which have Secure Boot enabled. Security controls to mitigate this vulnerability from being exploited should focus on preventing an attacker from obtaining remote privileged access to the device through secure identity and access management, or to prevent unauthorised individuals from having physical access to the device. Black Arrow will continue to monitor the situation, and this alert will be updated when more information is made available.

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Research on BlackLotus malware can be found here: https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/

Details for CVE-2023-21716 can be found here: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21716