Security researchers have identified infections involving a UEFI bootkit tracked as BlackX that successfully compromised fully updated Windows systems despite multiple security patches released over several years. The malware exploits a vulnerability known as Baton Drop, tracked as CVE-2022-21894, which allows attackers to bypass the Secure Boot security mechanism.
UEFI, or Unified Extensible Firmware Interface, is firmware that runs immediately after a computer powers on and is responsible for initializing hardware and preparing the system to load its operating system. Secure Boot establishes a chain of trust by verifying digital signatures of boot software before execution. The Baton Drop flaw enables attackers to circumvent this protection by compromising the boot manager, the component responsible for loading the operating system.
Microsoft first patched the underlying vulnerability in 2022 but did not revoke trust in the certificate used to sign older vulnerable boot managers. A predecessor bootkit called BlackLotus exploited this gap. Microsoft subsequently issued additional updates: one in 2023 added a new certificate to prevent loading older vulnerable boot managers, and another in 2024 provided means to revoke trust in the old certificate. However, organizations infected with BlackX had installed all available patches, yet still fell victim to the compromise.
The challenge stems from Microsoft’s cautious approach to enforcement. Fully revoking the older certificate risked rendering millions of devices unbootable if they had not received necessary updates. The company’s solution required administrators to take additional manual steps beyond standard patch installation to fully activate protections. According to security researchers at Kaspersky, who discovered the BlackX infections, these activation instructions are buried in Microsoft’s documentation and are difficult for typical administrators to locate or understand.
Microsoft representative communications have not adequately communicated the residual risks to customers who install patches without performing manual revocation steps. Researchers suggest that threat actors likely recognized that most organizations were unaware of the need to manually activate the full protections, making investment in developing a BlackX variant worthwhile. The incident highlights tensions between security robustness and the practical challenges of managing widespread software updates across diverse computing environments.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI